Granted Patent B2

US 8,732,831 · App. 13/182,652 · Granted May 20, 2014

Abstract

Claims (43)

1. A method for determining the legitimacy of a software application provided to a user of a computing device, the method comprising using at least one data processing device:

programmatically detecting that the software application is resident on the computing device;

extracting visual user interface characteristics from at least one of an executable file and data files associated with the software application;

collecting and storing the visual user interface characteristics of the software application in a memory;

programmatically comparing the collected visual user interface characteristics to known visual user interface characteristics of at least one known legitimate software application;

when a similarity between the collected visual user interface characteristics and the known visual user interface characteristics surpasses a predefined similarity threshold, analyzing at least one additional characteristic of the software application, wherein the at least one additional characteristic comprises at least one of a digital signature, a source location and a binary signature; and

terminating the software application and quarantining the files associated with the software application for subsequent deletion from the computing device when the at least one additional characteristic is indicative of rogue software.

2. The method of claim 1 , wherein the computing device comprises one of a personal computer, a tablet computer, a game console, or a mobile communications device.

3. The method of claim 1 , wherein the visual user interface characteristics comprise at least one of window title names, screen control names, screen control components, progress bars, lists, buttons, image files, dialog box names, colors, and system tray settings.

4. The method of claim 1 , wherein the legitimate software application comprises an anti-virus application.

5. The method of claim 4 , wherein the software application is a rogue software application masquerading as an authentic anti-virus application.

6. The method of claim 1 , further comprising determining if the software application has been digitally signed, and, if not, classifying the software application as rogue software and presenting the user with a message indicating as such.

7. The method of claim 1 , further comprising determining if the source of the software application is a source of known legitimate software applications, and if not, classifying the software application as rogue software and presenting the user with a message indicating as such.

8. The method of claim 1 , further comprising determining the binary signature of the software application and determining if the binary signature matches a known binary signature of a known legitimate software application, and if not, classifying the software application as rogue software and presenting the user with a message indicating as such.

9. The method of claim 1 , further comprising presenting the user with a message recommending deletion of the software application.

10. The method of claim 9 , further comprising deleting the software application from the computing device in response to user input.

11. A system for determining the legitimacy of a software application provided to a user of a computing device, the system comprising:

at least one memory component for storing computer-executable instructions; and

at least one processor configured to execute computer-executable instructions stored in the at least one memory, which when executed:

programmatically detect that the software application is resident on the computing device;

extract visual user interface characteristics from at least one of an executable file and data files associated with the software application;

collect and store visual user interface characteristics of the software application;

programmatically compare the collected visual user interface characteristics to the known visual user interface characteristics of at least one known legitimate software application;

when a similarity between the collected visual user interface characteristics and the known visual user interface characteristics surpasses a predefined similarity threshold, analyze at least one additional characteristic of the software application,

wherein the at least one additional characteristic comprises at least one of a digital signature, a source location and a binary signature; and

terminate the software application and quarantine the files associated with the software application for subsequent deletion from the computing device when the at least one additional characteristic is indicative of rogue software.

12. The system of claim 11 , wherein the computing device comprises one of a personal computer, a tablet computer, a game console, or a mobile communications device.

13. The system of claim 11 , wherein the visual user interface characteristics comprise at least one of window title names, screen control names, screen control components, progress bars, lists, buttons, image files, dialog box names, colors, and system tray settings.

14. The system of claim 11 , wherein the at least one known legitimate software application comprises an anti-virus application.

15. The system of claim 11 , wherein the instructions when executed determine if the software application has been digitally signed, and, if not, classify the software application as rogue software and present the user with a message indicating as such.

16. The system of claim 11 , wherein the instructions when executed determine if the source of the software application is a source of known legitimate software applications, and if not, classify the software application as rogue software and present the user with a message indicating as such.

17. The system of claim 11 , wherein the instructions when executed determine the binary signature of the software application and determine if the binary signature matches a known binary signature of a known legitimate software application, and if not, classify the software application as rogue software and present the user with a message indicating as such.

18. The system of claim 11 , wherein the instructions when executed present the user with a message recommending deletion of the software application.

19. The system of claim 18 , wherein the instructions when executed delete the software application from the computing device.

20. A non-transitory program storage medium, comprising instructions encoded thereon that when executed by a computer:

detect that a software application is resident on the computing device;

extract visual user interface characteristics from at least one of an executable file and data files associated with the software application;

collect and store the visual user interface characteristics of the software application in a memory;

compare the collected visual user interface characteristics to known visual user interface characteristics of at least one known legitimate software application;

when a similarity between the collected visual user interface characteristics and the known visual user interface characteristics surpasses a predefined similarity threshold, analyze at least one additional characteristic of the software application, wherein the at least one additional characteristic comprises at least one of a digital signature, a source location and a binary signature; and

terminate the software application and quarantine the files associated with the software application for subsequent deletion from the computing device when the at least one additional characteristic is indicative of rogue software.

21. The method of claim 1 , wherein the extracting is performed while the software application is not executing on the computing device.

22. The system of claim 11 , wherein the at least one processor is configured to extract the visual user interface characteristics while the software application is not executing on the computing device.

Assignments (14)