Malware warning

• US 10,091,214 B2
• Filed: 03/15/2016
• Issued: 10/02/2018
• Est. Priority Date: 05/11/2015
• Status: Active Grant

• Current Assignee: Finjan Mobile LLC (SoftBank Group Corp.)
• Original Assignee: Finjan Mobile, Inc. (SoftBank Group Corp.)
• Inventors: Godlewski, Michael, House, Geoffrey, Tong, Winnie, Mutter, Rudolph, Feore, Bay Lee, Shipman, Timothy, Scherba, Anthony, McDole, Lee, Kremer, Alexander Lin, Mar-Spinola, Julie
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Zhu, Zhimei
• Application Number:
  US15/069,981
• Publication Number:
  US 20160337379A1
• Time in Patent Office: 931 Days
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 3/048 Interaction techniques based on graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A malware warning system, including a client sending requests to and receiving replies from a server, and a server, including a first warning generator sending to the client a warning including a threat level of content located at a web site, in response to receiving from the client a URL for accessing content at the web site, a second warning generator sending to the client a warning including information about at least one of the nature of the threat of the content located at the web site and a location of the web site, in response to receiving from the client a request for more information about the nature of the threat, and a third warning generator, sending to the client a warning including an instruction to perform a swipe gesture to confirm a request to access the URL, in response to receiving that request from the client.

Claims

1. A non-transitory computer readable medium storing instructions, which, when executed by a processor of an electronic device, cause the processor to:

register to listen to redirection events for a web browser that receives identifiers for accessing content at a destination web site;

generate three different successive warning displays to prevent access to malicious content, comprising;

receive an identifier for accessing content at a destination web site;

in response to receiving the identifier, send the identifier to a plurality of virus scan engines;

generate a first warning display comprising a threat level of content located at the destination web site, wherein the threat level is determined by a percentage of the virus scan engines that indicate that the destination web site is a threat;

receive a request for more information about the nature of the threat;

in response to receiving the request for more information, generate a second warning display comprising information about both (i) the nature of the threat of the content, and (ii) a location of the destination web site;

receive a request to access the content;

in response to receiving the request to access the content, generate a third warning display comprising an instruction to perform a confirmatory touch gesture to confirm the request to access the content;

in response to detecting the confirmatory touch gesture, attempt to access the content at the destination web site;

recognize an event that the identifier is being re-directed by the destination web site to another identifier; and

prior to accessing the content using the other identifier, repeating said generate a first warning display, receive a request for more information, generating a second warning display, receive a request to access the content, and generate a third warning display, using the other identifier.

2. The computer readable medium of claim 1 wherein the identifier is a URL.

3. The computer readable medium of claim 1 wherein the confirmatory touch gesture is a swipe gesture.

4. A malware warning module for an electronic device, comprising:

a touch-enabled input module, (i) receiving touch-based user input to a web browser comprising identifiers to access content at a destination web site, (ii) registering to listen to redirection events for the web browser that receives the identifiers, and (iii) generating three different successive warning displays to prevent access to malicious content;

a first warning display generator, sending an identifier of a destination web site to a plurality of virus scan engines in response to said one or more input devices receiving the identifier for accessing content at the destination web site, and generating a first warning display comprising a threat level of content located at a destination web site, wherein the threat level is determined by a percentage of the virus scan engines that indicate that the destination web site is a threat;

a second warning display generator, generating a second warning display comprising information about both (i) the nature of the threat of the content, and (ii) a location of the destination web site, in response to the electronic device receiving a request for more information about the nature of the threat; and

a third warning display generator, generating a third warning display comprising an instruction to perform a confirmatory touch gesture to confirm a request to access the content, in response to the electronic device receiving a request to access the content; and

a content accessor, attempting to access the content in response to detecting the confirmatory touch gesture, recognizing an event that the identifier is being re-directed by the destination web site to another identifier, and re-invoking said first, second and third warning display generators with the other identifier, prior to accessing the content using the other identifier.

