Method and system for detecting rogue security software that displays frequent misleading warnings

1. A computing system implemented process for detecting rogue security software comprising:

defining a timeframe for monitoring a source process;

determining, using one or more processors associated with one or more computing systems, a threshold pop-up score such that a source process having a pop-up score greater than the threshold pop-up score is considered a suspect source process;

monitoring, using the one or more processors associated with the one or more computing systems, a user computing system to detect any pop-ups generated on the user computing system;

detecting, using the one or more processors associated with the one or more computing systems, a pop-up generated on the user computing system;

identifying, using the one or more processors associated with the one or more computing systems, a source process associated with the detected pop-up;

monitoring, using the one or more processors associated with the one or more computing systems, the identified source process associated with the detected pop-up for at least the defined timeframe to determine a number of pop-up events on the user computing system in the defined timeframe associated with the identified source process, wherein a pop-up event that is minimized and later reopened by a user comprises one independent pop-up event;

determining, using the one or more processors associated with the one or more computing systems, a pop-up score for the identified source process, the pop-up score for the identified source process being based, at least in part, on the determined number of pop-up events on the user computing system in the defined timeframe associated with the identified source process, the popup score further being based on a reputation and prevalence score associated with the identified source process, the reputation and prevalence score being representative of how well-known and wide-spread the identified source process is, wherein an unknown reputation and a low prevalence score causes the pop-up score to increase;

comparing, using the one or more processors associated with the one or more computing systems, the pop-up score for the identified source process with the threshold pop-up score; and

if the pop-up score for the identified source process is greater than the threshold pop-up score, using the one or more processors associated with the one or more computing systems to transform a status of the identified source process to a status of identified suspect source process.

2. The computing system implemented process for detecting rogue security software of claim 1 , wherein the threshold pop-up score is based on the number of pop-up events associated with a source process detected in the defined timeframe.

3. The computing system implemented process for detecting rogue security software of claim 1 , wherein the threshold pop-up score is based on the number of pop-up events associated with a source process detected in the defined timeframe and one or more associated secondary factors.

4. The computing system implemented process for detecting rogue security software of claim 1 , wherein the pop-up score for the identified source process is further determined based, at least in part, on the determined number of pop-up events on the user computing system in the defined timeframe associated with the identified source process and a reputation associated with the identified source process.

5. The computing system implemented process for detecting rogue security software of claim 1 , further comprising:

prior to using one or more processors associated with one or more computing systems to monitor the identified source process associated with the detected pop-up for at least the defined timeframe;

using one or more processors associated with one or more computing systems to determine if the identified source process associated with the detected pop-up is an exempt process; and

if the identified source process associated with the detected pop-up is an exempt process taking no further action.

6. The computing system implemented process for detecting rogue security software of claim 1 , further comprising:

if the pop-up score for the identified source process is greater than the threshold pop-up score, using one or more processors associated with one or more computing systems to transform a status of the identified source process to a status of identified suspect source process and taking one or more protective measures against the identified suspect source process.

7. A system for detecting rogue security software comprising:

a user computing system;

a security system provider computing system; and

one or more processors associated with the user computing system, the one or more processors executing a process for detecting rogue security software comprising:

defining a timeframe;

determining a threshold pop-up score such that a source process having a pop-up score greater than the threshold pop-up score is considered a suspect source process;

monitoring a user computing system to detect any pop-ups generated on the user computing system;

detecting a pop-up generated on the user computing system;

identifying a source process associated with the detected pop-up;

monitoring the identified source process associated with the detected pop-up for at least the defined timeframe to determine a number of pop-up events on the user computing system in the defined timeframe associated with the identified source process;

determining a pop-up score for the identified source process, the pop-up score for the identified source process being based, at least in part, on the determined number of pop-up events on the user computing system in the defined timeframe associated with the identified source process, wherein a pop-up event that is minimized and later reopened by a user comprises one independent pop-up event, the pop-up score further being based on a reputation and prevalence score associated with the identified source process, the reputation and prevalence score being representative of how well-known and wide-spread the identified source process is, wherein an unknown reputation and a low prevalence score causes the pop-up score to increase;

using the one or more processors associated with one or more computing systems to compare the pop-up score for the identified source process with the threshold pop-up score; and

if the pop-up score for the identified source process is greater than the threshold popup score, using the one or more processors associated with one or more computing systems to transform a status of the identified source process to a status of identified suspect source process.

