Security data aggregation and business intelligence for web applications

• US 9,213,827 B2
• Filed: 09/27/2012
• Issued: 12/15/2015
• Est. Priority Date: 09/27/2012
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Li, Hong, Ross, Alan D., Wouhaybi, Rita H., Kohlenberg, Tobias M.
• Primary Examiner(s): RAHIM, MONJUR
• Application Number:
  US13/628,219
• Publication Number:
  US 20140090066A1
• Time in Patent Office: 1,174 Days
• Field of Search: 726/25
• US Class Current: 1/1
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Systems and methods may provide for detecting a browser request for web content. Additionally, interaction information associated with a plurality of sources may be determined in response to the browser request, and a risk profile may be generated based on the interaction. The risk profile may include at least a portion of the interaction information as well as recommended control actions to mitigate the identified risk. In one example, the risk profile is presented to a user associated with the browser request as well as to a security control module associated with the platform.

Claims

1. A computing platform comprising:

a plurality of hardware components including one or more of a sensor, a network interface, a memory, an input output (IO) component and a processor;

a browser interface to detect a browser request that is to be issued from a browser of the platform for remote web content, wherein the web content is to be presented on the platform in response to the browser request; and

a security module to;

determine interaction information corresponding to an interaction between the web content and the plurality of hardware components to identify a risk associated with access by the web content to any hardware component of the plurality of hardware components in response to the browser request; and

generate a risk profile based on the interaction information to document the risk associated with the access by the web content, wherein the risk profile is to include one or more pairings, each pairing of the one or more pairings to include a hardware component of the plurality of hardware components to be accessed by the web content in response to the browser request and an application associated with the web content that is to attempt access to the hardware component.

2. The platform of claim 1, wherein the security module includes a first data aggregator to obtain the interaction information from one or more of the sensor, the memory, the IO component, the processor, a runtime context interface and a user setting location.

3. The platform of claim 2, wherein the sensor includes one or more of a Wi-Fi sensor, a global positioning system (GPS) sensor, a cellular sensor, a near field communications (NFC) sensor, an audio sensor and a motion sensor.

4. The platform of claim 2, wherein the IO component includes one or more of a file system component, a networking component and a graphics component.

5. The platform of claim 1, wherein the security module includes a second data aggregator to obtain the interaction information from one or more of a remote peer-to-peer (P2P) application, a remote social network, a remote cloud service and a remote enterprise database.

6. The platform of claim 1, wherein the security module includes a graphical user interface (GUI) to present the risk profile to a user, wherein the risk profile is to present the one or more pairings and one or more recommended actions, each pairing of the one or more pairings to include an identity of a specific hardware component and an identity of a function call corresponding to the application that is to attempt access to the specific hardware component.

7. The platform of claim 1, further including a control interface to send the risk profile to a security control module in response to one or more of a control request from the security control module and a trigger condition associated with the risk profile.

24. The platform of claim 1, wherein the web content is to be written in one or more of a just in time (JIT) language and a runtime environment language that is to expose one or more of the plurality of hardware components, and wherein the runtime environment language is to include HyperText Markup Language 5 (HTML5).

8. An apparatus comprising:

a browser interface to detect a browser request that is to be issued from a browser of a platform for remote web content, wherein the web content is to be presented on the platform in response to the browser request; and

a security module to;

determine interaction information corresponding to an interaction between the web content and a plurality of platform sources to identify a risk associated with access by the web content to any platform source of the plurality of platform sources in response to the browser request; and

generate a risk profile based on the interaction information to document the risk associated with the access by the web content, wherein the risk profile is to include one or more pairings, each pairing of the one or more pairings to include a platform source of the plurality of platform sources to be accessed by the web content in response to the browser request and an application associated with the web content that is to attempt access to the platform source.

9. The apparatus of claim 8, wherein the security module includes a first data aggregator to obtain the interaction information from one or more of a platform sensor, a platform memory, a platform input output (IO) component, a platform processor, a platform runtime context interface and a platform user setting location.

