REAL-TIME HARMFUL WEBSITE BLOCKING METHOD USING OBJECT ATTRIBUTE ACCESS ENGINE

• US 20110087781A1
• Filed: 12/17/2010
• Published: 04/14/2011
• Est. Priority Date: 06/19/2008
• Status: Active Grant

• Current Assignee: Humotion Company Limited
• Original Assignee: Humotion Company Limited
• Inventors: Kim, Seong-Jin
• Granted Patent: US 8,510,443 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A real-time harmful website blocking method using an object attribute access engine is disclosed. In one embodiment, information about visual objects, currently being displayed on a screen by processes currently being executed, is obtained from a client. Attributes of the visual objects are extracted from the obtained information about the visual objects. Whether harmfulness is present is determined based on the extracted object attributes, and thus whether to block access to a server being connected thereto is decided. The client is requested to terminate a process for displaying the visual objects.

Claims

1. A real-time harmful website blocking method using an object attribute access engine, comprising:

obtaining information about visual objects, currently being displayed on a screen by processes currently being executed, from a client;

extracting attributes of the visual objects from the information about the visual objects;

determining whether harmfulness is present based on the extracted object attributes, and thus deciding whether to block access to a server being connected thereto; and

requesting the client to terminate a process for displaying the visual objects.

2. The real-time harmful website blocking method according to claim 1, wherein the client is an object-oriented Operating System (OS) running on a user computer.

3. The real-time harmful website blocking method according to claim 1, wherein the information about the visual objects is requested at regular periods of about 0.05 ms to about 1 ms.

4. The real-time harmful website blocking method according to claim 1, wherein the obtaining comprises:

retrieving a list of processes currently being executed and process information from the client;

transmitting an instruction for obtaining a handle ID value of a currently activated window to the client and obtaining the handle ID value;

requesting the client to convert the handle ID value into a process ID value of a process for executing the window, and obtaining the process ID value;

finding an identical process corresponding to the process ID value from the list of processes currently being executed and process information, based on the process ID value;

extracting a root visual object from the found identical process, and obtaining a handle ID value of the visual object; and

obtaining handle ID values of lower visual objects based on the handle ID value of the root visual object.

5. The real-time harmful website blocking method according to claim 4, wherein the extracting comprises:

calling individual attributes of the visual objects on the client and obtaining the individual attributes from the client, based on the handle ID values of the visual objects; and

grouping visual objects having an identical parent visual object through the obtained attributes of the visual objects, and generating connection relationships between the visual objects.

6. The real-time harmful website blocking method according to claim 5, wherein the determining comprises:

comparing, in a first blocking determination stage, connection relationships between objects previously obtained from obscene websites to be blocked and previously stored, with connection relationships between the visual objects obtained from the processes currently being executed, and then deciding to block a relevant process when the connection relationships are identical to each other;

if the process passes the first blocking determination stage, comparing, in a second blocking determination stage, object style attributes and location and size attributes, previously set as properties of obscene websites to be blocked, with object style attributes and location and size attributes of the visual objects obtained from the processes currently being executed, and then deciding to block the relevant process when the object style attributes and the location size attributes are identical to each other;

if the process passes the second blocking determination stage, determining, in a third blocking determination stage, using a database in which words having a possibility of being highly obscene are previously selected from Hypertext Markup Language (HTML) text of obscene websites to be blocked and are previously stored, whether the selected words are included in HTML text of the visual objects obtained from the processes currently being executed, and then deciding to block the relevant process, based on a result of the determination; and

if the process passes the third blocking determination stage, deciding to block the relevant process in a fourth blocking determination stage when an Internet address of a website on which the visual objects obtained from the processes currently being executed are displayed is present in a database in which Internet addresses of obscene websites to be blocked are stored.

7. The real-time harmful website blocking method according to claim 6, wherein the third blocking determination stage is performed such that:

the selected words are classified in descending order of a possibility of being obscene into respective grades, and are stored in a database with weights assigned to the grades, and

the HTML text included in the visual objects obtained from the processes currently being executed is searched for words identical to the selected words, weights are assigned to the found words, and it is determined that the process is a harmful process if a total sum of the found words exceeds a preset value.

8. The real-time harmful website blocking method according to claim 1, wherein the requesting comprises:

accessing a relevant process determined to be harmful in termination mode, based on a process ID value of the relevant process, and obtaining authority for the process from the client;

obtaining a termination code of the process from the client; and

transmitting the termination code to the client and terminating the relevant process.

9. The real-time harmful website blocking method according to claim 1, wherein the obtaining, the extracting or the determining is re-executed if it is delayed by a predetermined period of time or longer.

10. The real-time harmful website blocking method according to claim 9, wherein the re-execution is performed by a watchdog timer.

11. A real-time harmful website blocking system using an object attribute access engine, comprising:

means for obtaining information about visual objects, currently being displayed on a screen by processes currently being executed, from a client;

means for extracting attributes of the visual objects from the information about the visual objects;

means for determining whether harmfulness is present based on the extracted object attributes, and thus deciding whether to block access to a server being connected thereto; and

means for requesting the client to terminate a process for displaying the visual objects.