Systems and methods for threat detection and warning
The present disclosure relates generally to computer security, and, more particularly, to systems and methods for assisting a user in avoiding the accidental disclosure of confidential or sensitive information, as well as avoiding potential security breaches, including phishing and impersonation, malware, and security issues, particularly with respect to websites and electronic communications.
1. A system for proactively providing a user with security-related information associated with content on a computing device prior to user interaction with such content, the system comprising:
a processor coupled to a non-transitory memory containing instructions executable by the processor to cause the system to:
present content on a user interface of the computing device for browsing by the user, the content including a link to an information resource;
analyze the content including monitoring the information resource and analyzing the information resource to account for changes to the information resource occurring after the content has been presented on the user interface of the computing device for browsing by the user but prior to user interaction with such content to determine whether at least one of (a) the content or the changes to the information resource requires disclosure of information or (b) the content or the changes to the information resource poses a security threat; and
based, at least in part, on the analysis, at least one of (a) output to the user, prior to user interaction with the content, security-related information associated with the content or the changes to the information resource based, at least in part, on the analysis or (b) prevent, prior to user interaction with the content, user interaction with the content.
2. The system of claim 1 , wherein outputting the security-related information comprises transmitting a signal to the computing device, or to a secondary computing device associated with the user, resulting in the computing device or secondary computing device outputting an alert comprising at least one of a physical indication, an audible indication, and a visual indication of whether the content or the information resource poses a security threat.
3. The system of claim 2 , wherein the visual indication comprises at least one of a notification, icon, pop-up warning, and modification of one or more visual aspects of the content displayed on a user interface of the computing device, a remote computing device, or a secondary remote computing device.
4. The system of claim 3 , wherein the visual indication comprises at least one of an image, graphic, object, text or color indicating whether the content is safe or unsafe for subsequent user interaction.
5. The system of claim 1 , wherein the security-related information comprises a safety assessment of the content.
6. The system of claim 5 , wherein the safety assessment comprises an indication of whether the content is safe or potentially harmful if the user interacts with such content with regard to a security standpoint.
7. The system of claim 5 , wherein the safety assessment comprises a recommended action that the user take with regard to the content.
8. The system of claim 5 , wherein the safety assessment comprises an indication whether the content contains a virus, malware, a cyberattack mechanism including phishing, or a combination thereof.
9. The system of claim 5 , wherein the safety assessment comprises an indication whether a claimed provenance or authorship of the content appears to be valid.
10. The system of claim 1 , wherein the content is associated with at least one of a software application, operating system, website, email, instant message, text message, and telecommunication.
11. The system of claim 1 , wherein the analysis of the content comprises identifying one or more content elements in addition to the link to the information resource and determining whether the one or more content elements pose a security threat.
12. The system of claim 11 , wherein the one or more content elements comprises a link, an icon, an attachment, or other visual representation of an information resource.
13. The system of claim 12 , wherein the visual representation is an email address or a link associated with a domain.
14. The system of claim 1 , wherein the analysis comprises a correlation of data associated with the content to a set of data associated with trusted content and flagging the content as being legitimate and safe or flagging the content as being illegitimate and unsafe based on the correlation.
15. The system of claim 14 , wherein the content is flagged as being legitimate and safe based on a positive correlation and the content is flagged as being illegitimate and unsafe based on a negative correlation.
16. The system of claim 14 , wherein the content data and the trusted content data comprises at least one of domain name(s), Uniform Resource Locator(s) (URL), Uniform Resource Identifier(s) (URIs), Internet Protocol addresses, HTML structure, webpage resources, including images, and a combination thereof.
17. The system of claim 16 , wherein the analysis comprises a graphical comparison comprising either a full comparison or a partial comparison of a screen image of the content to a screen image of trusted content and the flagging of the content is based, at least in part, on the graphical comparison.
18. The system of claim 17 , wherein the analysis comprises determining a suspicion score based on the correlation, wherein the suspicion score is a similarity metric determined based on a degree of similarity between a display representation of the content and a display representation of the trusted content.
19. The system of claim 1 , wherein at least one of:
the processor is provided locally on the computing device or provided on a server remote from the computing device; or
the processor is associated with at least one of an operating system of the computing device, a plugin for use with an application running on the computing device, a software application installed on, or queued to be installed on, the computing device, and a cloud-based service to which the computing device communicates.
20. A method for proactively providing a user with security-related information associated with content on a computing device prior to user interaction with such content, the method comprising:
presenting content on a user interface of the computing device for browsing by the user, the content including a link to an information resource;
analyzing the content including monitoring the information resource and analyzing the information resource to account for changes to the information resource occurring after the content has been presented on the user interface of the computing device for browsing by the user but prior to user interaction with such content to determine whether at least one of (a) the content or the changes to the information resource requires disclosure of information or (b) the content or the changes to the information resource poses a security threat; and
based, at least in part, on the analysis, at least one of (a) outputting to the user, prior to user interaction with the content, security-related information associated with the content or the changes to the information resource based, at least in part, on the analysis or (b) preventing, prior to user interaction with the content, user interaction with the content.