Preventing fraudulent misdirection of affiliate program cookie tracking
View Patent ↗A cookie monitoring manager detects fraudulent updates to cookies on a computer. The cookie monitoring manager monitors cookies, and detects attempted write operations thereto. The cookie monitoring manager determines whether each detected attempted write operation is an attempt to write a fraudulent affiliate identifier to a cookie. The cookie monitoring manager detects fraudulent write attempts, for example, by detecting an attempt to write a known fraudulent affiliate identifier to a cookie, by detecting an attempt to write to a cookie by a process other than a browser or by detecting multiple attempts to write affiliate identifiers to a cookie within a sufficiently short period of time. When the cookie tracking manager detects an attempt to write a fraudulent affiliate identifier to a cookie, it can block the write attempt and/or run an adware removal program on the computer.
1. A computer implemented method for detecting fraudulent updates to cookies stored on a computer, the method comprising:
using a computer processor configured to execute method steps, the steps comprising:
monitoring cookies stored on the computer, the cookies stored by a browser executing on the computer;
detecting at least one attempted write operation to a cookie;
determining that at least one detected attempted write operation comprises an attempt to write a fraudulent affiliate identifier to the cookie; and
performing at least one corrective action responsive to detecting the attempt to write the fraudulent affiliate identifier to the cookie.
2. The method of claim 1 wherein the step of determining that a detected write operation comprises an attempt to write a fraudulent affiliate identifier to the cookie further comprises:
detecting an attempt to write a known fraudulent affiliate identifier to the cookie.
3. The method of claim 1 wherein the step of determining that a detected write operation comprises an attempt to write a fraudulent affiliate identifier to the cookie further comprises:
detecting an attempt to write to a cookie by a process other than the browser.
4. The method of claim 1 wherein the step of determining that a detected write operation comprises an attempt to write a fraudulent affiliate identifier to the cookie further comprises:
detecting multiple attempts to write affiliate identifiers to the cookie within a specified period of time.
5. The method of claim 1 wherein the step of monitoring cookies further comprises:
intercepting calls to system write operations; and
examining intercepted write operations to monitor for attempts to write to known cookies.
6. The method of claim 1 wherein the step of monitoring cookies further comprises:
utilizing a file system filter driver to monitor for attempts to write to known cookies.
7. The method of claim 1 wherein performing at least one corrective action responsive to detecting the attempt to write the fraudulent affiliate identifier to the cookie comprises performing at least one step from a group of steps consisting of:
blocking the attempt to write the fraudulent affiliate identifier to the cookie; and
deleting the fraudulent affiliate identifier from the cookie.
8. The method of claim 1 further comprising:
maintaining a list of known fraudulent affiliate identifiers, wherein an attempted write operation is determined to be an attempt to write the fraudulent affiliate identifier to the cookie responsive to an affiliate identifier used in the attempted write operation being in the list of known fraudulent affiliate identifiers.
9. The method of claim 8 wherein:
the list further comprises associations between known fraudulent affiliate identifiers and signatures identifying associated adware programs.
10. The method of claim 9 further comprising:
responsive to detecting an attempt to write a known fraudulent affiliate identifier to a cookie,
running an adware removal program to remove at least adware with the associated identifying signature from the computer.
11. The method of claim 9 further comprising:
scanning cookies stored on the computer for known fraudulent affiliate identifiers; and
responsive to detecting a known fraudulent affiliate identifier in at least one cookie, running an adware removal program to remove at least adware with the associated identifying signature from the computer.
12. A computer readable medium containing executable program code for detecting fraudulent updates to cookies stored on a computer, the computer readable medium containing program code for:
monitoring cookies stored on the computer, the cookies stored by a browser executing on the computer;
detecting at least one attempted write operation to a cookie;
determining that at least one detected attempted write operation comprises an attempt to write a fraudulent affiliate identifier to the cookie; and
performing at least one corrective action responsive to detecting the attempt to write the fraudulent affiliate identifier to the cookie.
