Identifying Malicious Text In Advertisement Content

• US 20160034950A1
• Filed: 08/01/2014
• Published: 02/04/2016
• Est. Priority Date: 08/01/2014
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Inventors: Dowling, Benjamin Mark, Schroeder, Andrew Joseph
• Granted Patent: US 10,445,770 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/63 Querying
• CPC Class Codes: G06Q 30/0248 Avoiding fraud
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

An online system receives advertisement requests from one or more advertisers and determines whether an advertisement request includes malicious content before presenting content from the advertisement request to a user. To determine whether the advertisement request includes malicious content, the online system identifies text in the advertisement request, identifies words in the text, and identifies characters in each word. The online system identifies a most common type of character in each word and generates a score for each word based on its constituent characters. For example, a word'"'"'s score is based on the combination of characters in the word, such as a conditional probability of a word including a type of character given that the word includes a given number of the most common type of character. The scores are analyzed to determine if text in the advertisement request includes malicious content.

Claims

1. A method comprising:

retrieving text included in advertisement content of an advertisement (“

ad”

) request for presentation to a user of an online system;

identifying one or more words included in the advertisement content;

identifying one or more characters included in each of the identified one or more words;

determining a type associated with each of the identified one or more characters;

determining a score associated with each word of the identified one or more words based at least in part on types associated with one or more characters identified in a word;

determining whether the advertisement content is malicious based at least in part on the determined scores associated with each word of the identified one or more words; and

determining whether the advertisement content is eligible for presentation to the user of the online system based at least in part on the determination of whether the advertisement content is malicious.

2. The method of claim 1, wherein determining the score associated with each word of the identified one or more words based at least in part on types associated with one or more characters identified in the word comprises:

determining, for each of the identified one or more words, a most common type associated with characters in the word;

determining a conditional probability of one or more characters included in the word having a specific type based at least in part on a number of characters in the word and a number of characters in the word associated with a most common type associated with characters in the word; and

determining the score associated with the word based at least in part on the determined conditional probability.

3. The method of claim 1, wherein determining the score associated with each word of the identified one or more words based at least in part on types associated with one or more characters identified in the word comprises:

determining probabilities of each character in the word being followed by a subsequent character in the one or more characters included in the word; and

determining a score for the word based at least in part on the determined probabilities.

4. The method of claim 3, wherein determining the score for the word based at least in part on the determined probabilities comprises:

determining a sum of the determined probabilities.

5. The method of claim 3, wherein determining the score for the word based at least in part on the determined probabilities comprises:

determining an average of the determined probabilities.

6. The method of claim 1, wherein determining whether the advertisement content is malicious based at least in part on the determined scores associated with each word of the identified one or more words comprises:

generating a combined value based on the determined scores associated with each word of the identified one or more words; and

determining the advertisement content is malicious if the combined value is less than a threshold value.

7. The method of claim 6, wherein the threshold value is determined based at least in part on a number of the identified one or more words in the text.

8. The method of claim 1, wherein determining whether the advertisement content is malicious based at least in part on the determined scores associated with each word of the identified one or more words comprises:

determining a minimum score from the determined scores; and

determining the advertisement content is malicious if the minimum score is less than a threshold value.

9. The method of claim 8, wherein the threshold value is based at least in part on a number of the identified one or more words in the text.

10. The method of claim 1, wherein a type associated with an identified character is a Unicode range including the character.

11. The method of claim 1, wherein a character in the identified one or more characters is selected from a group consisting of:

a letter, a number, a text symbol, and any combination thereof.

12. A method comprising:

retrieving text included in advertisement content of an advertisement (“

ad”

) request for presentation to a user of an online system;

identifying one or more words included in the advertisement content;

identifying a one or more types associated with one or more characters in each of the identified one or more words;

scoring each word from the identified one or more words based at least in part on a probability associated with each of the identified one or more words, the probability associated with a word based at least in part on the one or more types associated with one or more characters in the word;

determining whether the advertisement content includes malicious content based at least in part on the determined scores; and

determining whether the advertisement content is eligible for presentation to the user of the online system based at least in part on the determination of whether the advertisement content includes malicious content.

13. The method of claim 12, wherein scoring each word from the identified one or more words based at least in part on a probability associated with each of the identified one or more words comprises:

determining, for each of the identified one or more words, a most common type associated with characters in the word;

determining a conditional probability of one or more characters included in the word having a specific type based at least in part on a number of characters in the word and a number of characters in the word associated with a most common type associated with characters in the word; and

determining the score associated with the word based at least in part on the determined conditional probability.

14. The method of claim 12, wherein a type associated with a character is a Unicode range including the character.

15. The method of claim 12, wherein scoring each word from the identified one or more words based at least in part on a probability associated with each of the identified one or more words comprises:

determining probabilities of each character in the word being followed by a subsequent character in the one or more characters included in the word; and

determining a score for the word based at least in part on the determined probabilities.

16. The method of claim 12, wherein determining whether the advertisement content includes malicious content based at least in part on the determined scores comprises:

generating a combined value based on the determined scores associated with each word of the identified one or more words; and

determining the advertisement content includes malicious content if the combined value is less than a threshold value

17. The method of claim 16, wherein the threshold value is based at least in part on a number of the identified one or more words in the text.

18. The method of claim 12, wherein determining whether the advertisement content includes malicious content based at least in part on the determined scores comprises:

determining a minimum score from the determined scores; and

determining the advertisement content is malicious if the minimum score is less than a threshold value.

19. A computer program product comprising a computer-readable storage medium having instructions encoded thereon that, when executed by a processor, cause the processor to:

retrieve text included in advertisement content of an advertisement (“

ad”

) request for presentation to a user of an online system;

identify one or more words included in the advertisement content;

identifying a one or more types associated with one or more characters in each of the identified one or more words;

score each word from the identified one or more words based at least in part on a probability associated with each of the identified one or more words, the probability associated with a word based at least in part on the one or more types associated with one or more characters in the word;

determine whether the advertisement content includes malicious content based at least in part on the determined scores; and

determine whether the advertisement content is eligible for presentation to the user of the online system based at least in part on the determination of whether the advertisement content includes malicious content.

20. The computer program product of claim 19, wherein determine whether the advertisement content includes malicious content based at least in part on the determined scores comprises:

generate a combined value based on the determined scores associated with each word of the identified one or more words; and

determine the advertisement content includes malicious content if the combined value is less than a threshold value.