System and method for protecting computer users from web sites hosting computer viruses

• US 20030097591A1
• Filed: 11/20/2001
• Published: 05/22/2003
• Est. Priority Date: 11/20/2001
• Status: Abandoned Application

• Current Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Kuo, Jimmy, Yasuda, Yoshihiro, Gryaznov, Dmitry, Pham, Khai
• Application Number:
  US09/988,606
• Publication Number:
  US 20030097591A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A method, system, and computer program product for protecting computer users from Web sites hosting computer viruses and for protecting Web hosting systems from hosting Web pages that contains links to computer viruses. a method for protecting users from Web sites hosting computer viruses comprises the steps of: receiving information identifying a Web page selected for access by a user, determining whether the Web page is hosted by a Web site that is included in a database of Web sites related to computer viruses, and allowing access to the Web page based on whether the Web page includes a link to a Web site that is included in the database.

Claims

1. A method for protecting users from Web sites hosting computer viruses comprising the steps of:

receiving information identifying a Web page selected for access by a user;

determining whether the Web page is hosted by a Web site that is included in a database of Web sites related to computer viruses; and

allowing access to the Web page based on whether the Web page includes a link to a Web site that is included in the database.

2. The method of claim 1, further comprising the step of:

preventing access to the Web page before determining whether the Web page is included in the database.

3. The method of claim 2, wherein the allowing step comprises the steps of:

allowing access to the Web page, if the Web page is determined not to be included in the database; and

continuing to prevent access to the Web page, if the Web page is determined to be included in the database.

4. The method of claim 1, further comprising the step of:

allowing access to the Web page before determining whether the Web page is included in the database.

5. The method of claim 4, wherein the allowing step comprises the steps of:

continuing to allow access to the Web page, if the Web page is determined not to be included in the database; and

preventing access to the Web page, if the Web page is determined to be included in the database.

6. The method of claim 1, further comprising the step of:

generating the database of Web sites related to computer viruses.

7. The method of claim 6, wherein the generating step comprises the steps of:

extracting, from a first Web page, a link to a second Web page;

fetching the second Web page using the link;

scanning the second Web page for computer viruses; and

storing information relating to a Web site that is hosting the second Web page in the database.

8. The method of claim 7, wherein the stored information includes information identifying the Web site that is hosting the second Web page and information identifying any computer viruses that were found in the second Web page.

9. The method of claim 7, further comprising the steps of:

extracting, from each Web page fetched, links to other Web pages;

fetching the other Web pages using the links;

scanning the other Web pages for computer viruses; and

storing information relating to Web sites that are hosting the other Web pages in the database.

10. The method of claim 9, wherein the stored information includes information identifying the Web sites that are hosting the other Web pages and information identifying any computer viruses that were found in the other Web pages.

11. The method of claim 6, wherein the generating step comprises the steps of:

extracting, from a first Web page, a link to a second Web page;

fetching the second Web page using the link;

scanning the second Web page for terminology relating to computer viruses;

reviewing content of the second Web page to determine whether a Web site hosting the second Web page is virus hosting, if the second Web page includes terminology relating to computer viruses; and

storing information relating to the Web site that is hosting the second Web page in the database.

12. The method of claim 11, wherein the stored information includes information identifying the second Web page and information identifying any computer viruses that were found in the second Web page.

13. The method of claim 11, further comprising the steps of:

extracting, from each Web page fetched, links to other Web pages;

fetching the other Web pages using the links;

scanning the other Web pages for terminology relating to computer viruses;

reviewing content of those other Web pages that include terminology relating to computer viruses to determine whether Web sites hosting the other Web page are virus hosting; and

storing information relating to the Web sites that are hosting the other Web pages in the database.

14. The method of claim 13, wherein the stored information includes information identifying the Web sites that are hosting the other Web pages and information identifying any computer viruses that were found in the other Web pages.

