Proactive browser content analysis
A protection module operates to analyze threats, at the protocol level (e.g., at the HTML level), by intercepting all requests that a browser engine resident in a computing device sends and receives, and the protection agent completes the requests without the help of the browser engine. And then the protection module analyzes and/or modifies the completed data before the browser engine has access to it, to, for example, display it. After performing all of its processing, removing, and/or adding any code as needed, the protection module provides the HTML content to the browser engine, and the browser engine receives responses from the protection agent as if it was speaking to an actual web server, when in fact, browser engine is speaking to an analysis engine of the protection module.
1. A content analysis and malware prevention method comprising:
intercepting, by a protection agent, a request from a web browser;
determining, by the protection agent, whether the request is associated with known malicious content;
when the request is associated with known malicious content, blocking, by the protection agent, the request; and
when the request is not associated with known malicious content:
sending, by the protection agent, the request to one or more web servers;
receiving, at the protection agent on a remote computer, web content from the one or more web servers, wherein web content comprises data for assembling a web page, and wherein the web content is received in response to the request;
identifying, by the protection agent, a malware threat within the web content;
in response to identifying the malware threat, modifying, by the protection agent, the web content, wherein modifying the web content comprises modifying the web content at protocol level to remove the malware threat from the web content;
assembling, by the protection agent, a modified version of the web page, wherein the modified web page is assembled using the modified web content, and wherein the modified version of the web page does not comprise the malware threat; and
providing, by the protection agent, the modified version of the web page to the web browser application on the remote computer for rendering and display.
2. The method of claim 1 , further comprising supplementing, by the protection agent, the web content with indicators regarding a vulnerability of one or more links within the web content.
3. The method of claim 1 , wherein an analysis to identify a malware threat within the web content includes one or more of a URL (Uniform Resource Locator) analysis, an IP (Internet Protocol) analysis, an image analysis, and a script/HTML analysis.
4. The method of claim 1 , further comprising determining, by the protection agent, whether a request for the web content from the web browser application is a first request.
5. The method of claim 1 , further comprising performing one or more of pre-process data decryption, de-chunking and decompressing.
6. The method of claim 1 , wherein a protocol-level analysis is utilized to identify the malware threat within the web content.
7. The method of claim 3 , further comprising performing cloud verification of the web content, wherein cloud verification determines one or more malware vulnerabilities based on an aggregation of the analyses.
8. The method of claim 1 , further comprising allocating memory for caching the web content.
9. A content analysis and malware prevention system comprising:
at least one processor; and
memory encoding computer executable instructions that, when executed by the at least one processor, perform a method comprising:
intercepting a request from a web browser;
determining whether the request is associated with known malicious content;
when the request is associated with known malicious content, blocking, by a protection agent, the request; and
when the request is not associated with known malicious content:
sending the request to one or more web servers;
receiving web content from one or more web servers, wherein web content comprises data for assembling a web page;
identifying a malware threat within the web content;
in response to identifying the malware threat, modifying the web content, wherein modifying the web content comprises modifying the web at protocol level to remove the malware threat from the web content;
assembling a modified version of the web page, wherein the modified web page is assembled using the modified web content, and wherein the modified version of the web page does not comprise the malware threat; and
providing the modified version of the web page to a web browser application on the remote computer for rendering and display.
10. The system of claim 9 , wherein the method further comprises supplementing the web content with indicators regarding a vulnerability of one or more links within the web content.
11. The system of claim 9 , wherein the method further comprises identifying the malware threat within the web content by performing one or more of a URL (Uniform Resource Locator) analysis, an IP (Internet Protocol) analysis, an image analysis, and a script/HTML analysis.
12. The system of claim 9 , wherein the method further comprises determining whether a request for the web content from the web browser application is a first request.
13. The system of claim 9 , wherein the method further comprises performing one or more of pre-process data decryption, de-chunking, and decompressing.
14. The system of claim 9 , wherein the method further comprises identifying the malware threat utilizing a protocol-level analysis.
15. The system of claim 9 , wherein the method further comprises caching the web content in allocated memory.
16. The method of claim 1 , wherein the malware threat comprises a Uniform Resource Locator (URL).
17. The system of claim 9 , wherein the method further comprises determining if a malware threat comprises a Uniform Resource Locator (URL).
18. The method of claim 1 , wherein sending the request to one or more web servers comprises iteratively sending a plurality of requests to the one or more web servers.
19. The method of claim 1 , further comprising processing the web content prior to identifying the malware threat within the web content.
20. The system of claim 9 , wherein sending the request to one or more web servers comprises iteratively sending a plurality of requests to the one or more web servers.