Adaptive scanning

• US 8,555,391 B1
• Filed: 06/30/2011
• Issued: 10/08/2013
• Est. Priority Date: 04/25/2009
• Status: Active Grant

• Current Assignee: Dasient, Inc. (X Holdings Corp.)
• Original Assignee: Dasient, Inc. (X Holdings Corp.)
• Inventors: Ranadive, Ameet, Rizvi, Shariq, Daswani, Neilkumar Murli, Demir, Tufan
• Primary Examiner(s): Chai, Longbit
• Application Number:
  US13/174,593
• Time in Patent Office: 831 Days
• Field of Search: 726/24
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/53 using third party service providers

Abstract

Diversity information associated with a set of advertisement tags is determined. Example ways of determining diversity include determining a list of distinct Uniform Resource Locators, determining a list of distinct domains, and determining whether an advertisement includes one or more dynamic elements. Scans are adaptively performed based on the determined diversity information. Scanning is performed more frequently for advertisement tags having higher associated diversities and scanning is performed less frequently for advertisement tags having lower associated diversities.

Claims

1. A system, comprising:

a computer processor; and

an anti-malvertising module executing on the computer processor and configured to;

identify a set of advertisement tags included in a web page;

determine a first diversity value for each of the set of advertisement tags, the first diversity value representing a count of external references associated with the advertisement tag, and content referenced by the external references comprising at least one selected from a group consisting of an image, an iframe, and a script;

determine a scanning frequency associated with each of the set of advertisement tags, the scanning frequency positively correlated with the first diversity value of the advertisement tag; and

request adaptive scanning of the set of advertisement tags based on the associated scanning frequency.

2. The system of claim 1, wherein the anti-malvertising module is further configured to determine the first diversity value for at least one of the set of advertisement tags at least in part by determining a list of distinct domains associated with the advertisement tag.

3. The system of claim 1, wherein the anti-malvertising module is configured to determine the first diversity value at least in part by determining whether an advertisement includes one or more dynamic elements.

4. The system of claim 1, wherein the anti-malvertising module is configured to determine the first diversity value at least in part by determining whether different content is served based on geolocation information.

5. The system of claim 1, wherein the scanning frequency is constrained by a maximum.

6. The system of claim 1, wherein the anti-malvertising module is further configured to generate as output a report of advertisements associated with the web page.

7. The system of claim 1, wherein the anti-malvertising module is further configured to generate as output a report of advertisements served by a particular domain.

8. The system of claim 1, further comprising:

a plurality of virtual machines each comprising an instrumented browser configured to;

emulate presentation of the web page using different user profile information.

9. The system of claim 1, further comprising:

a plurality of virtual machines each comprising an instrumented browser configured to;

emulate presentation of the web page using different geolocation information.

10. The system of claim 1, wherein the external references are distinct uniform resource locators (URLs), and wherein the first diversity value represents a count of the distinct URLs associated with the advertisement tag, and the anti-malvertising module further configured to:

determine a second diversity value for each of the set of advertisement tags, the second diversity value representing a count of unique domains associated with the advertisement tag; and

calculate, for each of the set of advertising tags, a composite diversity value based on a mathematical function of the first diversity value and the second diversity value, wherein determining the scanning frequency of the advertisement tag is further based on the composite diversity value.

11. The system of claim 1, the anti-malvertising module further configured to:

request a predefined number of adaptive scans of the set of advertisement tags with equal frequency;

construct, based on the predefined number of adaptive scans, a histogram depicting the diversity value for each of the set of advertisement tags, wherein determining the scanning frequency associated with each of the set of advertisement tags is based on the histogram; and

request, after constructing the histogram, adaptive scans of the set of advertisement tags based on the scanning frequency associated with each advertisement tag.

12. A method, comprising:

identifying a set of advertisement tags included in a web page;

determining a first diversity value for each of the set of advertisement tags, the first diversity value representing a count of external references associated with the advertisement tag, and content referenced by the external references comprising at least one selected from a group consisting of an image, an iframe, and a script;

determining, by a computer processor, a scanning frequency associated with each of the set of advertisement tags, the scanning frequency positively correlated with the first diversity value of the advertisement tag; and

request adaptive scanning of the set of advertisement tags based on the associated scanning frequency.

13. The method of claim 12, wherein determining the first diversity value of at least one of the set of advertisement tags is performed at least in part by determining a list of distinct domains associated with the advertisement tag.

14. The method of claim 12, wherein determining the first diversity value is performed at least in part by determining whether an advertisement includes one or more dynamic elements.

15. The method of claim 12, wherein the scanning frequency is constrained by a maximum.

16. The method of claim 12, wherein adaptive scanning of the set of advertisement tags comprises emulating presentation of the web page in an instrumented browser using different user profile information in each of a plurality of virtual machines.

17. The method of claim 12, wherein adaptive scanning of the set of advertisement tags comprises emulating presentation of the web page in an instrumented browser using different geolocation information in each of a plurality of virtual machines.

18. The method of claim 12, wherein the external references are distinct uniform resource locators (URLs), and wherein the first diversity value represents a count of the distinct URLs associated with the advertisement tag, and the method further comprising:

determining a second diversity value for each of the set of advertisement tags, the second diversity value representing a count of unique domains associated with the advertisement tag; and

calculating, for each of the set of advertising tags, a composite diversity value based on a mathematical function of the first diversity value and the second diversity value, wherein determining the scanning frequency of the advertisement tag is further based on the composite diversity value.

19. The method of claim 12, further comprising:

requesting a predefined number of adaptive scans of the set of advertisement tags with equal frequency;

constructing, based on the predefined number of adaptive scans, a histogram depicting the diversity value for each of the set of advertisement tags, the determining the scanning frequency associated with each of the set of advertisement tags is based on the histogram; and

requesting, after constructing the histogram, adaptive scans of the set of advertisement tags based on the scanning frequency associated with each advertisement tag.

20. A non-transitory computer readable storage medium comprising computer instructions configured to execute on at least one computer processor to enable the computer processor to:

identify a set of advertisement tags included in a web page;

determine a first diversity value for each of the set of advertisement tags, the first diversity value representing a count of external references associated with the advertisement tag, and content referenced by the external references comprising at least one selected from a group consisting of an image, an iframe, and a script;

determine a scanning frequency associated with each of the set of advertisement tags, the scanning frequency positively correlated with the first diversity value of the advertisement tag; and

request adaptive scanning of the set of advertisement tags based on the associated scanning frequency.