SYSTEM AND METHOD FOR SCANNING AND MARKING WEB CONTENT

• US 20110030058A1
• Filed: 07/09/2010
• Published: 02/03/2011
• Est. Priority Date: 03/24/2006
• Status: Active Grant

• Current Assignee: Avast Software SRO (Gen Digital Inc.)
• Original Assignee: AVG Netherlands B.V. (Gen Digital Inc.)
• Inventors: Ben-Itzhak, Yuval, Mosher, Gregory A.
• Granted Patent: US 8,769,690 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Instructions to access content at a destination node is intercepted. Content at the destination node is analyzed for malicious components, and results of the analysis are associated with the content prior to being presented to viewers of the content.

Claims

1. A method for analyzing content for malicious components, the method comprising:

monitoring, at a sender device, a submission of electronic instructions to access content;

scanning the content for one or more malicious components to obtain a scan result; and

presenting an indicator associated with the content, wherein the indicator is based on the scan result.

2. The method of claim 1, wherein the sender device sends the electronic instructions and the steps of monitoring, scanning, and presenting are performed by the sender device.

3. The method of claim 1 wherein the electronic instructions comprise an instruction to visit a destination link.

4. The method of claim 1 wherein the electronic instructions comprise an instruction to view a multimedia file.

5. The method of claim 1 wherein the electronic instructions comprise the content.

6. The method of claim 1 wherein the electronic instructions to access content comprises a destination node and wherein the destination node is selected from a group comprising a content server, a bulletin board service, a publicly accessible electronic content source, a repository, and a database.

7. The method of claim 1 wherein the instructions are posted at a host-server, and the host-server is selected from a group consisting of a content server, a bulletin board service, and a publicly accessible electronic content source.

8. The method of claim 7 wherein the destination node is the host-server.

9. The method of claim 1 wherein the sender device sends the electronic instructions and at least one of the steps of scanning and presenting is performed by the host-server.

10. The method of claim 1, wherein the content comprises at least one of text data, audio data, image data, user-generated content, video data, and a link to content.

11. The method of claim 1 wherein the presenting step comprises displaying the content and the associated indicator in a webpage.

12. A method for analyzing content for malicious components, the method comprising:

monitoring, at a sender device, a submission of electronic instructions to access content wherein the instructions comprise a destination link to content at a destination node;

replacing the destination link with an alternate link;

presenting the alternate link;

in response to a request by a user to access content associated with the alternate link, scanning content at the destination link associated with the alternate link for one or more malicious components to obtain a scan result; and

directing the user to the content at the destination link in response to the scan result.

13. The method of claim 12, wherein the monitoring and replacing steps are performed by the sender device and the scanning and directing steps are performed by a host-server.

14. The method of claim 13 wherein the host-server is selected from a group consisting of a content server, a bulletin board service, and a publicly accessible electronic content source.

15. The method of claim 12 wherein the electronic instructions comprise an instruction to visit a webpage.

16. The method of claim 12 wherein the electronic instructions comprise an instruction to view a multimedia file.

17. The method of claim 12 wherein the electronic instructions comprise the content.

18. The method of claim 12 wherein the destination node is selected from a group consisting of a content server, a bulletin board service, a publicly accessible electronic content source, a repository, a database, and a host-server whereupon the instructions are posted.

19. The method of claim 12 wherein the content comprises at least one of text data, audio data, image data, video data, instructions to a computer, and a link to content.

20. The method of claim 12 wherein the presenting step comprises displaying the alternate link in a webpage.

21. A system for analyzing content for malicious components, the system comprising:

a client device configured to facilitate electronic communications among individuals, the client device further comprising;

a monitor for monitoring electronic instructions to access content;

a scanner to scan the content for one or more malicious components to obtain a scan result; and

a presenter for presenting an indicator associated with the content wherein the indicator is based on the scan result.

22. The system of claim 21 wherein the content is stored at a content source destination node.

23. The system of claim 21 wherein the content source comprises a publically accessible electronic content source.

24. The system of claim 21 wherein the scanner comprises a computer-virus scanner.

25. The system of claim 21 wherein the scanner comprises a malware scanner.

26. A system for analyzing content for malicious components, the system comprising:

a sender device comprising;

a monitor for monitoring submissions of electronic instructions to access content, wherein the instructions comprise a destination link to the content at a destination node; and

a presenter for presenting an alternate link associated with the destination link; and

a host-server comprising;

a scanner to scan content at the destination node for one or more malicious components to obtain a scan result, in response to a user requesting access to content associated with the alternate link; and

a director to direct the user to the content at the destination node in response to the scan result.

27. The system of claim 26 wherein the destination node comprises a content source.

28. The system of claim 27 wherein the content source comprises a publically accessible electronic content source.

29. The system of claim 26 wherein the scanner comprises a computer-virus scanner.

30. The system of claim 26 wherein the scanner comprises a malware scanner.

31. The sending device of claim 26 further comprising:

a scanner to scan content at the destination node for one or more malicious components to obtain a scan result; and

a presenter for presenting the destination link and an indicator associated with the destination link, wherein the indicator is based on the scan result.