Precise web security alert

• US 8,001,599 B2
• Filed: 07/15/2008
• Issued: 08/16/2011
• Est. Priority Date: 07/15/2008
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: McBrearty, Gerald F., Mullen, Shawn P., Shieh, Johnny Meng-Han, Keohane, Susann M., Murillo, Jessica C.
• Primary Examiner(s): Song; Hosuk
• Assistant Examiner(s): To; Baotran N
• Application Number:
  US12/173,080
• Publication Number:
  US 20100017878A1
• Time in Patent Office: 1,127 Days
• Field of Search: 726/22, 726/23, 726/24, 726/25, 713/188, 709/224, 709/229
• US Class Current: 726/22
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for providing an alert when a potentially or likely malicious web site is browsed to by a user. The method maintains web site identification details. If a web site purporting to be a known, previously identified, encountered and utilized web site is browsed to and requests information, the user is alerted to the precise differences between the stored web site historical identity and the identity of the present requester.

Claims

1. A method for providing an alert, performed by a processor executing non-transitory computer usable program code, comprising:

maintaining, by a device, a history of key bits of information of at least one web site browsed by a user further including;

storing a uniform resource locater (URL) for said web site;

storing an internet protocol (IP) address for said web site;

storing an indicator of data entry to said web site;

storing an indicator that communication with said web site occurred over a secure connection;

monitoring a current flow of key bits of information between said user and said web site further including;

comparing a URL for currently requested web site with said stored URL for said web site;

comparing an IP address for currently requested web site with said stored IP address for said web site;

comparing portions of an IP address for currently requested web site with said stored IP address for said web site;

comparing a current indicator of data entry with said stored indicator of data entry to said web site;

comparing a current indicator of a secure connection with said stored indicator that communication with said web site occurred over a secure connection; and

alerting said user to a precise difference between said current flow of key bits of information and said history of key bits of information.