Accessible content reputation lookup

• US 9,769,194 B2
• Filed: 03/17/2011
• Issued: 09/19/2017
• Est. Priority Date: 06/07/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Iverson, Kristofer N.
• Primary Examiner(s): Hong, Stephen
• Assistant Examiner(s): ROBINSON, MARSHON L
• Application Number:
  US13/050,585
• Publication Number:
  US 20110167328A1
• Time in Patent Office: 2,378 Days
• Field of Search: 715205, 715738
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Implementations of accessible content reputation lookup are described. In one implementation, before a user activates a link in a document, such as a hyperlink on a webpage, the user can designate the link. For example, the user can float a cursor over the link or interact with an icon placed proximate to the link. By designating the link, the user can request reputation information associated with the link, including information as to whether or not content associated with the link, an application used to access the content, and/or source(s) on which the content resides, are known to be dangerous or risky. If the reputation information indicates that the link is safe to activate, the user can activate the link and access the content. Alternately, if the reputation information indicates that the link is unsafe to access, the user can choose to forego activation of the link.

Claims

1. A computer implemented method operable on a processor, the method comprising:

presenting in text of a web page a first link to first content;

presenting in the text of the web page a second link to second content;

presenting, in a first state, proximate to the first link in the text of the webpage a first icon corresponding to the first link, wherein the first state of the first icon indicates that first reputation information associated with the first link is available, the first reputation information including a history of an application associated with the first link to the first content and a history of a device storing the first content, the history of the device indicating a reputation for the device based on a likelihood of the device to disseminate malware and a length of an access time for retrieving content from the device;

presenting, in a second state, proximate to the second link in the text of the webpage a second icon corresponding to the second link, wherein the second state of the second icon is different than the first state of the first icon and indicates that second reputation information associated with the second link is not available;

receiving input designating the first link by floating a cursor over the first icon associated with the first link to request the first reputation information associated with the first link;

displaying a pull down menu extending from the first icon and over the text of the web page when the user designates the first link; and

displaying, in the pull down menu, the first reputation information associated with the first link.

2. The method of claim 1, further comprising receiving input to designate the first link by floating a cursor over the first link.

3. The method of claim 1, further comprising querying a local cache for the first reputation information.

4. The method of claim 3, further comprising querying a cache on a remote device when the first reputation information is not available in the local cache.

5. The method of claim 1, further comprising displaying that no reputation information can be returned when the first reputation information cannot be accessed.

6. The method of claim 1, further comprising blocking activation of the first link when the first reputation information indicates a risk in accessing the content associated with the first link.

7. The method of claim 1, further comprising receiving input including comments regarding a quality of the first reputation information.

15. The method of claim 1, wherein presenting the first icon proximate to the first link in the text of the web page comprises displaying the first icon adjacent to a left end or right end of the first link in the text of the web page.

8. A device having computer-readable instructions residing thereon that, when executed, performs operations comprising:

presenting in text of a web page a first link to first content;

presenting in the text of the web page a second link to second content;

presenting a first icon, corresponding to the first link, in a first state proximate to the first link in the text of the web page indicating first reputation information associated with the first link is available, the first reputation information including a history of an application associated with the first link to the first content and a history of a computing device storing the first content, the history of the computing device indicating a reputation for the computing device based on a likelihood of the computing device to disseminate malware and a length of an access time for retrieving content from the computing device;

presenting a second icon, corresponding to the second link, in a second state proximate to the second link in the text of the web page, the second state of the second icon being different than the first state of the first icon and indicating second reputation information associated with the second link is not available;

receiving a user input designating the first link without activating the first link by floating a cursor over the first icon;

requesting the first reputation information associated with the first link from a cache when the user designates the first link;

displaying a pull down menu extending from the first icon and over the text of the web page; and

displaying, in the pull down menu, the first reputation information associated with the first link.

9. The device of claim 8 having computer-readable instructions residing thereon that, when executed, perform operations further comprising:

prepopulating the cache with first reputation information for the first link.

10. The device of claim 8 having computer-readable instructions residing thereon that, when executed, perform operations further comprising:

displaying a warning recommending that the user forego activation of the first link when too little reputation information exists in the cache to indicate that a risk of activating the first link is below an acceptable threshold.

16. The device of claim 8, wherein presenting the first icon proximate to the first link in the text of the web page comprises displaying the first icon adjacent to a left end or right end of the first link in the text of the web page.

11. A computing device, comprising:

a hardware processor;

a computer-readable memory coupled to the hardware processor, the computer-readable memory including computer-readable instructions that when executed by the hardware processor perform operations comprising;

displaying in text of a web page a first link to first content;

displaying in the text of the web page a second link to second content;

displaying a first icon, corresponding to the first link, in a first state proximate to the first link in the text of the web page indicating first reputation information associated with the content is available, the first reputation information including a history of an application associated with the first link to the first content and a history of a device storing the first content, the history of the device indicating a reputation for the device based on a likelihood of the device to disseminate malware and a length of an access time for retrieving content from the device;

displaying a second icon, corresponding to the second link, in a second state proximate to the second link in the text of the web page, wherein the second state of the second icon is different than the first state of the first icon and indicates that second reputation information associated with the second link is not available;

displaying a pull down menu extending from the first icon and over the text of the web page when a user interacts with the first icon; and

displaying, in the pull down menu, the first reputation information associated with the content.

12. The computing device of claim 11, the computer-readable memory further including computer-readable instructions that when executed by the hardware processor perform operations comprising:

receiving user input providing comments regarding a quality of the first reputation information.

13. The computing device of claim 11, further comprising a local cache, wherein the computing device attempts to retrieve the first reputation information from the local cache before attempting to retrieve the first reputation information from a cache residing on a remote computing device.

14. The computing device of claim 11, wherein displaying the first icon proximate to the first link in the text of the web page comprises displaying the first icon above or below a left end of the first link in the text of the web page, or displaying the first icon above or below a right end of the first link in the text of the web page.

17. The computing device of claim 11, wherein displaying the first icon proximate to the first link in the text of the web page comprises displaying the first icon adjacent to a left end or right end of the first link in the text of the web page.