Method and apparatus for detecting system message misrepresentation using a keyword analysis

• US 8,516,100 B1
• Filed: 02/04/2010
• Issued: 08/20/2013
• Est. Priority Date: 02/04/2010
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Oliver, Ian James
• Primary Examiner(s): JACOBS, LASHONDA T
• Application Number:
  US12/700,543
• Time in Patent Office: 1,293 Days
• Field of Search: 709/223, 709/224, 709/225, 709/229, 709/203, 726/12, 726/22, 726/23, 726/24, 726/25, 726/27, 713/201
• US Class Current: 709/223
• CPC Class Codes: H04L 51/212 using filtering or selective blocking

Abstract

A method and apparatus for detecting system message misrepresentation using a keyword analysis is described. In one embodiment, the method of using one or more processors for detecting system message misrepresentation in memory by performing a keyword analysis, comprising monitoring visual representation object creation within a user interface, accessing keyword information comprising commonly used text for misrepresenting system messages, examining internet activity using the keyword information to produce an examination result, wherein the internet activity is for the created visual representation objects, identifying deceptive text within at least one of the created visual representation objects based on the examination result and producing indicia of detection as to the deceptive text.

Claims

1. A method of using one or more processors for detecting system message misrepresentation in memory by performing a keyword analysis, comprising:

monitoring, via at least one computer processor, visual representation object creation within a user interface by detecting each new window that is created by a browser;

accessing keyword information comprising commonly used text for misrepresenting system messages;

examining internet activity by parsing created visual representation objects displayed to a user and using the keyword information to produce an examination result, wherein the internet activity is for the created visual representation objects and the examination result comprises a value based upon matching keywords;

identifying deceptive text within at least one of the created visual representation objects based on the examination result; and

producing indicia of detection as to the deceptive text.

2. The method of claim 1, wherein producing the indicia further comprises modifying the at least one of the created visual representation objects to highlight the deceptive text.

3. The method of claim 1, wherein the examination result is produced after the visual representation objects are visible to the user.

4. The method of claim 1 further comprising examining URL chain information associated with the deceptive text to identify at least one variant, wherein the at least one variant is added to the keyword information.

5. The method of claim 1, wherein producing the indicia further comprises terminating the at least one of the created visual representation objects.

6. The method of claim 1 further comprising identifying legitimate keywords within the deceptive text based on a white list.

7. The method of claim 1, wherein examining the internet activity further comprising:

monitoring textual data assignment in the memory; and

identifying portions of the assigned textual data that form at least one commonly used keyword for misrepresenting a system message.

8. The method of claim 1, wherein examining the internet activity further comprising:

assigning weights to keywords within the created visual representation objects; and

computing values for portions of textual data.

9. The method of claim 8, wherein the deceptive text having a value that exceeds a pre-defined threshold value according to a metric for detecting the system message misrepresentation.

10. The method of claim 1, wherein identifying the deceptive text further comprises transforming the internet activity and the keyword information into the indicia of detection.

11. An apparatus for using one or more processors for detecting system message misrepresentation in memory by performing a keyword analysis, comprising:

means for monitoring visual representation object creation within a user interface by detecting each new window that is created by a browser;

means for accessing keyword information comprising commonly used text for misrepresenting system messages;

means for examining internet activity by parsing created visual representation objects displayed to a user and using the keyword information to produce an examination result, wherein the internet activity is for the created visual representation objects and the examination result comprises a value based upon matching keywords;

means for identifying deceptive text within at least one of the created visual representation objects based on the examination result; and

means for producing indicia of detection as to the deceptive text.

12. The apparatus of claim 11 further comprising means for modifying the at least one of the created visual representation objects to highlight the deceptive text.

13. The apparatus of claim 11 further comprising means for examining URL chain information associated with the deceptive text to identify at least one variant, wherein the at least one variant is added to the keyword information.

14. The apparatus of claim 11 further comprising means for transforming the internet activity and the keyword information into the indicia of detection.

15. A computer-readable-storage medium comprising one or more processor-executable instructions that, when executed by at least one processor, causes the at least one processor to:

monitor visual representation object creation within a user interface by detecting each new window that is created by a browser;

access keyword information comprising commonly used text for misrepresenting system messages;

examine internet activity by parsing created visual representation objects displayed to a user and using the keyword information to produce an examination result, wherein the internet activity is for the created visual representation objects and the examination result comprises a value based upon matching keywords;

identify deceptive text within at least one of the created visual representation objects based on the examination result; and

produce indicia of detection as to the deceptive text.

16. The computer-readable-storage medium of claim 15 further comprising one or more processor-executable instructions that, when executed by the at least one processor, causes the at least one processor to:

modify the at least one of the created visual representation objects to highlight the deceptive text.

17. The computer-readable-storage medium of claim 15 further comprising one or more processor-executable instructions that, when executed by the at least one processor, causes the at least one processor to:

examine url chain information associated with the deceptive text to identify at least one variant, wherein the at least one variant is added to the keyword information.

18. The computer-readable-storage medium of claim 15 further comprising one or more processor-executable instructions that, when executed by the at least one processor, causes the at least one processor to:

transform the internet activity and the keyword information into the indicia of detection.

19. The computer-readable-storage medium of claim 15 further comprising one or more processor-executable instructions that, when executed by the at least one processor, causes the at least one processor to:

assign weights to keywords within the created visual representation objects; and

compute values for portions of textual data, wherein the deceptive text having a value that exceeds a pre-defined threshold value according to a metric for detecting the system message misrepresentation.

20. The computer-readable-storage medium of claim 15 further comprising one or more processor-executable instructions that, when executed by the at least one processor, causes the at least one processor to:

monitor textual data assignment in a portion of the memory for the created visual representation objects; and

identifying portions of the assigned textual data that form the deceptive text.