Systems and methods for proactive analysis of artifacts associated with information resources
The invention is related to security systems and methods for proactively informing a user about an artifact associated with a clickable object on a user interface with which the user is interacting, where such information is provided to the user prior to selection of the clickable object. The information includes a safety assessment of the clickable object, details about the underlying artifact, such as the contents of an archive file, and general information helpful in assisting the user with making a decision as to whether to select the clickable object.
1. A system for proactively providing a user with information associated with an information resource in advance of user selection and viewing of the information resource, the system comprising:
a processor coupled to a memory containing instructions executable by the processor to cause the system to:
monitor user interaction with a user interface of a computing device displaying content;
detect a hover event corresponding to user input with the user interface, the user input comprising positioning of a selection input proximate to a visual representation of an information resource for a predetermined period of time;
analyze one or more underlying artifacts associated with the information resource; and
output to the user, via the user interface, information associated with the information resource based on the analysis of the one or more underlying artifacts,
wherein the visual representation of the information resource is a selectable object associated with a domain; and
wherein analyzing the one or more underlying artifacts associated with the information resource comprises analyzing the domain associated with the selectable object, such analyzing comprising:
comparing the domain with a plurality of trusted domains;
correlating metadata of the domain with metadata of at least one trusted domain if the domain is determined to be similar to at least one of the trusted domains; and
flagging the domain as being legitimate or flagging the domain as being illegitimate based on the correlation, wherein the domain is flagged as being legitimate based on a positive correlation and the domain is flagged as being illegitimate based on a negative correlation.
2. The system of claim 1 , wherein outputting the information comprises displaying, on the user interface, a pop-up icon providing information associated with the information resource.
3. The system of claim 1 , wherein the information associated with the information resource comprises a safety assessment of the information resource.
4. The system of claim 3 , wherein the safety assessment of the information resource comprises an indication of whether the information resource is safe or potentially harmful if selected and viewed from a security standpoint.
5. The system of claim 4 , wherein the information associated with the information resource further comprises a recommended action that the user take based on the safety assessment.
6. The system of claim 4 , wherein the safety assessment comprises an indication whether the information resource contains viruses or other malware.
7. The system of claim 4 , wherein the safety assessment comprises an indication whether a claimed provenance or authorship of the information resource appears to be valid.
8. The system of claim 1 , wherein the information associated with the information resource informs the user of whether the information resource is an executable program for a platform other than a platform associated with the computing device and in use.
9. The system of claim 1 , wherein the information associated with the information resource comprises a listing of contents of a multipart information resource.
10. The system of claim 9 , wherein the multipart information resource is a file archive.
11. The system of claim 1 , wherein the information associated with the information resource informs the user of whether the information resource comprises adult-oriented material.
12. The system of claim 1 , wherein the visual representation is a link and the information associated with the information resource indicates whether the link redirects to a different link.
13. The system of claim 1 , wherein the information associated with the information resource informs the user of whether the information resource comprises material distributed without legal permission.
14. The system of claim 13 , wherein the information informs the user of whether the information resource comprises copyright violations.
15. The system of claim 1 , wherein the information associated with the information resource informs the user of whether the information resource comprises sensitive information that the user should not view, wherein the sensitive information comprises at least one of health care information and national security information.
16. The system of claim 1 , wherein the information associated with the information resource informs the user of whether the information resource is forbidden by a policy of the user's employer.
17. The system of claim 1 , wherein the visual representation of the information resource is a selectable object comprising a link, an icon, an attachment, or other visual representation of an information resource.
18. The system of claim 1 , wherein the visual representation is an email address, and the information associated with the information resource comprises one or more aspects of a reputation of the email address.
19. The system of claim 1 , wherein the system is further configured to maintain a database with the plurality of trusted domains.
20. The system of claim 1 , wherein the metadata is stored in a domain name system (DNS).
21. The system of claim 1 , wherein the metadata comprises at least one of a Mail Exchanger (MX) record, a Sender Policy Framework (SPF) record, or a DomainKeys Identified Mail (DKIM) record.