8. The system for detecting rogue security software of claim 7 , wherein the threshold pop-up score is based on the number of pop-up events associated with a source process detected in the defined timeframe.

9. The system for detecting rogue security software of claim 7 , wherein the threshold pop-up score is based on the number of pop-up events associated with a source process detected in the defined timeframe and one or more associated secondary factors.

10. The system for detecting rogue security software of claim 7 , wherein the pop-up score for the identified source process is further determined based, at least in part, on the determined number of pop-up events on the user computing system in the defined timeframe associated with the identified source process and a reputation associated with the identified source process.

11. The system for detecting rogue security software of claim 7 , wherein the process for detecting rogue security software further comprises:

prior to using the one or more processors associated with one or more computing systems to monitor the identified source process associated with the detected pop-up for at least the defined timeframe;

using the one or more processors associated with one or more computing systems to determine if the identified source process associated with the detected pop-up is an exempt process; and

if the identified source process associated with the detected pop-up is an exempt process taking no further action.

12. The system for detecting rogue security software of claim 7 , wherein the process for detecting rogue security software further comprises:

if the pop-up score for the identified source process is greater than the threshold popup score, using one or more processors associated with one or more computing systems to transform a status of the identified source process to a status of identified suspect source process and taking one or more protective measures against the identified suspect source process.

13. A method for detecting rogue security software comprising:

defining a timeframe for monitoring a source process;

determining a threshold pop-up score such that a source process having a pop-up score greater than the threshold pop-up score is considered a suspect source process;

monitoring a user computing system to detect any pop-ups generated on the user computing system;

detecting a pop-up generated on the user computing system;

identifying a source process associated with the detected pop-up;

monitoring the identified source process associated with the detected pop-up for at least the defined timeframe to determine a number of pop-up events on the user computing system in the defined timeframe associated with the identified source process;

determining a pop-up score for the identified source process, the pop-up score for the identified source process being based, at least in part, on the determined number of pop-up events on the user computing system in the defined timeframe associated with the identified source process, wherein a pop-up event that is minimized and later reopened by a user comprises one independent pop-up event, the pop-up score further being based on a reputation and prevalence score associated with the identified source process, the reputation and prevalence score being representative of how well-known and wide-spread the identified source process is, wherein an unknown reputation and a low prevalence score causes the pop-up score to increase;

comparing the pop-up score for the identified source process with the threshold pop-up score; and

if the pop-up score for the identified source process is greater than the threshold pop-up score, transforming a status of the identified source process to a status of identified suspect source process.

14. The method for detecting rogue security software of claim 13 , wherein the threshold pop-up score is based on the number of pop-up events associated with a source process detected in the defined timeframe and one or more associated secondary factors.

15. The method for detecting rogue security software of claim 13 , wherein the pop-up score for the identified source process is further determined based, at least in part, on the determined number of pop-up events on the user computing system in the defined timeframe associated with the identified source process and a reputation associated with the identified source process.

16. The method for detecting rogue security software of claim 13 , wherein, prior to monitoring the identified source process associated with the detected pop-up for at least the defined timeframe, determining if the identified source process associated with the detected pop-up is an exempt process, and, if the identified source process associated with the detected pop-up is an exempt process, taking no further action.

17. The method for detecting rogue security software of claim 13 , further comprising:

if the pop-up score for the identified source process is greater than the threshold pop-up score, transforming a status of the identified source process to a status of identified suspect source process and taking one or more protective measures against the identified suspect source process.