Granted Patent B1

US 10,986,118 · App. 16/184,085 · Granted Apr 20, 2021

Inventors: Anand Darak (Pune, IN); Anuradha Joshi (Pune, IN)

Assignee: NortonLifeLock Inc.

H04L63/1441H04L63/10H04L63/20

Abstract

Claims (65)

1. A computer-implemented method for preventing system level browser attacks through mobile applications, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

intercepting, by the computing device prior to launching of a browser application, a message transmitted by a mobile application executing on the computing device, wherein the message is a system level browse intent that indicates that the mobile application is launching the browser application and is transmitted based on data received by the mobile application;

obtaining a universal resource locator (URL) from the message;

obtaining reputation data using the URL;

determining that the URL is for a malicious website based on the reputation data; and

in response to determining that the URL is for the malicious website, performing a security action to protect the computing device from system level browser attacks.

2. The computer-implemented method of claim 1 , wherein the security action comprises:

presenting, to a user of the computing device, a recommendation to block the URL.

3. The computer-implemented method of claim 2 , further comprising:

receiving, in response to presenting the recommendation, an indication to block URL; and

in response to receiving the indication, blocking the URL.

4. The computer-implemented method of claim 2 , further comprising:

receiving, in response to presenting the recommendation, an indication to add the URL to a bypass list, wherein the bypass list comprise URLs that bypass future security analysis;

generating an association for the URL with an application specified in the indication, wherein the application is specified to launch the URL; and

in response to receiving the indication, adding the URL and the association to the bypass list.

5. The computer-implemented method of claim 2 , further comprising:

receiving, in response to presenting the recommendation, a request for additional information associated with the URL; and

presenting, to the user, a warning displaying the reputation data associated with the URL.

6. The computer-implemented method of claim 1 , wherein the security action comprises:

identifying a user setting that indicates URLs associated with malicious websites are to be blocked; and

enforcing the user setting by blocking the URL in response to detecting that the URL is associated with the malicious website.

7. The computer-implemented method of claim 1 , further comprising:

receiving additional reputation data for the URL from a user of the computing device; and

transmitting the additional reputation data to a remote server to be added to the reputation data associated with the URL.

8. A system for preventing system level browser attacks through mobile applications, the system comprising:

at least one physical processor;

physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:

intercept, prior to launching of a browser application, a message transmitted by a mobile application executing on the computing device, wherein the message is a system level browse intent that indicates that the mobile application is launching the browser application and is transmitted based on data received by the mobile application;

obtain a universal resource locator (URL) from the message;

obtain reputation data using the URL;

determine that the URL is for a malicious website based on the reputation data; and

in response to determining that the URL is for the malicious website, perform a security action to protect a computing device from system level browser attacks.

9. The system of claim 8 , wherein the security action comprises:

presenting, to a user of the computing device, a recommendation to block the URL.

10. The system of claim 9 , wherein the computer-executable instructions further cause the computing device to:

receive, in response to presenting the recommendation, an indication to block URL; and

in response to receiving the indication, block the URL.

11. The system of claim 9 , wherein the computer-executable instructions further cause the computing device to:

receive, in response to presenting the recommendation, an indication to add the URL to a bypass list, wherein the bypass list comprise URLs that bypass future security analysis;

generate an association for the URL with an application specified in the indication, wherein the application is specified to launch the URL; and

in response to receiving the indication, add the URL and the association to the bypass list.

12. The system of claim 9 , wherein the computer-executable instructions further cause the computing device to:

receive, in response to presenting the recommendation, a request for additional information associated with the URL; and

present, to the user, a warning displaying the reputation data associated with the URL.

13. The system of claim 8 , wherein the security action comprises:

identifying a user setting that indicates URLs associated with malicious websites are to be blocked; and

enforcing the user setting by blocking the URL in response to detecting that the URL is associated with the malicious website.

14. The system of claim 8 , wherein the computer-executable instructions further cause the computing device to:

receive additional reputation data for the URL from a user of the computing device; and

transmit the additional reputation data to a remote server to be added to the reputation data associated with the URL.

15. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

intercept, prior to launching of a browser application, a message transmitted by a mobile application executing on the computing device, wherein the message is a system level browse intent that indicates that the mobile application is launching the browser application and is transmitted based on data received by the mobile application;

obtain a universal resource locator (URL) from the message;

obtain reputation data using the URL;

determine that the URL is for a malicious website based on the reputation data; and

in response to determining that the URL is for the malicious website, perform a security action to protect the computing device from system level browser attacks.

16. The non-transitory computer-readable medium of claim 15 , wherein the security action comprises:

presenting, to a user of the computing device, a recommendation to block the URL.

17. The non-transitory computer-readable medium of claim 16 , wherein the one or more computer-executable instructions further cause the computing device to:

receive, in response to presenting the recommendation, an indication to block URL; and

in response to receiving the indication, block the URL.

18. The non-transitory computer-readable medium of claim 16 , wherein the one or more computer-executable instructions further cause the computing device to:

receive, in response to presenting the recommendation, an indication to add the URL to a bypass list, wherein the bypass list comprise URLs that bypass future security analysis;

generate an association for the URL with an application specified in the indication, wherein the application is specified to launch the URL; and

in response to receiving the indication, add the URL and the association to the bypass list.

Assignments (6)