15. A method for protecting a Web hosting system from hosting a Web page that contains a link to a computer virus comprising the steps of:

receiving information identifying a first Web page to be hosted by the Web hosting system;

determining whether the first Web page includes a link to a Web site that is included in a database of Web sites related to computer viruses; and

allowing hosting of the first Web page based on whether the Web page includes a link to a Web site that is included in the database.

16. The method of claim 15, wherein the determining step comprises the steps of:

extracting, from the first Web page, links to other Web pages; and

determining whether the other Web pages are hosted by Web sites that are included in the database.

17. The method of claim 16, wherein the allowing step comprises the steps of:

refusing to host the first Web page, if the first Web page includes a link to a Web page that is hosted by a Web site that is included in the database; and

hosting the first Web page, if the first Web page includes no links to a any Web pages that are hosted by a Web site that is included in the database.

18. The method of claim 17, further comprising the step of:

generating the database of Web sites related to computer viruses.

19. The method of claim 18, wherein the generating step comprises the steps of:

extracting, from a first Web page, a link to a second Web page;

fetching the second Web page using the link;

scanning the second Web page for computer viruses; and

storing information relating to a Web site that is hosting the second Web page in the database.

20. The method of claim 19, wherein the stored information includes information identifying the Web site that is hosting the second Web page and information identifying any computer viruses that were found in the second Web page.

21. The method of claim 19, further comprising the steps of:

extracting, from each Web page fetched, links to other Web pages;

fetching the other Web pages using the links;

scanning the other Web pages for computer viruses; and

storing information relating to Web sites that are hosting the other Web pages in the database.

22. The method of claim 21, wherein the stored information includes information identifying the Web sites that are hosting the other Web pages and information identifying any computer viruses that were found in the other Web pages.

23. The method of claim 18, wherein the generating step comprises the steps of:

extracting, from a first Web page, a link to a second Web page;

fetching the second Web page using the link;

scanning the second Web page for terminology relating to computer viruses;

reviewing content of the second Web page to determine whether a Web site hosting the second Web page is virus hosting, if the second Web page includes terminology relating to computer viruses; and

storing information relating to the Web site that is hosting the second Web page in the database.

24. The method of claim 23, wherein the stored information includes information identifying the second Web page and information identifying any computer viruses that were found in the second Web page.

25. The method of claim 23, further comprising the steps of:

extracting, from each Web page fetched, links to other Web pages;

fetching the other Web pages using the links;

scanning the other Web pages for terminology relating to computer viruses;

reviewing content of those other Web pages that include terminology relating to computer viruses to determine whether Web sites hosting the other Web page are virus hosting; and

storing information relating to the Web sites that are hosting the other Web pages in the database.

26. The method of claim 25, wherein the stored information includes information identifying the Web sites that are hosting the other Web pages and information identifying any computer viruses that were found in the other Web pages.

27. A system for protecting users from Web sites hosting computer viruses comprising:

a processor operable to execute computer program instructions;

a memory operable to store computer program instructions executable by the processor; and

computer program instructions stored in the memory and executable to perform the steps of;

receiving information identifying a Web page selected for access by a user;

determining whether the Web page is hosted by a Web site that is included in a database of Web sites related to computer viruses; and

allowing access to the Web page based on whether the Web page includes a link to a Web site that is included in the database.

28. The system of claim 27, further comprising computer program instructions executable to perform the step of:

preventing access to the Web page before determining whether the Web page is included in the database.

29. The system of claim 28, wherein the allowing step comprises the steps of:

allowing access to the Web page, if the Web page is determined not to be included in the database; and

continuing to prevent access to the Web page, if the Web page is determined to be included in the database.

30. The system of claim 27, further comprising computer program instructions executable to perform the step of:

allowing access to the Web page before determining whether the Web page is included in the database.

31. The system of claim 30, wherein the allowing step comprises the steps of:

continuing to allow access to the Web page, if the Web page is determined not to be included in the database; and

preventing access to the Web page, if the Web page is determined to be included in the database.

