Using disposable data misuse to determine reputation

• US 8,413,251 B1
• Filed: 09/30/2008
• Issued: 04/02/2013
• Est. Priority Date: 09/30/2008
• Status: Active Grant

• Current Assignee: NortonLifeLock Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Cooley, Shaun P., Gibney, Josephine
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): Vaughan, Michael R
• Application Number:
  US12/242,634
• Time in Patent Office: 1,645 Days
• Field of Search: None
• US Class Current: 726/26
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06Q 20/123 Shopping for digital content
• CPC Class Codes: G06Q 20/34 using cards, e.g. integrated circuit [IC] cards or magnetic cards
• CPC Class Codes: G06Q 20/385 using an alias or single-use codes
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing
• CPC Class Codes: G06Q 30/0185 Product, service or business identity fraud

Abstract

A reputation system generates reputation scores for websites based at least in part on analyses of disposable data misuse associated with the websites. The reputation system receives reports describing disposable data misuses detected by clients and/or other entities, such as credit card issuers. The reputation system also detects certain types of misuse itself by analyzing received disposable data involved in a misuse detection to determine the websites or other entities that misused the data. The reputation system generates misuse statistics describing the amount of data misuse performed by websites. The reputation system generates reputation scores for websites based on the disposable data misuse statistics and, optionally, other reputation information for the websites, such as malware distribution associated with the websites. The reputation system reports the reputations of the websites to the clients.

Claims

1. A method of determining a reputation for a website, comprising:

using a computer to perform steps comprising;

detecting an attempted submission of non-disposable data to the website by a consumer;

determining whether the non-disposable data corresponds to disposable data previously provided to the website for the consumer;

responsive to the non-disposable data corresponding to the disposable data previously provided to the website for the consumer, substituting the disposable data for the non-disposable data in a submission to the website;

detecting misuse of the disposable data submitted to the website;

generating disposable data misuse statistics for the website responsive to the disposable data misuse detection; and

generating and storing a reputation score for the website based at least in part on the disposable data misuse statistics.

2. The method of claim 1, wherein the disposable data comprise non-personally identifiable information substituted for personally identifiable information during an interaction with the website.

3. The method of claim 1, wherein the disposable data provided to the website comprise one or more types of disposable data from the group consisting of:

a disposable credit card;

a disposable email address;

a phone number;

a physical address;

a bank routing number;

a bank account number; and

an electronic check number.

4. The method of claim 1, wherein detecting misuse of disposable data provided to the website comprises:

receiving a report from an entity via a network, the report indicating that a misuse of disposable data was detected by the entity.

5. The method of claim 1, wherein generating the disposable data misuse statistics comprises:

determining a proportion of disposable data misuse by the website relative to all disposable data provided to the website.

6. The method of claim 1, wherein the reputation score indicates a propensity of the website to misuse disposable data provided to it.

7. The method of claim 1, further comprising reporting the reputation score of the website to a client via a network.

8. A system for determining a reputation for a website, comprising:

a computer processor for executing computer program modules; and

a non-transitory computer-readable storage medium storing executable computer program modules comprising;

a monitoring module configured to;

detect an attempted submission of non-disposable data to the website by a consumer;

determine whether the non-disposable data corresponds to disposable data previously provided to the website for the consumer; and

responsive to the non-disposable data corresponding to the disposable data previously provided to the website for the consumer, substitute the disposable data for the non-disposable data in a submission to the website;

a misuse detection module configured to detect misuse of the disposable data submitted to the website;

a data analysis module configured to generate disposable data misuse statistics for the website responsive to the disposable data misuse detection; and

a reputation generation module configured to generate and store a reputation score for the website based at least in part on the disposable data misuse statistics.

9. The system of claim 8, wherein the disposable data comprise non-personally identifiable information substituted for personally identifiable information during an interaction with the website.

10. The system of claim 8, wherein the disposable data provided to the website comprise one or more types of disposable data from the group consisting of:

a disposable credit card;

a disposable email address;

a phone number;

a physical address;

a bank routing number;

a bank account number; and

an electronic check number.

11. The system of claim 8, wherein the misuse detection module is further configured to:

receive a report from an entity via a network, the report indicating that a misuse of disposable data was detected by the entity.

12. The system of claim 8, wherein the data analysis module is further configured to:

determine a proportion of disposable data misuse by the website relative to all disposable data provided to the website.

13. The system of claim 8, wherein the reputation score indicates a propensity of the website to misuse disposable data provided to it.

14. The system of claim 8, further comprising a reporting module configured to report the reputation score of the website to a client via a network.

15. A non-transitory computer-readable storage medium storing executable program modules for reporting a reputation of a website, the modules comprising:

a monitoring module configured to monitor interactions between a client and the website to detect an attempted submission of non-disposable data from the client to the website by a consumer, to determine whether the non-disposable data corresponds to disposable data previously provided to the website for the consumer and, responsive to the non-disposable data corresponding to the disposable data previously provided to the website for the consumer, to submit the correlated disposable data in place of the non-disposable data;

a detection module configured to detect misuse of the disposable data submitted to the website; and

a reporting module configured to provide a report describing the reputation of the website, the reputation based at least in part on the detected misuse of the disposable data.

16. The computer-readable storage medium of claim 15, wherein the disposable data comprise one or more types of data from the group consisting of:

a disposable credit card;

a disposable email address;

a phone number;

a physical address;

a bank routing number;

a bank account number; and

an electronic check number.

17. The computer-readable storage medium of claim 15, further comprising:

an item generation module configured to generate the disposable data responsive at least in part to the detected attempted submission of non-disposable data to the website, the non-disposable data comprising personally identifiable information and the disposable data comprising non-personally identifiable information associated with the website.

18. The computer-readable storage medium of claim 15, wherein the detection module is further configured to detect misuse of the disposable data submitted to the website by observing consumer interactions with the client.

19. The computer-readable storage medium of claim 15, wherein the detection module is further configured to generate a report describing the detected disposable data misuse and provide the report to a reputation server, wherein the reputation server uses the report describing the detected disposable data misuse to determine the reputation of the website.

20. The computer-readable storage medium of claim 15, wherein the reporting module is further configured to:

receive the report describing the reputation of the website from a reputation server via a network; and

provide the received report to a consumer using the client.