5. The module of claim 4 wherein the identifier is a URL.

6. The module of claim 4 wherein the confirmatory touch gesture is a swipe gesture.

7. A malware warning system, comprising:

a touch-enabled client computing device (i) sending requests to a web browser for accessing content at a destination web site, (ii) receiving replies from a server computing device, and (iii) registering to listen to redirection events for the web browser; and

a server computing device (i) receiving the requests from the client for accessing content at the destination web site, (ii) receiving from the client redirection events for the web browser, and (iii) generating three different warning displays to prevent access to malicious content, comprising;

a first warning display generator, sending an identifier of a destination web site to a plurality of virus scan engines in response to receiving from the client the identifier from the client to access content at the destination web site, and sending to the client a first warning display comprising a threat level of content located at a destination web site, wherein the threat level is determined by a percentage of the virus scan engines that indicate that the destination web site is a threat;

a second warning display generator, sending to the client a second warning display comprising information about both (i) the nature of the threat of the content, and (ii) a location of the destination web site, in response to receiving from the client a request for more information about the nature of the threat;

a third warning display generator, sending to the client a third warning display comprising an instruction to perform a confirmatory touch gesture to confirm a request to access the content, in response to receiving from the client a request to access the content; and

a content accessor, attempting to access the content in response to detecting that the confirmatory touch gesture has been performed on said client, recognizing an event that the identifier is being re-directed by the destination web site to another identifier, and re-invoking said first, second and third warning generators with the other identifier, prior to accessing the content using the other identifier.

8. The system of claim 7 wherein the identifier is a URL.

9. The system of claim 7 wherein the confirmatory touch gesture is a swipe gesture.

10. A non-transitory computer readable medium storing instructions, which, when executed by a processor of an electronic device;

cause the processor to;

register to listen to redirection events for a web browser that receives identifiers for accessing content at a destination web site;

receive, by the web browser, an identifier for accessing content at a destination web site;

in response to the browser receiving the identifier, send the identifier to a plurality of virus scan engines;

generate a first warning display comprising a threat level of content located at the destination web site, wherein the threat level is determined by a percentage of the virus scan engines that indicate that the destination web site is a threat;

receive a request to access the content;

in response to receiving the request to access the content, generate a second warning display comprising an instruction to perform a confirmatory touch gesture to confirm the request to access the content;

in response to detecting the confirmatory touch gesture, attempt to access the content at the destination web site;

recognize an event that the identifier is being re-directed by the destination web site to another identifies; and

prior to accessing the content using the other identifier, repeat said generating a warning, and attempt to access the content, using the other identifier.

11. The computer readable medium of claim 10 wherein the identifier is a URL.

12. The computer readable medium of claim 10 wherein the confirmatory touch gesture is a swipe gesture.

13. A malware warning module for an electronic device, comprising:

one or more touch-enabled input devices comprising web browsers, and (i) receiving touch-based identifiers for the web browsers to access content at a destination web site, and (ii) registering to listen to redirection events for the web browsers;

a first warning display generator, sending an identifier of a destination web site to a plurality of virus scan engines in response to said one or more input devices receiving the identifier to accessing content at the destination web site, and generating a warning comprising a threat level of content located at the destination web site, wherein the threat level is determined by a percentage of the virus scan engines that indicate that the destination web site is a threat;

a second warning display generator, generating a warning comprising an instruction to perform a confirmatory touch gesture to confirm a request to access the content, in response to said one or more input devices receiving the request to access the content; and

a content accessor, attempting to access the content in response to detecting the confirmatory touch gesture, recognizing an event that the identifier is being re-directed by the destination web site to another identifier, and re-invoking said first and second warning generators with the other identifier, prior to accessing the content using the other identifier.

14. The module of claim 13 wherein the identifier is a URL.

15. The module of claim 13 wherein the confirmatory touch gesture is a swipe gesture.

16. A malware warning system, comprising:

a touch-enabled client computer device sending requests comprising an identifier to a web browser for accessing content at a destination web site and receiving replies from a server computing device, and registering to listen to redirection events for the web browser; and

a server computing device receiving the requests from the client computer device, comprising;

a first warning display generator, sending an identifier of a destination web she to a plurality of virus scan engines in response to receiving from the client a request for accessing content at a destination web site, and sending to the client a warning comprising a threat level of content located at the destination web site, wherein the threat level is determined by a percentage of the virus scan engines that indicate that the destination web site is a threat;

a second warning display generator, sending to the client a warning comprising an instruction to perform a confirmatory touch gesture to confirm a request to access the content, in response to receiving from the client the request to access the content; and

a content accessor, attempting to access the content in response to detecting that the confirmatory touch gesture has been performed on said client, recognizing an event that the identifier is being re-directed by the destination web site to another identifier, and re-invoking said first and second warning generators with the other identifier, prior to accessing the content using the other identifier.

17. The system of claim 16 wherein the identifier is a URL.

18. The system of claim 16 wherein the confirmatory touch gesture is a swipe gesture.