METHOD AND SYSTEM FOR MISUSE DETECTION

• US 20090282479A1
• Filed: 05/06/2009
• Published: 11/12/2009
• Est. Priority Date: 05/07/2008
• Status: Active Grant

• Current Assignee: ZeroFOX, Inc. (ZeroFox Holdings, Inc.)
• Original Assignee: Cyveillance, Inc. (ZeroFox Holdings, Inc.)
• Inventors: Smith, Steve, Ogorek, Greg, Walker, Andy, Serban, Vlad
• Granted Patent: US 9,148,445 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A method and system for discovering inappropriate and/or illegitimate use of Web page content, comprising: monitoring access to a first Web page by a user; comparing information from the first Web page to information from a second known legitimate Web page; and determining whether the first Web page is legitimate based on the compared information.

Claims

1. A method for discovering inappropriate and/or illegitimate use of Web page content, comprising:

monitoring access to at least one first Web page by at least one user;

comparing information from the at least one first Web page to information from at least one second known legitimate Web page; and

determining whether the at least one first Web page is legitimate based on the compared information.

2. The method of claim 1, wherein at least one element indicating whether the at least one first Web page is legitimate or not is sent to the at least one user.

3. The method of claim 1, wherein at least one element indicating that the at least one first Web page is legitimate is sent to the at least one user regardless of whether it is determined that the at least one first Web page is legitimate.

4. The method of claim 1, wherein the compared information is sent to at least one entity for evaluation and analysis.

5. The method of claim 1, wherein it is determined that the at least one first Web page is illegitimate before at least one good faith user is exposed to the at least one first Web page.

6. A system for discovering inappropriate use of Web page content, comprising:

at least one server coupled to at least one network;

at least one user terminal coupled to the at least one network; and

at least one application coupled to the at least one server and/or the at least one user terminal, wherein the at least one application is configured for;

monitoring access to at least one first Web page by at least one user;

comparing information from the at least one first Web page to information from at least one second known legitimate Web page; and

determining whether the at least one first Web page is legitimate based on the compared information.

7. The system of claim 6, wherein at least one element indicating whether the at least one first Web page is legitimate or not is sent to the at least one user.

8. The system of claim 6, wherein at least one element indicating that the at least one first Web page is legitimate is sent to the at least one user regardless of whether it is determined that the at least one first Web page is legitimate.

9. The system of claim 6, wherein the compared information is sent to at least one entity for evaluation and analysis.

10. The system of claim 6, wherein it is determined that the at least one first Web page is illegitimate before a good faith user is exposed to the at least one first Web page.