Enhanced browsing with security scanning

• US 9,584,539 B2
• Filed: 02/19/2016
• Issued: 02/28/2017
• Est. Priority Date: 09/27/2004
• Status: Active Grant

• Current Assignee: Cufer Asset Ltd LLC (Intellectual Ventures LLC)
• Original Assignee: Cufer Asset Ltd LLC (Intellectual Ventures LLC)
• Inventors: Milener, Scott, Brown, Wendell, Kelly, James
• Primary Examiner(s): To, Baotran N
• Application Number:
  US15/047,775
• Publication Number:
  US 20160173523A1
• Time in Patent Office: 375 Days
• Field of Search: 726 22- 25, 713/188, 709/224, 715/738, 715/804, 715/805, 715/822
• US Class Current: 1/1
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/5681 Pre-fetching or pre-delivering data based on network characteristics

Abstract

A method scans a second web page linked to a first web page being displayed by a browser. The method identifies a target link to the second web page. Prior to receiving a user selection of the target link, the method prefetches content from the second web page and loads it into a safe cache before receiving the user selection of the target link. The method scans the prefetched content for a security threat, within the safe cache, which is configured to prevent the prefetched content from altering a memory or storage location external to the safe cache. The method detects user placement of a cursor proximate to the target link and, in response to identifying a security threat, presents a warning to the user, or in response to identifying no threat or the user opting to ignore the warning, causing display of a second window comprising the prefetched content.

Claims

1. A method of secure scanning of a second web page linked to a first web page being displayed by a browser in a browser window on a client computing device, the method comprising:

identifying a target link to a second web page from one or more links that are contained within a first web page;

prior to receiving a user selection of the target link, prefetching content from the second web page;

loading the prefetched content from the second web page into a safe cache on the client computing device before receiving the user selection of the target link;

scanning the prefetched content from the second web page for a security threat, within the safe cache, wherein the safe cache is configured to prevent the prefetched content from altering a memory location or storage location external to the safe cache;

detecting user placement of a cursor proximate to the target link;

in response to identifying a security threat within the prefetched content, presenting a warning to the user along with one or more selectable options, including an option to ignore the warning; and

in response to identifying no security threat within the prefetched content, or in response to the user selecting the option to ignore the warning, causing display of a second window comprising the prefetched content.

2. The method of claim 1, further comprising prior to said causing display of a second window:

generating but not displaying the second window;

populating the second window with the prefetched content; and

caching the second window.

3. The method of claim 1, wherein the second window is an enhanced browsing window lacking one or more functions provided by the browser window.

4. The method of claim 1, wherein the second window is configured to close in response to movement of the cursor out of the second window.

5. The method of claim 1, wherein the prefetched content contains executable code and said scanning comprises executing the code within the safe cache to determine a behavior of the executable code.

6. The method of claim 1, further comprising:

notifying a central server of a result of the scanning the prefetched content for a security threat.

7. The method of claim 6, further comprising:

prior to said scanning, querying the central server for a result of a previous scanning of the prefetched content.

8. The method of claim 1, wherein the security threat comprises one or more of a virus, a worm, or a trojan horse.

9. The method of claim 1, wherein the security threat comprises one or more of spyware or adware.

10. The method of claim 1, wherein the security threat comprises one or more of a phishing attack, a cookie, or a script.

11. A non-transitory computer-readable storage medium storing instructions thereon that, if executed by a client computing device, cause the client computing device to perform operations of enhanced browsing with security scanning, the instructions comprising:

instructions to identify a target link to a second web page from one or more links that are displayed within a first web page;

instructions to prefetch content from the second web page prior to receiving a user selection of the target link;

instructions to load the prefetched content into a safe cache on the client computing device before receiving the user selection of the target link;

instructions to scan the prefetched content for a security threat, within the safe cache, wherein the safe cache is configured to prevent the prefetched content from altering a memory location or storage location external to the safe cache;

instructions to detect user placement of a cursor proximate to the target link;

instructions to, in response to identifying a security threat with the prefetched content, present a warning along with one or more selectable options, including an option to ignore the warning, to the user if a security threat is detected within the prefetched content; and

instructions to, in response to identifying no security threat with the prefetched content or in response to receiving from the user a selectable option to ignore the warning, to cause display of a second window comprising the prefetched content if no security threat is detected within the prefetched content or if the user selects the option to ignore the warning.

12. The computer-readable storage medium of claim 11, wherein the instructions further comprise:

instructions to generate but not display the second window;

instructions to populate the second window with the prefetched content; and

instructions to cache the second window.

13. A method of enhanced browsing with security scanning, the method comprising:

identifying a target link to content from one or more links that are contained within a first document displayed on a client computing device;

prior to receiving a user selection of the target link, prefetching the content;

loading the content into a safe cache on the client computing device before receiving a user selection of the target link;

while the content is in the safe cache;

preventing the content from altering a memory location or storage location external to the safe cache; and

scanning the content on the client computing device to identify a presence or absence of a security threat;

detecting placement of a cursor proximate to the target link and presenting one or more user selectable options to initiate in response to an identified security threat; and

in response to identifying no security threat within the content or in response to receiving from the user selecting a selectable option to ignore an identified security threat, causing display of a second window comprising the content.

14. The method of claim 13, further comprising:

before receiving the user selection of the target link altering an appearance of an indicator to indicate whether a security threat was detected within the content.

15. The method of claim 13, wherein the content contains executable code and said scanning comprises executing the code within the safe cache to determine a behavior of the code.