Advanced responses to online fraud

• US 20070192853A1
• Filed: 11/23/2004
• Published: 08/16/2007
• Est. Priority Date: 05/02/2004
• Status: Active Grant

• Current Assignee: Opsec Online Limited
• Original Assignee: MarkMonitor Inc.
• Inventors: Shull, Mark, Shraim, Ihab
• Granted Patent: US 7,913,302 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Various embodiments of the invention provide solutions (including inter alia, systems, methods and software) for dealing with online fraud. In particular, various embodiments of the invention provide advanced responses to an identified instance of online fraud. Such advanced responses can incorporate one or more of a variety of strategies for defeating an attempt by a server to filter and/or otherwise avoid responses to its fraudulent activity. Merely by way of example, in accordance with some embodiments, one or more HTTP responses to a server'"'"'s request (such as an online form, etc.) may be submitted and/or transmitted for reception by the server. In some cases, each of the submitted responses may appear to comprise valid information responsive to the server'"'"'s request. In other cases, one or more countermeasures may be implemented to defeat an attempt by a phisher (or any other operator of an illegitimate server) to filter responses.

Claims

1. A method of combating online fraud, the method comprising:

determining that a web server is engaged in a fraudulent activity;

creating with a computer a plurality of hypertext transfer protocol (“

HTTP”

) responses for transmission to the web server, wherein each of the plurality of HTTP responses appears to comprise valid information responsive to a request from the web server; and

transmitting the plurality of HTTP responses for reception by the web server.

2. A method of combating online fraud as recited in claim 1, wherein determining that a web server is engaged in a fraudulent activity comprises interrogating the web server.

3. A method of combating online fraud, the method comprising:

creating with a computer a plurality of hypertext transfer protocol (“

HTTP”

) responses for transmission to a web server suspected of being involved in a fraudulent activity, wherein each of the plurality of HTTP responses appears to comprise valid information responsive to a request from the web server;

transmitting the plurality of HTTP responses for reception by the web server; and

implementing at least one countermeasure to impair an attempt to filter the plurality of HTTP responses.

4. A method of combating online fraud as recited in claim 3, wherein transmitting the plurality of HTTP responses comprises transmitting each of plurality of HTTP responses from one of a plurality of diverse Internet Protocol (IP) addresses.

5. A method of combating online fraud as recited in claim 3, wherein transmitting the plurality of HTTP responses comprises transmitting the plurality of HTTP responses via a megaproxy.

6. A method of combating online fraud as recited in claim 3, wherein the method further comprises receiving at least one electronic message comprising a uniform resource locator that references a web site hosted by the web server, and wherein implementing at least one countermeasure comprises:

parsing the message to determine at least one piece of information to be submitted with at least one of the plurality of responses.

7. A method of combating online fraud as recited in claim 6, wherein the at least one piece of information is an electronic mail address.

8. A method of combating online fraud as recited in claim 6, wherein the at least one piece of information is a response code.

9. A method of combating online fraud as recited in claim 3, wherein the method further comprises receiving a plurality of electronic messages, each of the plurality of electronic messages comprising a uniform resource locator that references a web site hosted by the web server, and wherein implementing at least one countermeasure comprises:

analyzing the plurality of messages to determine at least one similarity between the messages; and

ensuring that each of the plurality of responses accounts for the at least one similarity.

10. A method of combating online fraud as recited in claim 3, wherein implementing at least one countermeasure comprises:

analyzing an embedded test on a web page hosted by the web server, wherein the embedded test is designed to validate responses received by the web server; and

ensuring that each of the plurality of responses does not violate the embedded test.

11. A method of combating online fraud as recited in claim 3, each of the HTTP responses comprises a plurality of data elements, and wherein implementing at least one countermeasure comprises:

ensuring that at least one data element of each of the plurality of responses complies with a known standard that applies to the at least one data element.

12. A method of combating online fraud, the method comprising:

identifying with a computer an online form served by a web server and used to perpetrate a fraudulent activity;

analyzing with the computer the online form to determine a plurality of fields by which the online form collects data from a user;

creating with the computer a response to the online form, the response comprising a plurality of data elements corresponding to the plurality of fields by which the online form collects data from a user;

verifying that at least one of the data elements does not violate a test used by the web server to filter responses to the online form; and

transmitting the response for reception by the web server.

