Malicious advertisement detection and remediation
First Claim
Patent Images
1. A system for detecting a malicious advertisement, comprising:
- a computer processor; and
an anti-malvertising module executing on the computer processor and configured to;
identify a web page comprising the advertisement;
determine that the advertisement is hosted by a third party;
periodically request emulation of the web page by a plurality of virtual machines, each of the plurality of virtual machines comprising an instrumented browser configured to perform a dynamic analysis of the web page by emulating presentation of the web page using different user profile information for different web pages;
determine, based on an instance of emulating presentation of the web page, that the advertisement is associated with malicious content; and
provide as output an indication that the advertisement is malicious.
4 Assignments
0 Petitions
Accused Products
Abstract
Detecting a malicious advertisement is disclosed. An advertisement is analyzed. A determination that the advertisement is associated with malicious activity is made. An indication that the advertisement is malicious is provided as output. The indication can be provided as a report, such as to a publisher and can also be provided using an API, such as to the entity responsible for serving the advertisement.
437 Citations
20 Claims
-
1. A system for detecting a malicious advertisement, comprising:
-
a computer processor; and an anti-malvertising module executing on the computer processor and configured to; identify a web page comprising the advertisement; determine that the advertisement is hosted by a third party; periodically request emulation of the web page by a plurality of virtual machines, each of the plurality of virtual machines comprising an instrumented browser configured to perform a dynamic analysis of the web page by emulating presentation of the web page using different user profile information for different web pages; determine, based on an instance of emulating presentation of the web page, that the advertisement is associated with malicious content; and provide as output an indication that the advertisement is malicious. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12)
-
-
13. A method for detecting a malicious advertisement, comprising:
-
identifying a web page comprising the advertisement; determining that the advertisement is hosted by a third party; periodically requesting emulation of the web page by a plurality of virtual machines, each of the plurality of virtual machines comprising an instrumented browser configured to perform a dynamic analysis of the web page by emulating presentation of the web page using different user profile information for different web pages; determining, by a computer processor and based on an instance of emulating presentation of the web page, that the advertisement is associated with malicious content; and providing, by the computer processor, as output an indication that the advertisement is malicious. - View Dependent Claims (14, 15, 16, 17, 18, 19)
-
-
20. A computer program product for detecting a malicious advertisement, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
-
identifying a web page comprising the advertisement; determining that the advertisement is hosted by a third party; periodically requesting emulation of the web page by a plurality of virtual machines, each of the plurality of virtual machines comprising an instrumented browser configured to perform a dynamic analysis of the web page by emulating presentation of the web page using different user profile information for different web pages; determining, based on an instance of emulating presentation of the web page, that the advertisement is associated with malicious content; and providing as output an indication that the advertisement is malicious.
-
Specification