Advanced responses to online fraud

• US 7,913,302 B2
• Filed: 11/23/2004
• Issued: 03/22/2011
• Est. Priority Date: 05/02/2004
• Status: Active Grant

• Current Assignee: Opsec Online Limited
• Original Assignee: MarkMonitor Inc.
• Inventors: Shull, Mark, Shraim, Ihab
• Primary Examiner(s): Cervetti; David Garcia
• Application Number:
  US10/996,993
• Publication Number:
  US 20070192853A1
• Time in Patent Office: 2,310 Days
• Field of Search: 713/170, 726/13, 726/22, 726/23, 726/25
• US Class Current: 726/22
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Various embodiments of the invention provide solutions (including inter alia, systems, methods and software) for dealing with online fraud. In particular, various embodiments of the invention provide advanced responses to an identified instance of online fraud. Such advanced responses can incorporate one or more of a variety of strategies for defeating an attempt by a server to filter and/or otherwise avoid responses to its fraudulent activity. Merely by way of example, in accordance with some embodiments, one or more HTTP responses to a server'"'"'s request (such as an online form, etc.) may be submitted and/or transmitted for reception by the server. In some cases, each of the submitted responses may appear to comprise valid information responsive to the server'"'"'s request. In other cases, one or more countermeasures may be implemented to defeat an attempt by a phisher (or any other operator of an illegitimate server) to filter responses.

Claims

1. A method of responding to a web site, the method comprising:

receiving at a web server an electronic message comprising a uniform resource locator (“

URL”

) referencing a web site;

accessing the web site by the web server referenced by the URL;

downloading by the web server an online form provided by the web site, the online form comprising a plurality of fields configured to allow a user to provide information to the web site;

identifying by the web server a test on the web site, the test being designed to identify a user by reference to an electronic message transmitted by an operator of the web site and comprising a URL referencing the web site;

creating by the web server a set of safe data comprising a plurality of data elements, each of the data elements corresponding to one of the online form'"'"'s plurality of fields; and

ensuring by the web server that the set of safe data does not violate the test on the web site by identifying a user to whom the operator of the web site believes an electronic message was transmitted.

2. A method of responding to a web site as recited in claim 1, the method further comprising:

transmitting from the web server the set of safe data for reception by the web site, wherein the set of safe data comprises a response to the online form.

3. A method of responding to a web site as recited in claim 2, wherein ensuring that the set of safe data does not violate the test on the web site comprises transmitting the safe data using the identity of a user to whom the operator of the web site believes an electronic message was transmitted.

4. A method of responding to a web site as recited in claim 1, wherein creating a set of safe data comprises creating a plurality of sets of safe data, and wherein ensuring that the set of safe data does not violate the test on the web site comprises ensuring that each of the sets of safe data does not violate the test on the web site.

5. A method of responding to a web site as recited in claim 4, the method further comprising:

transmitting from the web server the plurality of sets of safe data for reception by the web site, wherein each of plurality of the sets of safe data comprises a response to the online form.

6. A method of responding to a web site as recited in claim 1, wherein:

receiving an electronic message comprises receiving a plurality of electronic messages;

each of the plurality of electronic messages comprises a hyperlink referencing the web site;

the method further comprises identifying a similarity among the plurality of received electronic messages; and

ensuring that the set of safe data does not violate the test on the web site comprises ensuring that the set of safe data is consistent with the identified similarity among the plurality of electronic messages.

7. A method of responding to a web site as recited in claim 6, wherein the plurality of electronic messages were transmitted for reception by recipients at a particular domain, and wherein identifying the similarity among the plurality of messages comprises identifying the particular domain.

8. A method of responding to a web site as recited in claim 6, wherein each of the plurality of electronic messages comprises a response code generated by an algorithm, wherein identifying the similarity among the plurality of electronic messages comprises identifying the algorithm responsible for generating the response code in each of the plurality of messages, and wherein ensuring that the data set conforms with the test on the web site comprises ensuring that the data set comprises a data element corresponding to a response code generated from the algorithm.

9. A method of analyzing an online form, the method comprising:

accessing a web site by a web server;

downloading by the web server an online form from the web site, the online form comprising a plurality of fields corresponding to information requested by the web site;

identifying by the web server an embedded test associated with the online form, the embedded test comprising executable code, wherein the embedded test is used by an operator of the web site to determine the validity of responses to the online form;

analyzing by the web server the executable code to identify a response that conforms with the embedded test; and

creating by the web server a set of safe data comprising a plurality of data elements, each of the data elements comprising information corresponding to one of the plurality of the online form'"'"'s fields, wherein at least one of the data elements comprises a response that conforms with the embedded test.

10. A method of analyzing an online form as recited in claim 9, wherein the embedded test is incorporated within the online form.

11. A method of analyzing an online form as recited in claim 9, wherein the embedded test is incorporated within an electronic message directing users to the web site.