13. The computer readable medium of claim 12 wherein the program code for determining that a detected write operation comprises an attempt to write a fraudulent affiliate identifier to the cookie further comprises:
program code for detecting an attempt to write a known fraudulent affiliate identifier to the cookie.
14. The computer readable medium of claim 12 wherein the program code for determining that a detected write operation comprises an attempt to write a fraudulent affiliate identifier to the cookie further comprises:
program code for detecting an attempt to write to a cookie by a process other than the browser.
15. The computer readable medium of claim 12 wherein the program code for determining that a detected write operation comprises an attempt to write a fraudulent affiliate identifier to the cookie further comprises:
program code for detecting multiple attempts to write affiliate identifiers to the cookie within a specified period of time.
16. The computer readable medium of claim 12 wherein the program code for further performing at least one corrective action responsive to detecting the attempt to write the fraudulent affiliate identifier to the cookie comprises program code for performing at least one step from a group of steps consisting of:
blocking the attempt to write the fraudulent affiliate identifier to the cookie; and
deleting the fraudulent affiliate identifier from the cookie.
17. A computer system for detecting fraudulent updates to cookies stored on a computer, the computer system comprising:
a computer readable medium storing executable software portions, comprising:
a software portion configured to monitor cookies stored on the computer by a browser executing on the computer;
a software portion configured to detect at least one attempted write operation to a cookie;
a software portion configured to determine that at least one detected attempted write operation comprises an attempt to write a fraudulent affiliate identifier to the cookie; and
a software portion configured to perform at least one corrective action responsive to detecting the attempt to write the fraudulent affiliate identifier to the cookie.
18. The computer system of claim 17 wherein the software portion configured to determine that a detected write operation comprises an attempt to write a fraudulent affiliate identifier to the cookie is further configured to:
detect an attempt to write a known fraudulent affiliate identifier to the cookie.
19. The computer system of claim 17 wherein the software portion configured to determine that a detected write operation comprises an attempt to write a fraudulent affiliate identifier to the cookie is further configured to:
detect an attempt to write to a cookie by a process other than the browser.
20. The computer system of claim 17 wherein the software portion configured to determine that a detected write operation comprises an attempt to write a fraudulent affiliate identifier to the cookie is further configured to:
detect multiple attempts to write affiliate identifiers to the cookie within a specified period of time.
21. The computer system of claim 17 wherein the software portion configured to further perform at least one corrective action responsive to detecting the attempt to write the fraudulent affiliate identifier to the cookie further comprises a software portion configured to perform at least one step from a group of steps consisting of:
blocking the attempt to write the fraudulent affiliate identifier to the cookie; and
deleting the fraudulent affiliate identifier from the cookie.
22. A computer system for detecting fraudulent updates to cookies stored on a computer, the computer system comprising:
a cookie monitoring manager executable by a computer processor for:
monitoring cookies stored on the computer by a browser executing on the computer;
detecting at least one attempted write operation to a cookie;
determining that at least one detected attempted write operation comprises an attempt to write a fraudulent affiliate identifier to the cookie; and
performing at least one corrective action responsive to detecting the attempt to write the fraudulent affiliate identifier to the cookie; and
a computer processor for executing the cookie monitoring manager.
23. The computer system of claim 22 wherein the cookie monitoring manager is further configured for:
detecting an attempt to write a known fraudulent affiliate identifier to the cookie.
24. The computer system of claim 22 wherein the cookie monitoring manager is further configured for:
detecting an attempt to write to a cookie by a process other than the browser.
25. The computer system of claim 22 wherein the cookie monitoring manager is further configured for:
detecting multiple attempts to write affiliate identifiers to the cookie within a specified period of time.
26. The computer system of claim 22 wherein the cookie monitoring manager is further configured for performing at least one step from a group of steps consisting of:
blocking the attempt to write the fraudulent affiliate identifier to the cookie; and
deleting the fraudulent affiliate identifier from the cookie.