Mitigating malware

• US 8,370,938 B1
• Filed: 04/15/2010
• Issued: 02/05/2013
• Est. Priority Date: 04/25/2009
• Status: Active Grant

• Current Assignee: Dasient, Inc. (X Holdings Corp.)
• Original Assignee: Dasient, Inc. (X Holdings Corp.)
• Inventors: Daswani, Neilkumar Murli, Ranadive, Ameet, Rizvi, Shariq
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Hailu, Teshome
• Application Number:
  US12/761,331
• Time in Patent Office: 1,027 Days
• Field of Search: None
• US Class Current: 726/23
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Remediating a suspicious element in a web page is disclosed. An indication of a suspicious element is received. A quarantine instruction is sent to a server of the web page. One example of a quarantine instruction is an instruction to block the page from being served. Another example of a quarantine instruction in as instruction to block an element of the page from being served.

Claims

1. A system for remediating a suspicious element, comprising:

a computer processor;

a detection engine executing on the computer processor and configured to;

emulate presentation of a web page;

identify the suspicious element based on emulating presentation of the web page; and

identify a portion of the web page comprising the suspicious element; and

a quarantine engine configured to;

generate a first quarantine instruction identifying the portion of the web page; and

transmit the first quarantine instruction to a server hosting the web page, the server quarantining at least the portion of the web page in response to receiving the first quarantine instruction, and the server serving a remainder of the web page after quarantining the portion of the web page.

2. The system of claim 1, wherein the identified portion of the web page is one selected from a group consisting of a tag, a tag body, a byte range, and a specified structural portion of the web page.

3. The system of claim 1, wherein the quarantine engine is further configured to verify that the portion of the web page was successfully quarantined.

4. The system of claim 1, wherein the quarantine engine is further configured to:

determine that the portion of the web page was not successfully quarantined; and

transmit a second quarantine instruction in response to determining that the portion of the web page was not successfully quarantined, wherein the second quarantine instruction causes the server to blacklist the entire web page.

5. The system of claim 4, wherein the second quarantine instruction causes the server hosting the web page to serve another web page upon receiving a request for the web page.

6. The system of claim 1, wherein the first quarantine instruction causes insertion of text in the web page, the inserted text indicating that the suspicious element has been removed from the web page.

7. A method for remediating a suspicious element, comprising:

emulating, by a computer processor, presentation of a web page;

identifying the suspicious element based on emulating presentation of the web page;

identifying a portion of the web page comprising the suspicious element;

generating, by the computer processor, a first quarantine instruction identifying the portion of the web page; and

transmitting, by the computer processor, the first quarantine instruction to a server hosting the web page, the server quarantining at least the portion of the web page in response to receiving the first quarantine instruction, and the server serving a remainder of the web page after quarantining the portion of the web page.

8. The method of claim 7, wherein the identified portion of the web page is one selected from a group consisting of a tag, a tag body, a byte range, and a specified structural portion of the web page.

9. The method of claim 7, further comprising verifying that the portion of the web page was successfully quarantined.

10. The method of claim 7, further comprising:

determining that the portion of the web page was not successfully quarantined; and

transmitting a second quarantine instruction in response to determining that the portion of the web page was not successfully quarantined, wherein the second quarantine instruction causes the server to blacklist the entire web page.

11. The method of claim 10, wherein the first quarantine instruction causes the server hosting the web page to serve another web page upon receiving a request for the web page.

12. The method of claim 7, wherein the first quarantine instruction causes insertion of text in the web page, the inserted text indicating that the suspicious element has been removed from the web page.

13. A non-transitory computer readable storage medium comprising a plurality of instructions for remediating a suspicious element, the instructions when executed by a processor causing the processor to:

emulate presentation of a web page;

identify the suspicious element based on emulating presentation page;

identify a portion of the web page comprising the suspicious element;

generate a first quarantine instruction identifying the portion of the web page; and

transmit the first quarantine instruction to a server hosting the web page, the server quarantining at least the portion of the web page in response to receiving the first quarantine instruction, and the server serving a remainder of the web page after quarantining the portion of the web page.

14. The non-transitory computer readable storage medium of claim 13, wherein the identified portion of the web page is one selected from a group consisting of a tag, a tag body, a byte range, and a specified structural portion of the web page.

15. The non-transitory computer readable storage medium of claim 13, further comprising instructions that cause the processor to:

determine that the portion of the web page was not successfully quarantined; and

transmit a second quarantine instruction in response to determining that the portion of the web page was not successfully quarantined, wherein the second quarantine instruction causes the server to blacklist the entire web page.

16. The non-transitory computer readable storage medium claim 15, wherein the second quarantine instruction causes the server hosting the web page to serve another web page upon receiving a request for the web page.

17. The non-transitory computer readable storage medium of claim 13, wherein the first quarantine instruction causes insertion of text in the web page, the inserted text indicating that the suspicious element has been removed from the web page.

18. The non-transitory computer readable storage medium of claim 13, wherein the first quarantine instruction causes the server hosting the web page to serve another web page upon receiving a request for the web page.