12. A method of analyzing an online form as recited in claim 9, wherein the embedded test resides on the web site.

13. A method of analyzing an online form as recited in claim 9, wherein the executable code is selected from the group consisting of a Java applet, a JavaScript, and a computer gateway interface (“

CGI”

) application.

14. A method of analyzing an online form as recited in claim 9, wherein the embedded test implements a device selected from the group consisting of a cookie, a timer, a counter, and a hash function.

15. A computer system for responding to a web site, the computer system comprising a processor and a computer readable memory with instructions executable by the processor to:

receive an electronic message comprising a uniform resource locator (“

URL”

) referencing a web site;

access the web site referenced by the URL;

download an online form provided by the web site, the online form comprising a plurality of fields configured to allow a user to provide information to the web site;

identify a test on the web site, the test being designed to identify a user by reference to an electronic message transmitted by an operator of the web site and comprising a URL referencing the web site;

create a set of safe data comprising a plurality of data elements, each of the data elements corresponding to one of the online form'"'"'s plurality of fields; and

ensure that the set of safe data does not violate the test on the web site by identifying a user to whom the operator of the web site believes an electronic message was transmitted.

16. The computer system of claim 15, wherein the instructions further comprise instructions executable by the processor to:

transmit the set of safe data for reception by the web site, wherein the set of safe data comprises a response to the online form.

17. The computer system of claim 16, wherein ensuring that the set of safe data does not violate the test on the web site comprises transmitting the safe data using the identity of a user to whom the operator of the web site believes an electronic message was transmitted.

18. The computer system of claim 15, wherein:

receiving an electronic message comprises receiving a plurality of electronic messages;

each of the plurality of electronic messages comprises a hyperlink referencing the web site;

the method further comprises identifying a similarity among the plurality of received electronic messages; and

the instructions executable to ensure that the set of safe data does not violate the test on the web site comprise instructions executable to ensure that the set of safe data is consistent with the identified similarity among the plurality of electronic messages.

19. The computer system of claim 18, wherein the plurality of electronic messages were transmitted for reception by recipients at a particular domain, and wherein identifying the similarity among the plurality of messages comprises identifying the particular domain.

20. The computer system of claim 18, wherein each of the plurality of electronic messages comprises a response code generated by an algorithm, wherein identifying the similarity among the plurality of electronic messages comprises identifying the algorithm responsible for generating the response code in each of the plurality of messages, and wherein ensuring that the data set conforms with the test on the web site comprises ensuring that the data set comprises a data element corresponding to a response code generated from the algorithm.

21. A computer system for analyzing an online form, the computer system comprising a processor and a computer readable memory with instructions executable by the processor to:

access a web site;

download an online form from the web site, the online form comprising a plurality of fields corresponding to information requested by the web site;

identify an embedded test associated with the online form, the embedded test comprising executable code, wherein the embedded test is used by an operator of the web site to determine the validity of responses to the online form;

analyze the executable code to identify a response that conforms with the embedded test; and

create a set of safe data comprising a plurality of data elements, each of the data elements comprising information corresponding to one of the plurality of the online form'"'"'s fields, wherein at least one of the data elements comprises a response that conforms with the embedded test.

22. The computer system of claim 21, wherein the embedded test is incorporated within the online form.

23. The computer system of claim 21, wherein the embedded test is incorporated within an electronic message directing users to the web site.

24. The computer system of claim 21, wherein the embedded test resides on the web site.

25. The computer system of claim 21, wherein the executable code is selected from the group consisting of a Java applet, a JavaScript, and a computer gateway interface (“

CGI”

) application.

26. The computer system of claim 21, wherein the embedded test implements a device selected from the group consisting of a cookie, a timer, a counter, and a hash function.

27. A software program embodied on a computer readable memory, the software program comprising instructions executable by one or more computers to:

receive an electronic message comprising a uniform resource locator (“

URL”

) referencing a web site;

access the web site referenced by the URL;

download an online form provided by the web site, the online form comprising a plurality of fields configured to allow a user to provide information to the web site;

identify a test on the web site, the test being designed to identify a user by reference to an electronic message transmitted by an operator of the web site and comprising a URL referencing the web site;

create a set of safe data comprising a plurality of data elements, each of the data elements corresponding to one of the online form'"'"'s plurality of fields; and

ensure that the set of safe data does not violate the test on the web site by identifying a user to whom the operator of the web site believes an electronic message was transmitted.

28. A software program embodied on a computer readable memory, as recited by claim 27, wherein creating a set of safe data comprises creating a plurality of sets of safe data, and wherein ensuring that the set of safe data does not violate the test on the web site comprises ensuring that each of the sets of safe data does not violate the test on the web site.

