Intelligent pop-up blocker
A pop-up blocker application detects and remediates malicious pop-up loops. The pop-up blocker application intercepts a call from a web page for initiating a pop-up browser window in a web browser. The pop-up blocker application updates a count of pop-up initiating calls associated with the web page occurring within a pre-defined time window. The updated count is compared to a threshold to determine whether the count meets a threshold indicative of a malicious pop-up loop. Responsive to the count meeting the threshold, the pop-up blocker applications takes a remedial action, such as navigating away from the web page.
1. A computer-implemented method for detecting and remediating a pop-up loop having malicious characteristics, the method comprising:
intercepting, by a computer, a call from a webpage for initiating a pop-up browser window in a web browser;
updating, based on the call, by the computer, a count tracking a number of calls initiating pop-up browser windows, wherein the calls are associated with the webpage and occurred within a predefined time window, wherein updating the count comprises:
recording, in a call log, an identifier for the webpage and a time associated with the call:
identifying, based on the call log, a subset of log entries pertaining to historical calls made by the web page associated with initiating the pop-up browser window and occurring within the predefined time window; and
generating the count based on the identified subset;
determining, by the computer, whether the count exceeds a threshold count indicative of the pop-up loop; and
responsive to the count exceeding the threshold count, classifying the calls as indicative of a malicious pop-up loop; and
responsive to classifying the calls as indicative of a malicious pop-up loop, performing, by the computer, a remedial action to remediate the pop-up loop.
2. The method of claim 1 , wherein remediating the pop-up loop comprises:
causing the browser to navigate away from the webpage and close the pop-up browser window.
3. The method of claim 1 , further comprising:
responsive to the count exceeding the threshold, updating, by the computer, a blacklist of malicious webpages for blocking by the web browser to include the web page.
4. The method of claim 1 , further comprising:
comparing an identifier of the webpage against a whitelist of trusted webpages; and
determining, by the computer, that the webpage is not included on the whitelist prior to intercepting the call.
5. The method of claim 1 , wherein intercepting the call comprises:
comparing the call to a list of predefined calls; and
determining, by the computer, that the call is included on the list of predefined calls.
6. The method of claim 1 , wherein remediating the pop-up loop comprises:
sending an identifier of the web page to a central malware detection server to cause the server to add the web page to a blacklist.
7. A non-transitory computer-readable storage medium storing instructions for detecting and remediating a pop-up loop, the instructions when executed by a processor cause the processor to perform steps including:
intercepting, by a computer, a call from a webpage for initiating a pop-up browser window in a web browser;
updating, based on the call, by the computer, a count tracking a number of calls initiating pop-up browser windows, wherein the calls are associated with the webpage and occurred within a predefined time window, wherein updating the count comprises:
recording, in a call log, an identifier for the webpage and a time associated with the call:
identifying, based on the call log, a subset of log entries pertaining to historical calls made by the web page associated with initiating the pop-up browser window and occurring within the predefined time window; and
generating the count based on the identified subset;
determining, by the computer, whether the count exceeds a threshold count indicative of the pop-up loop; and
responsive to the count exceeding the threshold count, classifying the calls as indicative of a malicious pop-up loop; and
responsive to classifying the calls as indicative of a malicious pop-up loop, performing, by the computer, a remedial action to remediate the pop-up loop.
8. The non-transitory computer-readable storage medium of claim 7 , wherein the instructions when executed further cause the processor to perform steps including:
causing the browser to navigate away from the webpage and close the pop-up browser window.
9. The non-transitory computer-readable storage medium of claim 7 , wherein the instructions when executed further cause the processor to perform steps including:
responsive to the count exceeding the threshold, updating a blacklist of malicious webpages for blocking by the web browser to include the web page.
10. The non-transitory computer-readable storage medium of claim 7 , wherein the instructions when executed further cause the processor to perform steps including:
comparing an identifier of the webpage against a whitelist of trusted webpages; and
determining that the webpage is not included on the whitelist prior to intercepting the call.
11. The non-transitory computer-readable storage medium of claim 7 , wherein intercepting the call comprises:
comparing the call to a list of predefined calls; and
determining that the call is included on the list of predefined calls.
12. The non-transitory computer-readable storage medium of claim 7 , wherein remediating the pop-up loop comprises:
sending an identifier of the web page to a central malware detection server to cause the server to add the web page to a blacklist.
13. A computing system comprising:
a processor; and
a non-transitory computer-readable storage medium storing instructions for detecting and blocking a pop-up loop, the instructions when executed by the processor cause the processor to perform steps including:
intercepting, by a computer, a call from a webpage for initiating a pop-up browser window in a web browser;
updating, based on the call, by the computer, a count tracking a number of calls initiating pop-up browser windows, wherein the calls are associated with the webpage and occurred within a predefined time window, wherein updating the count comprises:
recording, in a call log, an identifier for the webpage and a time associated with the call:
identifying, based on the call log, a subset of log entries pertaining to historical calls made by the web page associated with initiating the pop-up browser window and occurring within the predefined time window; and
generating the count based on the identified subset;
determining, by the computer, whether the count exceeds a threshold count indicative of the pop-up loop; and
responsive to the count exceeding the threshold count, classifying the calls as indicative of a malicious pop-up loop; and
responsive to classifying the calls as indicative of a malicious pop-up loop, performing, by the computer, a remedial action to remediate the pop-up loop.
14. The computing system of claim 13 , further comprising:
causing the browser to navigate away from the webpage and close the pop-up browser window.
15. The computing system of claim 13 , further comprising:
responsive to the count exceeding the threshold, updating, by the computer, a blacklist of malicious webpages for blocking by the web browser to include the web page.
16. The computing system of claim 13 , further comprising:
comparing an identifier of the webpage against a whitelist of trusted webpages; and
determining, by the computer, that the webpage is not included on the whitelist prior to intercepting the call.
17. The computing system of claim 13 , wherein intercepting the call comprises:
comparing the call to a list of predefined calls; and
determining, by the computer, that the call is included on the list of predefined calls.