13. A method of combating online fraud as recited in claim 12, the method further comprising:

determining that a web server is engaged in a fraudulent activity;

14. A method of combating online fraud as recited in claim 12, wherein the response to the online form comprises safe data associated with a fictitious identity, the safe data appearing to comprise a valid response to the online form.

15. A method of combating online fraud as recited in claim 14, wherein the safe data is associated with an account at a financial institution.

16. A method of combating online fraud as recited in claim 15, the method further comprising:

monitoring the account at the financial institution for use, wherein said use indicates an attempted online fraud; and

tracing said use to identify a perpetrator of the attempted online fraud.

17. A method of responding to a web site, the method comprising:

receiving an electronic message comprising a uniform resource locator (“

URL”

) referencing a web site;

accessing the web site referenced by the URL;

downloading an online form provided by the web site, the online form comprising a plurality of fields configured to allow a user to provide information to the web site;

identifying a test on the web site, the test being designed to identify a user by reference to an electronic message transmitted by an operator of the web site and comprising a URL referencing the web site;

creating a set of safe data comprising a plurality of data elements, each of the data elements corresponding to one of the online form'"'"'s plurality of fields; and

ensuring that the set of safe data does not violate the test on the web site by identifying a user to whom the operator of the web site believes an electronic message was transmitted.

18. A method of responding to a web site as recited in claim 17, the method further comprising:

transmitting the set of safe data for reception by the web site, wherein the set of safe date comprises a response to the online form.

19. A method of responding to a web site as recited in claim 17, wherein creating a set of safe date comprises creating a plurality of sets of safe data, and wherein ensuring that the set of safe data does not violate the test on the web site comprises ensuring that each of the sets of safe data does not violate the test on the web site.

20. A method of responding to a web site as recited in claim 19, the method further comprising:

transmitting the plurality of sets of safe data for reception by the web site, wherein each of plurality of the sets of safe data comprises a response to the online form.

21. A method of responding to a web site as recited in claim 18, wherein ensuring that the set of safe data does not violate the test on the web site comprises transmitting the safe data using the identity of a user to whom the operator of the web site believes an electronic message was transmitted.

22. A method of responding to a web site as recited in claim 17, wherein:

receiving an electronic message comprises receiving a plurality of electronic messages;

each of the plurality of electronic messages comprises a hyperlink referencing the web site;

the method further comprises identifying a similarity among the plurality of received electronic messages; and

ensuring that the set of safe data does not violate the test on the web site comprises ensuring that the set of safe data is consistent with the identified similarity among the plurality of electronic messages.

23. A method of responding to a web site as recited in claim 22, wherein the plurality of electronic messages were transmitted for reception by recipients at a particular domain, and wherein identifying the similarity among the plurality of messages comprises identifying the particular domain.

24. A method of responding to a web site as recited in claim 22, wherein each of the plurality of electronic messages comprises a response code generated by an algorithm, wherein identifying the similarity among the plurality of electronic messages comprises identifying the algorithm responsible for generating the response code in each of the plurality of messages, and wherein ensuring that the data set conforms with the test on the web site comprises ensuring that the data set comprises a data element corresponding to a response code generated from the algorithm.

25. A method of analyzing an online form, the method comprising:

accessing a web site;

downloading an online form from the web site, the online form comprising a plurality of fields corresponding to information requested by the web site;

identifying an embedded test associated with the online form, the embedded test comprising executable code, wherein the embedded test is used by an operator of the web site to determine the validity of responses to the online from;

analyzing the executable code to identify a response that conforms with the embedded test; and

creating a set of safe data comprising a plurality of data elements, each of the data elements comprising information corresponding to one of the plurality of the online form'"'"'s fields, wherein at least one of the data elements comprises a response that conforms with the embedded test.

26. A method of analyzing an online form as recited in claim 25, wherein the embedded test is incorporated within the online form.

27. A method of analyzing an online form as recited in claim 25, wherein the embedded test is incorporated within an electronic message directing users to the web site.

