Online risk mitigation

• US 8,429,743 B2
• Filed: 12/23/2008
• Issued: 04/23/2013
• Est. Priority Date: 12/23/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Loveland, Shawn, Hulten, Geoffrey J, Haber, Elliott Jeb, Scarrow, John L.
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): Rahman, Mahfuzur
• Application Number:
  US12/342,981
• Publication Number:
  US 20100162391A1
• Time in Patent Office: 1,582 Days
• Field of Search: 726/22, 726/24
• US Class Current: 726/22
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 11/1461 Backup scheduling policy

Abstract

Online risk mitigation techniques are described. In an implementation, a service is queried for a reputation associated with an object from an online source in response to selection of the object. A backup of a client that is to receive the object is stored prior to obtaining the object when the reputation does not meet a threshold reputation level.

Claims

1. A computer-implemented method comprising:

querying a service for a reputation associated with an object from an online source, responsive to selection of the object; and

responsive to a determination that the reputation does not meet a threshold reputation level that is determined at least in part using heuristics;

providing an estimated risk level associated with the object;

storing a backup of a client for restoring the client that is to receive the object prior to obtaining the object; and

obtaining the object after the backup of the client is stored.

2. A computer-implemented method as described in claim 1, wherein the object is one or more of:

a program,

an application,

a plug-in, or

web content.

3. A computer-implemented method as described in claim 1, further comprising sending a notification that the reputation does not meet the threshold reputation level.

4. A computer-implemented method as described in claim 1, further comprising isolating an automatic backup of the client, which is scheduled to occur after the object is obtained, when the reputation does not meet the threshold reputation level.

5. A computer-implemented method as described in claim 4, wherein the isolating includes suspending the automatic backup.

6. A computer-implemented method as described in claim 1, wherein the backup of the client is stored external to the client.

7. A computer-implemented method as described in claim 1, further comprising sending a notification, that recommends restoration of the client with the backup of the client when the reputation does not meet the threshold reputation level.

8. A system comprising:

a reputation module configured to query a service for a reputation associated with an object requested in an online session by a client, the reputation based at least in part on heuristics; and

a backup module configured to automatically create a virtual environment such that the object is isolated, within the virtual environment, from a backup of data of the client for restoring the client to a state represented in the backup of the data of the client, the backup of the data of the client is created and stored responsive to a determination that the reputation does not meet a threshold reputation level and prior to receiving the object, the backup module further configured to suspend an automatic backup of the client that is scheduled to occur after the object is obtained.

9. A system as described in claim 8, wherein the object is one or more of:

web content associated with a uniform resource locator,

an application, or

a plug-in.

10. A system as described in claim 8, wherein the backup module is configured to discard the virtual environment upon termination of an online session with a source that contains the object.

11. A system as described in claim 8, wherein the backup module is configured to send a notification that offers to restore the client to the state represented in the backup of the data of the content, responsive to a determination that the client is infected with malware.

12. A system as described in claim 8, wherein the reputation module is configured to cache a response to the query in the client.

13. A system as described in claim 8, wherein the backup module is configured to isolate a copy of the backup of the data of the client remote from the backup of the data of the client that is stored on the client.

14. One or more computer-readable memory devices comprising instructions that are executable to generate a service that is operable to:

query for a reputation associated with web content that is designated by a uniform resource locator (URL) before the web content is accessed, the reputation based at least in part on heuristics; and

if the reputation meets a threshold reputation level for a client, then;

access the web content;

if the reputation does not meet the threshold reputation level for the client, then;

store a backup of data of the client to restore the client to a state before the web content was accessed;

provide an estimated risk level associated with the web content; and

access the web content after the backup of the data of the client is stored and the estimated risk level is provided.

15. One or more computer-readable memory devices as described in claim 14, wherein the service is installed on the client.

16. One or more computer-readable memory devices as described in claim 14, wherein the threshold reputation level is set by the client.

17. One or more computer-readable memory devices as described in claim 14, wherein the backup of the data of the client is stored locally with the service.

18. One or more computer-readable memory devices as described in claim 15, wherein the service is configured to create a virtual environment within the client to browse the web content, in which the virtual environment is discarded when a browser, used to output the web content, is closed.