Malicious advertisement detection and remediation

• US 8,516,590 B1
• Filed: 02/28/2011
• Issued: 08/20/2013
• Est. Priority Date: 04/25/2009
• Status: Active Grant

• Current Assignee: Dasient, Inc. (X Holdings Corp.)
• Original Assignee: Dasient, Inc. (X Holdings Corp.)
• Inventors: Ranadive, Ameet, Rizvi, Shariq, Daswani, Neilkumar Murli
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US13/037,242
• Time in Patent Office: 904 Days
• Field of Search: 726/24
• US Class Current: 726/24
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

Detecting a malicious advertisement is disclosed. An advertisement is analyzed. A determination that the advertisement is associated with malicious activity is made. An indication that the advertisement is malicious is provided as output. The indication can be provided as a report, such as to a publisher and can also be provided using an API, such as to the entity responsible for serving the advertisement.

Claims

1. A system for detecting a malicious advertisement, comprising:

a computer processor; and

an anti-malvertising module executing on the computer processor and configured to;

identify a web page comprising the advertisement;

determine that the advertisement is hosted by a third party;

periodically request emulation of the web page by a plurality of virtual machines, each of the plurality of virtual machines comprising an instrumented browser configured to perform a dynamic analysis of the web page by emulating presentation of the web page using different user profile information for different web pages;

determine, based on an instance of emulating presentation of the web page, that the advertisement is associated with malicious content; and

provide as output an indication that the advertisement is malicious.

2. The system of claim 1, wherein the anti-malvertising module is further configured to determine a proxy to be used by each of the plurality of virtual machines.

3. The system of claim 1, wherein the anti-malvertising module is further configured to provide the indication as a report to a publisher.

4. The system of claim 1, wherein the anti-malvertising module is further configured to provide the indication using an API.

5. The system of claim 1, wherein the anti-malvertising module is further configured to cause the advertisement to cease being served.

6. The system of claim 1, wherein the indication includes a description of the malicious activity.

7. The system of claim 1, wherein each of the plurality of virtual machines is configured to emulate presentation of the web page by parsing the web page and generating a document object model that represents the relationships between a plurality of elements in the web page.

8. The system of claim 7, wherein the anti-malvertising module is further configured to identify a dynamic lineage of the advertisement corresponding to the instance, wherein the dynamic lineage is further provided as output.

9. The system of claim 8, wherein the dynamic lineage identifies an element inserted into the document object model during presentation, and wherein one of the plurality of virtual machines performing the instance of emulating presentation of the web page is configured to determine that the advertisement is associated with malicious content based on the dynamic lineage.

10. The system of claim 9, wherein the anti-malvertising module is configured to receive, from the instrumented browser of one of the plurality of virtual machines, a notification that the advertisement is associated with malicious content, wherein the instrumented browser is configured to determine that the dynamic element comprises malware and analyze the redirection requests to determine a source of the malware.

11. The system of claim 1, wherein the anti-malvertising module is configured to identify a frequency of requesting emulation of the web page based on determining that the advertisement is hosted by a third party, wherein periodically requesting emulation of the web page is based on the frequency.

12. The system of claim 1, wherein each of the set of user profile information comprises at least one selected from a group consisting of cookies, browser history, system language, and locale.

13. A method for detecting a malicious advertisement, comprising:

identifying a web page comprising the advertisement;

determining that the advertisement is hosted by a third party;

periodically requesting emulation of the web page by a plurality of virtual machines, each of the plurality of virtual machines comprising an instrumented browser configured to perform a dynamic analysis of the web page by emulating presentation of the web page using different user profile information for different web pages;

determining, by a computer processor and based on an instance of emulating presentation of the web page, that the advertisement is associated with malicious content; and

providing, by the computer processor, as output an indication that the advertisement is malicious.

14. The method of claim 13, further comprising:

determining a proxy to be used by each of the plurality of virtual machines.

15. The method of claim 13, further comprising:

causing the advertisement to cease being served.

16. The method of claim 13, further comprising:

emulating, by each of the plurality of virtual machines, presentation of the web page by parsing the web page and generating a document object model that represents the relationships between a plurality of elements in the web page.

17. The method of claim 13, further comprising:

identifying a dynamic lineage of the advertisement corresponding to the instance, wherein the dynamic lineage is further provided as output.

18. The method of claim 13, wherein the instrumented browser tracks redirection requests for downloading content of a dynamic element in the advertisement.

19. The method of claim 13, further comprising:

identifying a frequency of requesting emulation of the web page based on determining that the advertisement is hosted by a third party, wherein periodically requesting emulation of the web page is based on the frequency.

20. A computer program product for detecting a malicious advertisement, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

identifying a web page comprising the advertisement;

determining that the advertisement is hosted by a third party;

periodically requesting emulation of the web page by a plurality of virtual machines, each of the plurality of virtual machines comprising an instrumented browser configured to perform a dynamic analysis of the web page by emulating presentation of the web page using different user profile information for different web pages;

determining, based on an instance of emulating presentation of the web page, that the advertisement is associated with malicious content; and

providing as output an indication that the advertisement is malicious.