32. The system of claim 27, further comprising computer program instructions executable to perform the step of:

generating the database of Web sites related to computer viruses.

33. The system of claim 32, wherein the generating step comprises the steps of:

extracting, from a first Web page, a link to a second Web page;

fetching the second Web page using the link;

scanning the second Web page for computer viruses; and

storing information relating to a Web site that is hosting the second Web page in the database.

34. The system of claim 33, wherein the stored information includes information identifying the Web site that is hosting the second Web page and information identifying any computer viruses that were found in the second Web page.

35. The system of claim 33, further comprising computer program instructions executable to perform the steps of:

extracting, from each Web page fetched, links to other Web pages;

fetching the other Web pages using the links;

scanning the other Web pages for computer viruses; and

storing information relating to Web sites that are hosting the other Web pages in the database.

36. The system of claim 35, wherein the stored information includes information identifying the Web sites that are hosting the other Web pages and information identifying any computer viruses that were found in the other Web pages.

37. The system of claim 32, wherein the generating step comprises the steps of:

extracting, from a first Web page, a link to a second Web page;

fetching the second Web page using the link;

scanning the second Web page for terminology relating to computer viruses;

reviewing content of the second Web page to determine whether a Web site hosting the second Web page is virus hosting, if the second Web page includes terminology relating to computer viruses; and

storing information relating to the Web site that is hosting the second Web page in the database.

38. The system of claim 37, wherein the stored information includes information identifying the second Web page and information identifying any computer viruses that were found in the second Web page.

39. The system of claim 37, further comprising computer program instructions executable to perform the steps of:

extracting, from each Web page fetched, links to other Web pages;

fetching the other Web pages using the links;

scanning the other Web pages for terminology relating to computer viruses;

reviewing content of those other Web pages that include terminology relating to computer viruses to determine whether Web sites hosting the other Web page are virus hosting; and

storing information relating to the Web sites that are hosting the other Web pages in the database.

40. The system of claim 39, wherein the stored information includes information identifying the Web sites that are hosting the other Web pages and information identifying any computer viruses that were found in the other Web pages.

41. A system for protecting a Web hosting system from hosting a Web page that contains a link to a computer virus comprising:

a processor operable to execute computer program instructions;

a memory operable to store computer program instructions executable by the processor; and

computer program instructions stored in the memory and executable to perform the steps of;

receiving information identifying a first Web page to be hosted by the Web hosting system;

determining whether the first Web page includes a link to a Web site that is included in a database of Web sites related to computer viruses; and

allowing hosting of the first Web page based on whether the Web page includes a link to a Web site that is included in the database.

42. The system of claim 41, wherein the determining step comprises the steps of:

extracting, from the first Web page, links to other Web pages; and

determining whether the other Web pages are hosted by Web sites that are included in the database.

43. The system of claim 42, wherein the allowing step comprises the steps of:

refusing to host the first Web page, if the first Web page includes a link to a Web page that is hosted by a Web site that is included in the database; and

hosting the first Web page, if the first Web page includes no links to a any Web pages that are hosted by a Web site that is included in the database.

44. The system of claim 43, further comprising computer program instructions executable to perform the steps of:

generating the database of Web sites related to computer viruses.

45. The system of claim 44, wherein the generating step comprises the steps of:

extracting, from a first Web page, a link to a second Web page;

fetching the second Web page using the link;

scanning the second Web page for computer viruses; and

storing information relating to a Web site that is hosting the second Web page in the database.

46. The system of claim 45, wherein the stored information includes information identifying the Web site that is hosting the second Web page and information identifying any computer viruses that were found in the second Web page.

47. The system of claim 45, further comprising computer program instructions executable to perform the steps of:

extracting, from each Web page fetched, links to other Web pages;

fetching the other Web pages using the links;

scanning the other Web pages for computer viruses; and

storing information relating to Web sites that are hosting the other Web pages in the database.