29. A software program embodied on a computer readable memory, as recited by claim 28, wherein the instructions further comprise instructions executable by the processor to:

transmit the plurality of sets of safe data for reception by the web site, wherein each of plurality of the sets of safe data comprises a response to the online form.

30. A software program embodied on a computer readable memory, as recited by claim 27, wherein the instructions further comprise instructions executable by the one or more computers to:

transmit the set of safe data for reception by the web site, wherein the set of safe data comprises a response to the online form.

31. A software program embodied on a computer readable memory, as recited by claim 30, wherein ensuring that the set of safe data does not violate the test on the web site comprises transmitting the safe data using the identity of a user to whom the operator of the web site believes an electronic message was transmitted.

32. A software program embodied on a computer readable memory, as recited by claim 27, wherein creating a set of safe data comprises creating a plurality of sets of safe data, and wherein ensuring that the set of safe data does not violate the test on the web site comprises ensuring that each of the sets of safe data does not violate the test on the web site.

33. A software program embodied on a computer readable memory, as recited by claim 32, wherein the instruction further comprise instructions executable by the one or more computers to:

transmit the plurality of sets of safe data for reception by the web site, wherein each of plurality of the sets of safe data comprises a response to the online form.

34. A software program embodied on a computer readable memory, as recited by claim 27, wherein:

receiving an electronic message comprises receiving a plurality of electronic messages;

each of the plurality of electronic messages comprises a hyperlink referencing the web site;

the method further comprises identifying a similarity among the plurality of received electronic messages; and

the instructions executable to ensure that the set of safe data does not violate the test on the web site comprise instructions executable to ensure that the set of safe data is consistent with the identified similarity among the plurality of electronic messages.

35. A software program embodied on a computer readable memory, as recited by claim 34, wherein the plurality of electronic messages were transmitted for reception by recipients at a particular domain, and wherein identifying the similarity among the plurality of messages comprises identifying the particular domain.

36. A software program embodied on a computer readable memory, as recited by claim 34, wherein each of the plurality of electronic messages comprises a response code generated by an algorithm, wherein identifying the similarity among the plurality of electronic messages comprises identifying the algorithm responsible for generating the response code in each of the plurality of messages, and wherein ensuring that the data set conforms with the test on the web site comprises ensuring that the data set comprises a data element corresponding to a response code generated from the algorithm.

37. A software program embodied on a computer readable memory, the software program comprising instructions executable by one or more computers to:

access a web site;

download an online form from the web site, the online form comprising a plurality of fields corresponding to information requested by the web site;

identify an embedded test associated with the online form, the embedded test comprising executable code, wherein the embedded test is used by an operator of the web site to determine the validity of responses to the online form;

analyze the executable code to identify a response that conforms with the embedded test; and

create a set of safe data comprising a plurality of data elements, each of the data elements comprising information corresponding to one of the plurality of the online form'"'"'s fields, wherein at least one of the data elements comprises a response that conforms with the embedded test.

38. A software program embodied on a computer readable memory, as recited by claim 37, wherein the embedded test is incorporated within the online form.

39. A software program embodied on a computer readable memory, as recited by claim 37, wherein the embedded test is incorporated within an electronic message directing users to the web site.

40. A software program embodied on a computer readable memory, as recited by claim 37, wherein the embedded test resides on the web site.

41. A software program embodied on a computer readable memory, as recited by claim 37, wherein the executable code is selected from the group consisting of a Java applet, a JavaScript, and a computer gateway interface (“

CGI”

) application.

42. A software program embodied on a computer readable memory, as recited by claim 37, wherein the embedded test implements a device selected from the group consisting of a cookie, a timer, a counter, and a hash function.

43. A system, comprising:

means for receiving an electronic message comprising a uniform resource locator (“

URL”

) referencing a web site;

means for accessing the web site referenced by the URL;

means for downloading an online form provided by the web site, the online form comprising a plurality of fields configured to allow a user to provide information to the web site;

means for identifying a test on the web site, the test being designed to identify a user by reference to an electronic message transmitted by an operator of the web site and comprising a URL referencing the web site;

means for creating a set of safe data comprising a plurality of data elements, each of the data elements corresponding to one of the online form'"'"'s plurality of fields; and

means for ensuring that the set of safe data does not violate the test on the web site by identifying a user to whom the operator of the web site believes an electronic message was transmitted.

44. A system, comprising:

means for accessing a web site;

means for downloading an online form from the web site, the online form comprising a plurality of fields corresponding to information requested by the web site;

means for identifying an embedded test associated with the online form, the embedded test comprising executable code, wherein the embedded test is used by an operator of the web site to determine the validity of responses to the online form;

means for analyzing the executable code to identify a response that conforms with the embedded test; and

means for creating a set of safe data comprising a plurality of data elements, each of the data elements comprising information corresponding to one of the plurality of the online form'"'"'s fields, wherein at least one of the data elements comprises a response that conforms with the embedded test.