28. A method of analyzing an online form as recited in claim 25, wherein the embedded test resides on the web site.

29. A method of analyzing an online form as recited in claim 25, wherein the executable code is selected from the group consisting of a Java applet, a JavaScript, and a computer gateway interface (“

CGI”

) application.

30. A method of analyzing an online form as recited in claim 25, wherein the embedded test implements a device selected from the group consisting of a cookie, a timer, a counter, and a hash function.

31. A computer system for combating online fraud, the computer system comprising a processor and a computer readable medium with instructions executable by the processor to:

determine that a web server is engaged in a fraudulent activity;

create with a computer a plurality of hypertext transfer protocol (“

HTTP”

) responses for transmission to the web server, wherein each of the plurality of HTTP responses appears to comprise valid information responsive to a request from the web server; and

transmit the plurality of HTTP responses for reception by the web server.

32. A computer system for combating online fraud, the computer system comprising a processor and a computer readable medium with instructions executable by the processor to:

create a plurality of hypertext transfer protocol (“

HTTP”

) responses for transmission to a web server suspected of being involved in a fraudulent activity, wherein each of the plurality of HTTP responses appears to comprise valid information responsive to a request from the web server;

transmit the plurality of HTTP responses for reception by the web server; and

implement at least one countermeasure to impair the ability of an attempt to filter the plurality of HTTP responses.

33. A computer system for combating online fraud, the computer system comprising a processor and a computer readable medium with instructions executable by the processor to:

identify an online form served by a web server and used to perpetrate a fraudulent activity;

analyze the online form to determine a plurality of fields by which the online form collects data from a user;

create a response to the online form, the response comprising a plurality of data elements corresponding to the plurality of fields by which the online form collects data from a user;

verify that at least one of the data elements does not violate a test used by the web server to filter responses to the online form; and

transmit the response for reception by the web server.

34. A computer system for responding to a web site, the computer system comprising a processor and a computer readable medium with instructions executable by the processor to:

receive an electronic message comprising a uniform resource locator (“

URL”

) referencing a web site;

access the web site referenced by the URL;

download an online form provided by the web site, the online form comprising a plurality of fields configured to allow a user to provide information to the web site;

identify a test on the web site, the test being designed to identify a user by reference to an electronic message transmitted by an operator of the web site and comprising a URL referencing the web site;

create a set of safe data comprising a plurality of data elements, each of the data elements corresponding to one of the online form'"'"'s plurality of fields; and

ensure that the set of safe data does not violate the test on the web site by identifying a user to whom the operator of the web site believes an electronic message was transmitted.

35. A computer system for analyzing an online form, the computer system comprising a processor and a computer readable medium with instructions executable by the processor to:

access a web site;

download an online form from the web site, the online form comprising a plurality of fields corresponding to information requested by the web site;

identify an embedded test associated with the online form, the embedded test comprising executable code, wherein the embedded test is used by an operator of the web site to determine the validity of responses to the online from;

analyze the executable code to identify a response that conforms with the embedded test; and

create a set of safe data comprising a plurality of data elements, each of the data elements comprising information corresponding to one of the plurality of the online form'"'"'s fields, wherein at least one of the data elements comprises a response that conforms with the embedded test.

36. A software program embodied on a computer readable medium, the software program comprising instructions executable by one or more computers to:

determine that a web server is engaged in a fraudulent activity;

create with a computer a plurality of hypertext transfer protocol (“

HTTP”

) responses for transmission to the web server, wherein each of the plurality of HTTP responses appears to comprise valid information responsive to a request from the web server; and

transmit the plurality of HTTP responses for reception by the web server.

37. A software program embodied on a computer readable medium, the software program comprising instructions executable by one or more computers to:

create a plurality of hypertext transfer protocol (“

HTTP”

) responses for transmission to a web server suspected of being involved in a fraudulent activity, wherein each of the plurality of HTTP responses appears to comprise valid information responsive to a request from the web server;

transmit the plurality of HTTP responses for reception by the web server; and

implement at least one countermeasure to impair an attempt to filter the plurality of HTTP responses.