10. The apparatus of claim 9, wherein the first data aggregator includes a sensor interface to obtain the interaction information from one or more of a Wi-Fi sensor, a global positioning system (GPS) sensor, a cellular sensor, a near field communications (NFC) sensor, an audio sensor and a motion sensor, wherein the risk is associated with access by the web content to one or more of the Wi-Fi sensor, the GPS sensor, the cellular sensor, the near NFC sensor, the audio sensor and the motion sensor.

11. The apparatus of claim 9, wherein the first data aggregator includes an IO interface to obtain the interaction information from one or more of a file system component, a networking component and a graphics component, wherein the risk is associated with access by the web content to one or more of the file system component, the networking component and the graphics component.

12. The apparatus of claim 8, wherein the security module includes a second data aggregator to obtain the interaction information from one or more of a remote peer-to-peer (P2P) application, a remote social network, a remote cloud service and a remote enterprise database, wherein the risk is based on historical data associated with behavior of the web content relative to one or more other platforms.

13. The apparatus of claim 8, wherein the security module includes a graphical user interface (GUI) to present the risk profile to a user, wherein the risk profile is to present the one or more pairings and one or more recommended actions, each pairing of the one or more pairings to include an identity of a specific platform source and an identity of a function call corresponding to the application that is to attempt access to the specific platform source.

14. The apparatus of claim 8, further including a control interface to send the risk profile to a security control module in response to a control request from the security control module, wherein the security control module is to one or more of control the access by the web content to the one or more plurality of platform sources, detect an intrusion, and detect malware.

15. The apparatus of claim 8, further including a control interface to send the risk profile to a security control module in response to a trigger condition associated with the risk profile, wherein the security control module is to one or more of control the access by the web content to the one or more plurality of platform sources, detect an intrusion, and detect malware.

16. At least one non-transitory computer readable storage medium comprising a set of instructions which, if executed by a processor, cause a computer to:

detect a browser request that is to be issued from a browser of a platform for remote web content, wherein the web content is to be presented on the platform in response to the browser request;

determine interaction information corresponding to an interaction between the web content and a plurality of platform sources to identify a risk associated with access by the web content to any platform source of the plurality of platform sources in response to the browser request; and

generate a risk profile based on the interaction information to document the risk associated with the access by the web content, wherein the risk profile is to include one or more pairings, each pairing of the one or more pairings to include a platform source of the plurality of platform sources to be accessed by the web content in response to the browser request and an application associated with the web content that is to attempt access to the platform source.

17. The at least one computer readable storage medium of claim 16, wherein the instructions, if executed, cause a computer to obtain the interaction information from one or more of a platform sensor, a platform memory, a platform input output (IO) component, a platform processor, a platform runtime context interface and a platform user setting location.

18. The at least one computer readable storage medium of claim 17, wherein the instructions, if executed, cause a computer to obtain the interaction information from one or more of a Wi-Fi sensor, a global positioning system (GPS) sensor, a cellular sensor, a near field communications (NFC) sensor, an audio sensor and a motion sensor.

19. The at least one computer readable storage medium of claim 17, wherein the instructions, if executed, cause a computer to obtain the interaction information from one or more of a file system component, a networking component and a graphics component.

20. The at least one computer readable storage medium of claim 16, wherein the instructions, if executed, cause a computer to obtain the interaction information from one or more of a remote peer-to-peer (P2P) application, a remote social network, a remote cloud service and a remote enterprise database.

21. The at least one computer readable storage medium of claim 16, wherein the instructions, if executed, cause a computer to present the risk profile to a user via a graphical user interface (GUI), wherein the risk profile is to present the one or more pairings and one or more recommended actions, each pairing of the one or more pairings to include an identity of a specific platform source and an identity of a function call corresponding to the application that is to attempt access to the specific platform source.

22. The at least one computer readable storage medium of claim 16, wherein the instructions, if executed, cause a computer to send the risk profile to a security control module in response to a control request from the security control module.

23. The at least one computer readable storage medium of claim 16, wherein the instructions, if executed, cause a computer to send the risk profile to a security control module in response to a trigger condition associated with the risk profile.