Scanning ad content for malware with varying frequencies

• US 9,298,919 B1
• Filed: 08/26/2013
• Issued: 03/29/2016
• Est. Priority Date: 04/25/2009
• Status: Expired due to Fees

• Current Assignee: Dasient, Inc. (X Holdings Corp.)
• Original Assignee: Dasient, Inc. (X Holdings Corp.)
• Inventors: Demir, Tufan, Ranadive, Ameet, Rizvi, Shariq, Daswani, Neilkumar Murli
• Primary Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US13/975,510
• Time in Patent Office: 946 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/53 using third party service providers

Abstract

Diversity information associated with a set of advertisement tags is determined. Example ways of determining diversity include determining a list of distinct Uniform Resource Locators, determining a list of distinct domains, and determining whether an advertisement includes one or more dynamic elements. Scans are adaptively performed based on the determined diversity information. Scanning is performed more frequently for advertisement tags having higher associated diversities and scanning is performed less frequently for advertisement tags having lower associated diversities.

Claims

1. A system, comprising:

an anti-malvertising module executing on a processor and configured to;

compute a different diversity metric associated with each of a set of advertisement tags, the diversity metric associated with each advertisement tag indicative of a number of advertisement creatives that are provided in response to the advertisement tag being loaded; and

determine a frequency with which content associated with each of the advertisement tags are to be scanned for malware based on the computed diversity metrics associated with the advertisement tags, the frequency with which content associated with an advertisement tag is scanned being proportional to the diversity metric associated with the advertisement tag; and

adaptively scan the advertisement tags based on the determined frequencies; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system of claim 1 wherein the processor is configured to determine the diversity metric associated with an advertisement tag at least in part by determining a list of distinct URLs associated with the advertisement tag.

3. The system of claim 1 wherein the processor is configured to determine the diversity metric associated with an advertisement tag at least in part by determining a list of distinct domains associated with the advertisement tag.

4. The system of claim 1 wherein the processor is configured to determine the diversity metric associated with an advertisement tag at least in part by determining whether an advertisement creative that is provided in response to the advertisement tag being loaded includes one or more dynamic elements.

5. The system of claim 1 wherein the processor is configured to determine the diversity metric associated with an advertisement tag at least in part by determining whether different advertisement creatives are provided based on user profile information.

6. The system of claim 1 wherein the processor is configured to determine the diversity metric associated with an advertisement tag at least in part by determining whether different advertisement creatives are provided based on geolocation information.

7. The system of claim 1 wherein the processor is configured to determine a composite diversity.

8. The system of claim 1 wherein the frequency with which a scan is performed is constrained by a maximum.

9. The system of claim 1 wherein the frequency with which a scan is performed is constrained by a minimum.

10. The system of claim 1 wherein the processor is further configured to generate as output a report of advertisements served by a particular page.

11. The system of claim 1 wherein the processor is further configured to generate as output a report of advertisements served by a particular domain.

12. A computer-implemented method, comprising:

computing a different diversity metric associated with each of a set of advertisement tags, the diversity metric associated with each advertisement tag indicative of a number of advertisement creatives that are provided in response to the advertisement tag being loaded;

determining a frequency with which content associated with each of the advertisement tags are to be scanned for malware based on the computed diversity metrics associated with the advertisement tags, the frequency with which content associated with an advertisement tag is scanned being proportional to the diversity metric associated with the advertisement tag; and

adaptively scanning the advertisement tags based on the determined frequencies.

13. The method of claim 12 wherein determining the diversity metric associated with an advertisement tag is performed at least in part by determining a list of distinct URLs associated with the advertisement tag.

14. The method of claim 12 wherein determining the diversity metric associated with an advertisement tag is performed at least in part by determining a list of distinct domains associated with the advertisement tag.

15. The method of claim 12 wherein determining the diversity metric associated with an advertisement tag is performed at least in part by determining whether an advertisement includes one or more dynamic elements.

16. The method of claim 12 further comprising determining a composite diversity.

17. The method of claim 12 wherein the frequency with which a scan is performed is constrained by a maximum.

18. The method of claim 12 wherein the frequency with which a scan is performed is constrained by a minimum.

19. The method of claim 12 further comprising generating as output a report of advertisements served by a particular page.

20. A computer program product for detecting a malicious advertisement embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

computing a different diversity metric associated with each of a set of advertisement tags, the diversity metric associated with each advertisement tag indicative of a number of advertisement creatives that are provided in response to the advertisement tag being loaded;

determining a frequency with which content associated with each of the advertisement tags are to be scanned for malware based on the computed diversity metrics associated with the advertisement tags, the frequency with which content associated with an advertisement tag is scanned being proportional to the diversity metric associated with the advertisement tag; and

adaptively scanning the advertisement tags based on the determined frequencies.

21. The computer program product of claim 20 wherein determining the diversity metric associated with an advertisement tag is performed at least in part by determining a list of distinct URLs associated with the advertisement tag.

22. The computer program product of claim 20 wherein determining the diversity metric associated with an advertisement tag is performed at least in part by determining a list of distinct domains associated with the advertisement tag.

23. The computer program product of claim 20 wherein determining the diversity metric associated with an advertisement tag is performed at least in part by determining whether an advertisement includes one or more dynamic elements.

24. The computer program product of claim 20 further comprising determining a composite diversity.

25. The computer program product of claim 20 wherein the frequency with which a scan is performed is constrained by a maximum.

26. The computer program product of claim 20 wherein the frequency with which a scan is performed is constrained by a minimum.

27. The computer program product of claim 20 further comprising generating as output a report of advertisements served by a particular page.