Enhanced browsing with security scanning

• US 9,942,260 B2
• Filed: 02/27/2017
• Issued: 04/10/2018
• Est. Priority Date: 09/27/2004
• Status: Active Grant

• Current Assignee: Cufer Asset Ltd LLC (Intellectual Ventures LLC)
• Original Assignee: Cufer Asset Ltd LLC (Intellectual Ventures LLC)
• Inventors: Milener, Scott, Brown, Wendell, Kelly, James
• Primary Examiner(s): To, Baotran N
• Application Number:
  US15/444,181
• Publication Number:
  US 20170171238A1
• Time in Patent Office: 407 Days
• Field of Search: 726 22- 25, 713188, 709224, 715738, 715804, 715805, 715822
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/5681 Pre-fetching or pre-delivering data based on network characteristics

Abstract

A method securely scans a second web page linked to a first web page being displayed by a browser. The method identifies a target link to a second web page from one or more links contained within a first web page. Prior to receiving a user selection of the target link, the method prefetches content from the second web page and loads the prefetched content from the second web page into a safe cache on the client computing device before receiving the user selection of the target link. The method scans the prefetched content from the second web page for a security threat, within the safe cache, wherein the safe cache is configured to prevent the prefetched content from altering a memory location or storage location external to the safe cache. In response to identifying a security threat within the prefetched content, the method displays a warning to the user.

Claims

1. A method of secure scanning of a second web page linked to a first web page being displayed by a browser in a browser window on a client computing device, the method comprising:

identifying a target link to a second web page from one or more links that are contained within a first web page;

prior to receiving a user selection of the target link, prefetching content from the second web page;

loading the prefetched content from the second web page into a safe cache on the client computing device before receiving the user selection of the target link;

scanning the prefetched content from the second web page for a security threat, within the safe cache, wherein the safe cache is configured to prevent the prefetched content from altering a memory location or storage location external to the safe cache, wherein the prefetched content contains executable code and said scanning comprises executing the code within the safe cache to determine a behavior of the executable code; and

in response to identifying a security threat within the prefetched content, displaying a warning to the user.

2. The method of claim 1, further comprising:

presenting an option to ignore the warning; and

in response to the user selecting the option to ignore the warning, causing display of a second window comprising the prefetched content.

3. The method of claim 1, further comprising in response to identifying no security threat within the prefetched content or in response to the user selecting an option to ignore the warning, causing display of a second window comprising the prefetched content.

4. The method of claim 3, further comprising prior to causing the display of the second window:

generating but not displaying the second window;

populating the second window with the prefetched content; and

caching the second window.

5. The method of claim 3, wherein the second window is an enhanced browsing window lacking one or more functions provided by the browser window.

6. The method of claim 3, wherein the second window is configured to close in response to movement of a cursor out of the second window.

7. The method of claim 1, further comprising:

notifying a central server of a result of the scanning of the prefetched content for a security threat.

8. The method of claim 7, further comprising:

prior to said scanning, querying the central server for a result of a previous scanning of the prefetched content.

9. The method of claim 1, wherein the security threat comprises one or more of a virus, a worm, or a trojan horse.

10. The method of claim 1, wherein the security threat comprises one or more of spyware or adware.

11. The method of claim 1, wherein the security threat comprises one or more of a phishing attack, a cookie, or a script.

12. A non-transitory computer-readable storage medium storing instructions thereon that, if executed by a client computing device, cause the client computing device to perform operations of enhanced browsing with security scanning, the instructions comprising:

instructions to identify a target link to a second web page from one or more links that are displayed within a first web page;

instructions to prefetch content from the second web page prior to receiving a user selection of the target link;

instructions to load the prefetched content into a safe cache on the client computing device before receiving the user selection of the target link;

instructions to scan the prefetched content for a security threat, within the safe cache, wherein the safe cache is configured to prevent the prefetched content from altering a memory location or storage location external to the safe cache, wherein the prefetched content contains executable code and said instructions to scan the prefetched content comprise instructions to execute the code within the safe cache to determine a behavior of the executable code; and

instructions to, in response to identifying a security threat with the prefetched content, display a warning to the user if a security threat is detected within the prefetched content.

13. The non-transitory computer-readable storage medium of claim 12, wherein the instructions further comprise:

instructions to generate but not display a second window;

instructions to populate the second window with the prefetched content; and

instructions to cache the second window.

14. A method of enhanced browsing with security scanning, the method comprising:

identifying a target link to content from one or more links that are contained within a first document displayed on a client computing device;

prior to receiving a user selection of the target link, prefetching the content;

loading the content into a safe cache on the client computing device before receiving a user selection of the target link;

while the content is in the safe cache;

preventing the content from altering a memory location or storage location external to the safe cache; and

scanning the content on the client computing device to identify a presence or absence of a security threat; and

in response to identifying no security threat within the content or in response to receiving from the user selecting a selectable option to ignore an identified security threat, causing display of a second window comprising the content.

15. The method of claim 14, further comprising:

before receiving the user selection of the target link, altering an appearance of an indicator to indicate whether a security threat was detected within the content.

16. The method of claim 14, wherein the content contains executable code and said scanning comprises executing the code within the safe cache to determine a behavior of the code.