38. A software program embodied on a computer readable medium, the software program comprising instructions executable by one or more computers to:

identify an online form served by a web server and used to perpetrate a fraudulent activity;

analyze the online form to determine a plurality of fields by which the online form collects data from a user;

create a response to the online form, the response comprising a plurality of data elements corresponding to the plurality of fields by which the online form collects data from a user;

verify that at least one of the data elements does not violate a test used by the web server to filter responses to the online form; and

transmit the response for reception by the web server.

39. A software program embodied on a computer readable medium, the software program comprising instructions executable by one or more computers to:

receive an electronic message comprising a uniform resource locator (“

URL”

) referencing a web site;

access the web site referenced by the URL;

download an online form provided by the web site, the online form comprising a plurality of fields configured to allow a user to provide information to the web site;

identify a test on the web site, the test being designed to identify a user by reference to an electronic message transmitted by an operator of the web site and comprising a URL referencing the web site;

create a set of safe data comprising a plurality of data elements, each of the data elements corresponding to one of the online form'"'"'s plurality of fields; and

ensure that the set of safe data does not violate the test on the web site by identifying a user to whom the operator of the web site believes an electronic message was transmitted.

40. A software program embodied on a computer readable medium, the software program comprising instructions executable by one or more computers to:

access a web site;

download an online form from the web site, the online form comprising a plurality of fields corresponding to information requested by the web site;

identify an embedded test associated with the online form, the embedded test comprising executable code, wherein the embedded test is used by an operator of the web site to determine the validity of responses to the online from;

analyze the executable code to identify a response that conforms with the embedded test; and

create a set of safe data comprising a plurality of data elements, each of the data elements comprising information corresponding to one of the plurality of the online form'"'"'s fields, wherein at least one of the data elements comprises a response that conforms with the embedded test.

41. A system, comprising:

means for determining that a web server is engaged in a fraudulent activity;

creating with a computer a plurality of hypertext transfer protocol (“

HTTP”

) responses for transmission to the web server, wherein each of the plurality of HTTP responses appears to comprise valid information responsive to a request from the web server; and

means for transmitting the plurality of HTTP responses for reception by the web server.

42. A system, comprising:

means for creating a plurality of hypertext transfer protocol (“

HTTP”

) responses for transmission to a web server suspected of being involved in a fraudulent activity, wherein each of the plurality of HTTP responses appears to comprise valid information responsive to a request from the web server;

means for transmitting the plurality of HTTP responses for reception by the web server; and

means for implementing at least one countermeasure to impair an attempt to filter the plurality of HTTP responses.

43. A system, comprising:

means for identifying an online form served by a web server and used to perpetrate a fraudulent activity;

means for analyzing the online form to determine a plurality of fields by which the online form collects data from a user;

means for creating a response to the online form, the response comprising a plurality of data elements corresponding to the plurality of fields by which the online form collects data from a user;

means for verifying that at least one of the data elements does not violate a test used by the web server to filter responses to the online form; and

means for transmitting the response for reception by the web server.

44. A system, comprising:

means for receiving an electronic message comprising a uniform resource locator (“

URL”

) referencing a web site;

means for accessing the web site referenced by the URL;

means for downloading an online form provided by the web site, the online form comprising a plurality of fields configured to allow a user to provide information to the web site;

means for identifying a test on the web site, the test being designed to identify a user by reference to an electronic message transmitted by an operator of the web site and comprising a URL referencing the web site;

means for creating a set of safe data comprising a plurality of data elements, each of the data elements corresponding to one of the online form'"'"'s plurality of fields; and

means for ensuring that the set of safe data does not violate the test on the web site by identifying a user to whom the operator of the web site believes an electronic message was transmitted.

45. A system, comprising:

means for accessing a web site;

means for downloading an online form from the web site, the online form comprising a plurality of fields corresponding to information requested by the web site;

means for identifying an embedded test associated with the online form, the embedded test comprising executable code, wherein the embedded test is used by an operator of the web site to determine the validity of responses to the online from;

means for analyzing the executable code to identify a response that conforms with the embedded test; and

means for creating a set of safe data comprising a plurality of data elements, each of the data elements comprising information corresponding to one of the plurality of the online form'"'"'s fields, wherein at least one of the data elements comprises a response that conforms with the embedded test.