Method and system for protection against information stealing software

• US 9,455,981 B2
• Filed: 09/04/2015
• Issued: 09/27/2016
• Est. Priority Date: 03/19/2008
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Troyansky, Lidror
• Primary Examiner(s): ZHAO, DON GORDON
• Application Number:
  US14/846,538
• Publication Number:
  US 20150381604A1
• Time in Patent Office: 389 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A system and method for identifying infection of unwanted software on an electronic device is disclosed. A software agent configured to generate a bait and is installed on the electronic device. The bait can simulate a situation in which the user performs a login session and submits personal information or it may just contain artificial sensitive information. The output of the electronic device is monitored and analyzed for attempts of transmitting the bait. The output is analyzed by correlating the output with the bait and can be done by comparing information about the bait with the traffic over a computer network in order to decide about the existence and the location of unwanted software.

Claims

1. A system for controlling dissemination of sensitive information from an electronic network to an electronic device on the Internet, the system comprising:

an electronic hardware processor configured to execute computer instructions, wherein the computer instructions implement a traffic analyzer, the traffic analyzer in communication with the electronic network and configured to;

detect an electronic message on the electronic network, the electronic message including a password to be transmitted to the electronic device on the Internet,

determine a strength of the password based on one or more of a length of the password and an entropy score of the password,

determine a sensitivity of information protected by the password based on the strength, wherein the sensitivity is positively correlated with the strength of the password such that a stronger password results in a determination of higher sensitivity and a weaker password results in a determination of lower sensitivity,

determine a category of content at the electronic device by classifying website content at the electronic device,

determine a risk level based at least in part on the category and the sensitivity of the information protected by the password,

determine a required action in response to the risk level, wherein the required action includes one or more of blocking, quarantining, or alerting, and

block the electronic message destined for the electronic device and including the password in response to the required action including blocking.

2. The system of claim 1, wherein the traffic analyzer is further configured to quarantine the electronic message including the password in response to the determined required action including quarantining.

3. The system of claim 1, wherein the traffic analyzer is further configured to generate an alert in response to the required action including alerting.

4. The system of claim 1, wherein, for any particular category of the content, the traffic analyzer is configured to determine the risk level is higher with a higher sensitivity of information than with a lower sensitivity of information.

5. The system of claim 1, wherein the traffic analyzer is further configured to determine the risk level based on analysis of a recipient URL identifying content at the electronic device.

6. The system of claim 1, wherein the traffic analyzer is further configured to determine longer passwords are stronger than shorter passwords.

7. The system of claim 1, wherein the traffic analyzer is further configured to determine passwords less similar to other passwords are stronger than passwords that are more similar to the other passwords.

8. The system of claim 1, wherein the traffic analyzer is further configured to determine higher entropy passwords are stronger than lower entropy passwords.

9. The system of claim 1, wherein the traffic analyzer is further configured to determine a higher level of risk with a stronger password than with a weaker password.

10. The system of claim 1, wherein the traffic analyzer is further configured to determine the required action based, at least in part, on parameters settable by an operator.

11. A computer-implemented method of controlling dissemination of sensitive information from an electronic network to an electronic device on the Internet, the method comprising

analyzing, via an electronic hardware processor, traffic on the electronic network to detect an electronic message including a password to be transmitted to the electronic device on the Internet;

determining, via the electronic hardware processor a strength of the password based on one or more of a length of the password, and an entropy score of the password;

determining, via the electronic hardware processor, a sensitivity of information protected by the password based on the strength of the password, wherein the determined sensitivity is positively correlated with the strength of the password such that a stronger password results in a determination of higher sensitivity and a weaker password results in a determination of lower sensitivity;

determining, via the electronic hardware processor a category of content at the electronic device by classifying website content at the electronic device,

determining, via the electronic hardware processor, a risk level incurred if the password leaves the electronic network and is passed to the electronic device based at least in part on the category and the sensitivity of information protected by the password;

determining, via the electronic hardware processor, a required action based on the determined risk level, wherein the required action includes one or more of blocking, quarantining, or alerting; and

blocking, via the electronic hardware processor, the electronic message destined for the electronic device and including the password in response to the determined required action including blocking.

12. The method of claim 11, further comprising quarantining the electronic message in response to the determined required action including quarantining.

13. The method of claim 11, further comprising generating an alert in response to the required action including alerting.

14. The method of claim 11, wherein, for any particular category of the content, the determined risk level is higher with a higher sensitivity of information than with a lower sensitivity of information.

15. The method of claim 11, wherein the risk level is further determined based on analysis of a recipient URL identifying content at the electronic device.

16. The method of claim 11, further comprising determining longer passwords are stronger than shorter passwords.

17. The method of claim 11, further comprising determining passwords less similar to other passwords are stronger than passwords that are more similar to the other passwords.

18. The method of claim 11, further comprising determining higher entropy passwords are stronger than lower entropy passwords.

19. The method of claim 11, further comprising determining a higher level of risk with a stronger password than with a weaker password.

20. The method of claim 11, wherein the required action is based, at least in part, on parameters settable by an operator.