Providing malware-free web content to end users using dynamic templates

• US 8,584,233 B1
• Filed: 05/05/2008
• Issued: 11/12/2013
• Est. Priority Date: 05/05/2008
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Yang, Liulin, Lu, Kun, Xie, Shiyu
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Holmes, Angela
• Application Number:
  US12/115,388
• Time in Patent Office: 2,017 Days
• Field of Search: 726/22, 726/24, 726/12, 709/229, 715/273, 715/200, 713/152, 713/155, 713/175, 713/188
• US Class Current: 726/22
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Providing malware-free web content to a user is disclosed. The web content is any type of web content that may potentially be infected by any type of malware. Upon receiving a request for a piece of web content from the user, the requested piece of web content is obtained from the appropriate source, and a dynamic template for the piece of web content is retrieved. The dynamic template indicates whether the requested piece of web content includes any malware and what actions are to be performed if any malware is included in the piece of web content. The requested piece of web content is cleaned up by performing the actions indicated in the dynamic template. Thereafter, the piece of web content is provided to the user. The dynamic template is updated from time to time based on the currently available information regarding the piece of web content.

Claims

1. A method of providing malware-free web content to a user, comprising:

receiving a request for a piece of web content from the user at a computer, said web content not being scanned after receiving said user request;

obtaining the piece of web content by said computer;

obtaining a dynamic template for the piece of web content from a database, wherein said dynamic template includes a unique identifier associated with said piece of web content, said dynamic template further including for each piece of malware in said piece of web content a location of said each piece of malware in said web content, wherein the dynamic template exists prior to said obtaining the piece of web content and indicates that the piece of web content includes malware, and wherein said dynamic template further includes for each piece of malware included in said piece of web content at least one action to be performed with respect to said each piece of malware when cleaning up the piece of web content because said malware is included in the piece of web content;

cleaning up the piece of web content by performing the at least one action indicated in the dynamic template for said each piece of malware, the at least one action being performed after said user request; and

providing the cleaned-up piece of web content to the user.

2. A method as recited in claim 1, wherein the dynamic template for the piece of web content further comprises:

for each piece of malware included in the piece of web content, a type of the piece of malware, a rating of the piece of malware.

3. A method as recited in claim 1, further comprising:

analyzing the piece of web content to identify each piece of malware included in the piece of web content; and

constructing the dynamic template for the piece of web content by specifying at least one action to be performed with respect to each piece of malware included in the piece of web content.

4. A method as recited in claim 1, further comprising:

obtaining an update of the piece of web content before said request for said web content from said user;

analyzing the updated piece of web content to update the dynamic template for the piece of web content before said request for said web content from said user.

5. A method as recited in claim 1, wherein a piece of web content is one selected from the group consisting of an email message, a file, a web page, and a web feed.

6. A method as recited in claim 2, wherein one of the at least one action to be performed with respect to a piece of malware is one selected from the group consisting of add a stamp, delete, replace with pre-defined content, clean the malicious part, and remove the malicious part.

7. A method as recited in claim 3, wherein a piece of malware included in a piece of web content is identified according at least in part to at least one selected from the group consisting of a location of the piece of malware within the piece of web content, a keyword, a predefined rule, and a pattern.

8. A system for providing malware-free web content to a user, comprising:

a web proxy server computer;

a web content proxy application on said web server computer configured to provide a piece of web content to the user upon receiving a request from the user for the piece of web content, wherein the web content proxy application being further configured to obtain the piece of web content and a dynamic template for the piece of web content, wherein said dynamic template includes a unique identifier associated with said web content, said dynamic template further including for each piece of malware included in said piece of web content a location of said malware in said web content, wherein said dynamic template further includes for said each piece of malware included in said piece of web content at least one action to be performed with respect to said each piece of malware in order to clean up said web content, and wherein said dynamic template indicates prior to said obtaining the piece of web content that the piece of web content includes malware and that said at least one action is to be performed because malware is included in the piece of web content, said web content proxy application being further configured to clean up the piece of web content by performing the at least one action indicated in the dynamic template after said user request and to provide the cleaned-up piece of web content to the user, and wherein the dynamic template exists prior to said obtaining the piece of web content;

a database configured to store a plurality of dynamic templates, wherein each of the plurality of dynamic template is associated with a piece of web content;

a dynamic template provider configured to retrieve the dynamic template for the piece of web content requested by the user from the database and to forward the dynamic template to the web content proxy application; and

a web content analyzer configured to analyze a piece of web content, to construct the dynamic template for the piece of web content, and to store the dynamic template in the database, said web content analyzer not scanning said web content after receiving said user request.

9. A system as recited in claim 8, wherein the dynamic template for the piece of web content further comprises:

for each piece of malware included in the piece of web content, a type of the piece of malware, a rating of the piece of malware.

10. A system as recited in claim 8, wherein the web content analyzer is further configured to update the dynamic template for the piece of web content based on updated information on the piece of web content.

11. A system as recited in claim 8, wherein the web content analyzer is further configured to obtain the piece of web content to be analyzed.

12. A method of constructing a dynamic template for a piece of web content, wherein the template indicates an action to be performed with respect to a selected portion of the piece of web content, comprising:

analyzing the piece of web content to identify whether one or more specific portions of the piece of web content contain unwanted data;

for each portion of the piece of web content identified as containing unwanted data, identifying a location of the portion within the piece of web content and specifying at least one action to be performed on the unwanted data when cleaning up the piece of web content;

constructing the dynamic template for the piece of web content, wherein the dynamic template includes a unique identifier for the piece of web content, the location of said each portion within the piece of web content, and the at least one action for each portion of the piece of web content identified as containing unwanted data;

storing, by a computer, the dynamic template in a database before a user request for said web content; and

providing the dynamic template to a proxy after the user request, wherein the proxy is configured to obtain the web content based on the user request and clean up the web content by performing said at least one action for said each portion, wherein the dynamic template includes the at least one action for said each portion prior to the proxy obtaining the piece of web content.

13. A method as recited in claim 12, wherein the rating assigned to each portion of the piece of web content identified as containing unwanted data is determined based on a severity level of the unwanted data.

14. A method as recited in claim 12, wherein the at least one action specified for each portion of the piece of web content identified as containing unwanted data is determined based on at least one predefined rule.

15. A method as recited in claim 12, wherein the piece of web content is a web feed represented by a XML file, and the location of each portion of the piece of web content identified as containing unwanted data is identified by an XML entry.

16. A method as recited in claim 12, further comprising:

updating the dynamic template for the web content by reanalyzing a current version of the piece of web content.

17. A method as recited in claim 12, further comprising:

receiving said user request for said web content; and

performing said at least one action after said user request, said performing being based upon said template constructed and stored before said user request.

18. The method as recited in claim 12, further comprising:

for each portion of the piece of web content identified as containing unwanted data, identifying a type of the unwanted data contained in the portion and assigning a rating to the unwanted data; and

specifying in the dynamic template the type and the rating for each portion of the piece of web content identified as containing unwanted data.

19. A method as recited in claim 15, wherein the XML file is analyzed using at least in part XPATH.