Systems and methods for mediating access to resources
The present disclosure relates generally to the field of data processing and electronic messaging systems, and, more particularly, to systems and methods for mediating a user's access to a resource to thereby prevent potential security breaches, including phishing and impersonation, malware, and security issues, particularly with respect to websites and electronic communications.
1. A system for mediating a user's access to content, the system comprising:
a processor coupled to a non-transitory memory containing instructions executable by the processor to cause the system to:
monitor content delivered to, or queued to be delivered to, a computing device associated with the user, wherein the content is subject to changing over a period of time based on user interaction with the content through selection of a selectable object of the content or entry of data into a data entry field of the content;
analyze the content including analyzing the content at least each time the content changes based on said user interaction with the content to determine whether the content requires disclosure of information and/or poses a threat; and
mediate user access to the content based on the analysis, wherein the mediating of user access comprises at least one of (1) outputting to the user, at least prior to and/or during user interaction with the content, security- or content-related information associated with the content or (2) preventing any subsequent user interaction with the content.
2. The system of claim 1 , wherein the system is configured to analyze the content at a time of delivery and also to analyze the content at least once after delivery but before the user accesses the content.
3. The system of claim 2 , wherein the system is configured to analyze the content after delivery in response to the user attempting to access the content.
4. The system of claim 1 , wherein outputting the security- or content-related information comprises generating an indicator to be displayed on a user interface of the user's computing device that indicates to the user one or more actions that are deemed allowable or banned with respect to the content.
5. The system of claim 1 , wherein outputting the security- or content-related information comprises generating an indicator to be displayed on a user interface of the user's computing device that comprises a safety assessment of the content.
6. The system of claim 1 , wherein outputting the security- or content-related information comprises generating an indicator to be displayed on a user interface of the user's computing device that comprises information about the content.
7. The system of claim 1 , wherein outputting the security- or content-related information comprises generating an indicator to be displayed on a user interface of the user's computing device that indicates a recommended action for the user to take with regard to the content.
8. The system of claim 1 , wherein outputting the security- or content-related information comprises generating an indicator to be displayed on a user interface of the user's computing device that indicates whether the content contains a virus, malware, a cyberattack mechanism including phishing, or a combination thereof.
9. The system of claim 1 , wherein outputting the security- or content-related information comprises generating an indicator to be displayed on a user interface of the user's computing device that comprises training information.
10. The system of claim 1 , wherein the content is associated with at least one of a software application, an operating system, a website, an email, an instant message, a text message, a voice mail, a social media message, a syndication feed such as RSS and ATOM, or a telecommunication.
11. The system of claim 10 , wherein the analysis comprises identifying one or more information resources associated with the content and determining whether or to what degree or with what probability the one or more information resources poses a security threat.
12. The system of claim 11 , wherein the one or more information resources comprises a link, an icon, an attachment, or other visual representation of an information resource.
13. The system of claim 12 , wherein the visual representation is an email address or a link associated with a domain.
14. The system of claim 1 , wherein the analysis comprises a similarity analysis of data associated with the content to a set of data associated with trusted content and flagging the content as being legitimate and safe or flagging the content as being illegitimate and unsafe based on the similarity analysis.
15. The system of claim 14 , wherein the similarity analysis uses a distance function, similarity metric, or machine learning model to evaluate similarity.
16. The system of claim 1 , wherein the content data and the trusted content data comprises at least one of domain name(s), Uniform Resource Locator(s) (URL), Uniform Resource Identifier(s) (URIs), Internet Protocol addresses, HTML structure, webpage resources, including images, reputation data, and a combination thereof.
17. The system of claim 1 , wherein the analysis comprises a graphical comparison comprising either a full comparison or a partial comparison of a screen image of the content to a screen image of trusted content and the flagging of the content is based, at least in part, on the graphical comparison.
18. The system of claim 14 , wherein the analysis comprises determining a suspicion score, wherein the suspicion score is a similarity metric representing of a degree of similarity between the data associated with the content and the set of data associated with trusted content.
19. The system of claim 1 , wherein the processor is provided locally on the computing device or provided on a server remote from the computing device.
20. The system of claim 1 , wherein the mediating of user access comprises recommending or triggering a browser isolation session to provide user access to the content in a protected environment.
21. The system of claim 1 , wherein the content has been rewritten as protected content by a pre-delivery threat analysis and intervention system prior to delivery to the user.
22. The system of claim 21 , wherein the content includes a smart URL associated with stored information identifying the original content, message, and recipients.
23. The system of claim 22 , wherein the stored information is used as part of the threat analysis.
24. The system of claim 1 , wherein the content is analyzed every time new content is loaded.
25. The system of claim 1 , wherein outputting the security- or content-related information comprises alerting the user of the changes to the content.