48. The system of claim 47, wherein the stored information includes information identifying the Web sites that are hosting the other Web pages and information identifying any computer viruses that were found in the other Web pages.

49. The system of claim 44, wherein the generating step comprises the steps of:

extracting, from a first Web page, a link to a second Web page;

fetching the second Web page using the link;

scanning the second Web page for terminology relating to computer viruses;

reviewing content of the second Web page to determine whether a Web site hosting the second Web page is virus hosting, if the second Web page includes terminology relating to computer viruses; and

storing information relating to the Web site that is hosting the second Web page in the database.

50. The system of claim 49, wherein the stored information includes information identifying the second Web page and information identifying any computer viruses that were found in the second Web page.

51. The system of claim 49, further comprising computer program instructions executable to perform the steps of:

extracting, from each Web page fetched, links to other Web pages;

fetching the other Web pages using the links;

scanning the other Web pages for terminology relating to computer viruses;

reviewing content of those other Web pages that include terminology relating to computer viruses to determine whether Web sites hosting the other Web page are virus hosting; and

storing information relating to the Web sites that are hosting the other Web pages in the database.

52. The system of claim 51, wherein the stored information includes information identifying the Web sites that are hosting the other Web pages and information identifying any computer viruses that were found in the other Web pages.

53. A computer program product for protecting users from Web sites hosting computer viruses, comprising:

a computer readable medium;

computer program instructions, recorded on the computer readable medium, executable by a processor, for performing the steps of

receiving information identifying a Web page selected for access by a user;

determining whether the Web page is hosted by a Web site that is included in a database of Web sites related to computer viruses; and

allowing access to the Web page based on whether the Web page includes a link to a Web site that is included in the database.

54. The computer program product of claim 53, further comprising computer program instructions executable to perform the steps of:

preventing access to the Web page before determining whether the Web page is included in the database.

55. The computer program product of claim 54, wherein the allowing step comprises the steps of:

allowing access to the Web page, if the Web page is determined not to be included in the database; and

continuing to prevent access to the Web page, if the Web page is determined to be included in the database.

56. The computer program product of claim 53, further comprising computer program instructions executable to perform the steps of:

allowing access to the Web page before determining whether the Web page is included in the database.

57. The computer program product of claim 56, wherein the allowing step comprises the steps of:

continuing to allow access to the Web page, if the Web page is determined not to be included in the database; and

preventing access to the Web page, if the Web page is determined to be included in the database.

58. The computer program product of claim 53, further comprising computer program instructions executable to perform the steps of:

generating the database of Web sites related to computer viruses.

59. The computer program product of claim 58, wherein the generating step comprises the steps of:

extracting, from a first Web page, a link to a second Web page;

fetching the second Web page using the link;

scanning the second Web page for computer viruses; and

storing information relating to a Web site that is hosting the second Web page in the database.

60. The computer program product of claim 59, wherein the stored information includes information identifying the Web site that is hosting the second Web page and information identifying any computer viruses that were found in the second Web page.

61. The computer program product of claim 59, further comprising computer program instructions executable to perform the steps of:

extracting, from each Web page fetched, links to other Web pages;

fetching the other Web pages using the links;

scanning the other Web pages for computer viruses; and

storing information relating to Web sites that are hosting the other Web pages in the database.

62. The computer program product of claim 61, wherein the stored information includes information identifying the Web sites that are hosting the other Web pages and information identifying any computer viruses that were found in the other Web pages.

63. The computer program product of claim 58, wherein the generating step comprises the steps of:

extracting, from a first Web page, a link to a second Web page;

fetching the second Web page using the link;

scanning the second Web page for terminology relating to computer viruses;

reviewing content of the second Web page to determine whether a Web site hosting the second Web page is virus hosting, if the second Web page includes terminology relating to computer viruses; and

storing information relating to the Web site that is hosting the second Web page in the database.

64. The computer program product of claim 63, wherein the stored information includes information identifying the second Web page and information identifying any computer viruses that were found in the second Web page.

65. The computer program product of claim 63, further comprising computer program instructions executable to perform the steps of:

extracting, from each Web page fetched, links to other Web pages;

fetching the other Web pages using the links;

scanning the other Web pages for terminology relating to computer viruses;

reviewing content of those other Web pages that include terminology relating to computer viruses to determine whether Web sites hosting the other Web page are virus hosting; and

storing information relating to the Web sites that are hosting the other Web pages in the database.

66. The computer program product of claim 65, wherein the stored information includes information identifying the Web sites that are hosting the other Web pages and information identifying any computer viruses that were found in the other Web pages.

67. A computer program product for protecting a Web hosting system from hosting a Web page that contains a link to a computer virus, comprising:

a computer readable medium;

computer program instructions, recorded on the computer readable medium, executable by a processor, for performing the steps of

receiving information identifying a first Web page to be hosted by the Web hosting system;

determining whether the first Web page includes a link to a Web site that is included in a database of Web sites related to computer viruses; and

allowing hosting of the first Web page based on whether the Web page includes a link to a Web site that is included in the database.

68. The computer program product of claim 67, wherein the determining step comprises the steps of:

extracting, from the first Web page, links to other Web pages; and

determining whether the other Web pages are hosted by Web sites that are included in the database.

69. The computer program product of claim 68, wherein the allowing step comprises the steps of:

refusing to host the first Web page, if the first Web page includes a link to a Web page that is hosted by a Web site that is included in the database; and

hosting the first Web page, if the first Web page includes no links to a any Web pages that are hosted by a Web site that is included in the database.

70. The computer program product of claim 69, further comprising computer program instructions executable to perform the steps of:

generating the database of Web sites related to computer viruses.

71. The computer program product of claim 70, wherein the generating step comprises the steps of:

extracting, from a first Web page, a link to a second Web page;

fetching the second Web page using the link;

scanning the second Web page for computer viruses; and

storing information relating to a Web site that is hosting the second Web page in the database.

72. The computer program product of claim 71, wherein the stored information includes information identifying the Web site that is hosting the second Web page and information identifying any computer viruses that were found in the second Web page.

73. The computer program product of claim 71, further comprising computer program instructions executable to perform the steps of:

extracting, from each Web page fetched, links to other Web pages;

fetching the other Web pages using the links;

scanning the other Web pages for computer viruses; and

storing information relating to Web sites that are hosting the other Web pages in the database.

74. The computer program product of claim 73, wherein the stored information includes information identifying the Web sites that are hosting the other Web pages and information identifying any computer viruses that were found in the other Web pages.

75. The computer program product of claim 70, wherein the generating step comprises the steps of:

extracting, from a first Web page, a link to a second Web page;

fetching the second Web page using the link;

scanning the second Web page for terminology relating to computer viruses;

reviewing content of the second Web page to determine whether a Web site hosting the second Web page is virus hosting, if the second Web page includes terminology relating to computer viruses; and

storing information relating to the Web site that is hosting the second Web page in the database.

76. The computer program product of claim 75, wherein the stored information includes information identifying the second Web page and information identifying any computer viruses that were found in the second Web page.

77. The computer program product of claim 75, further comprising computer program instructions executable to perform the steps of:

extracting, from each Web page fetched, links to other Web pages;

fetching the other Web pages using the links;

scanning the other Web pages for terminology relating to computer viruses;

reviewing content of those other Web pages that include terminology relating to computer viruses to determine whether Web sites hosting the other Web page are virus hosting; and

storing information relating to the Web sites that are hosting the other Web pages in the database.

78. The computer program product of claim 77, wherein the stored information includes information identifying the Web sites that are hosting the other Web pages and information identifying any computer viruses that were found in the other Web pages.