Granted Patent B2

US 11,487,877 · App. 17/014,792 · Granted Nov 1, 2022

Inventors: Alexey Stoletny (Long Island City, NY); Seth Demsey (Vienna, VA); Iván Soroka (Odessa, UA)

Assignee: CLEAN.IO, INC.

G06F21/564G06F21/54G06F21/561G06F21/568G06F21/563

Abstract

Claims (79)

1. A method for feeding identification data of malicious creatives existing in internet advertisements to intermediaries, the method comprising:

receiving at a feeding computing device from client computing devices malicious code reports of attempted unwanted actions by malicious creatives of internet advertisements (ads) sent by the intermediaries to webpages being displayed to users, the internet advertisements promoting goods and/or services,

wherein executing each malicious creative in a browser activates an unwanted action attempt by malicious code;

each malicious code report including a malicious code creative identification and an intermediary identification for the malicious code;

pre-processing each malicious code report to create pre-processed malicious code reports by:

parsing each malicious code report to extract the malicious code creative identification and the intermediary identification for the malicious code;

performing the parsing to create parsed pre-processed malicious code reports, each parsed pre-processed malicious code report including the malicious code creative identification, the intermediary identification, and a timestamp of the unwanted action attempt; and

feeding identification data of malicious creatives to intermediaries identified by the intermediary identifications of the malicious code reports, wherein feeding comprises:

feeding the parsed pre-processed malicious code reports to intermediaries identified by the intermediary identifications based on the parsed pre-processed malicious code reports.

2. The method of claim 1 , further comprising:

adding to each malicious code report, internet protocol address information of the client computing devices; and

parsing from each malicious code report, user agent information of a type of browser of the client computing devices.

3. The method of claim 1 ,

wherein the intermediary identification is one of a supply side platform (SSP) identification, a demand side platform (DSP) identification or an ad provider identification of an ad provider that sent the malicious creative; and

wherein each malicious code report includes:

at least two of a malicious code seat identification, a copy of malicious code programming code of each malicious creative and a malicious code chain of events that lead to the unwanted action attempt, the malicious code chain of events having the timestamp of the unwanted action attempt.

4. The method of claim 1 , wherein feeding includes:

dividing the parsed pre-processed malicious code reports into subsets of unique samples of the parsed pre-processed malicious code reports based on the intermediary identifications, each subset of unique samples having the parsed pre-processed malicious code reports for a single intermediary of the intermediary identifications.

5. The method of claim 4 , wherein parsing each pre-processed malicious code report to extract, and dividing the parsed pre-processed malicious code reports includes using parsing rules to detect and extract from different data formats due to the pre-processed malicious code reports being sent by different intermediaries.

6. The method of claim 1 , wherein

the malicious code creative identification includes a creative identification number for the malicious creative which is generated by an intermediary for each malicious creative and uniquely identifies each malicious creative to the intermediary, and

the intermediary identification for the malicious code includes an intermediary identification number for the intermediary that provided the malicious creative, which is generated by a publisher of the malicious creative, the client computing device or the intermediary that uniquely identifies each intermediary sending ads to the publisher.

7. A method for feeding identification data of malicious creatives existing in internet advertisements to intermediaries, the method comprising:

receiving at a feeding computing device from client computing devices malicious code reports of attempted unwanted actions by malicious creatives of internet advertisements (ads) sent by the intermediaries to webpages being displayed to users, the internet advertisements promoting goods and/or services,

wherein executing each malicious creative in a browser activates an unwanted action attempt by malicious code;

each malicious code report including a malicious code creative identification and an intermediary identification for the malicious code;

parsing each malicious code report to extract the malicious code creative identification and the intermediary identification for the malicious code; and

feeding identification data of malicious creatives to intermediaries identified by the intermediary identifications of the malicious code reports, wherein feeding includes preparing identification data for each of the intermediaries by:

dividing subsets of unique samples into daily sets of unique creatives based on the malicious code creative identifications, each unique creative having the parsed pre-processed malicious code information for a single malicious code creative identification of the malicious code creatives and a count of the number of the creatives in the information having that single malicious code creative identification; and

wherein feeding includes displaying the identification data for each of the intermediaries, the identification data showing the daily set of unique creatives.

8. The method of claim 7 , further comprising:

monitoring the daily sets of unique creatives to detect a first malicious code creative identification that is new or a second malicious code creative identification that has existed for a predetermined time period;

sending a new creative alert to a first intermediary if the first malicious code creative identification is detected; and

sending an old creative alert to a second intermediary if the second malicious code creative identification that has existed for the predetermined time period is detected.

9. An apparatus comprising a non-transitory machine readable medium storing a program having instructions which when executed by a processor will cause the processor to extract and feed identification data of malicious code existing in internet advertisements to intermediaries, the instructions of the program for:

receiving at a feeding computing device from client computing devices malicious code reports of attempted unwanted actions by malicious creatives of internet advertisements (ads) sent by the intermediaries to webpages being displayed to users, the internet advertisements promoting goods and/or services,

wherein executing each malicious creative in a browser activates an unwanted action attempt by malicious code;

each malicious code report including a malicious code creative identification and an intermediary identification for the malicious code;

pre-processing each malicious code report to create pre-processed malicious code reports by:

parsing each malicious code report to extract the malicious code creative identification, and the intermediary identification for the malicious code;

performing the parsing to create parsed pre-processed malicious code reports, each parsed pre-processed malicious code report including the malicious code creative identification, the intermediary identification, and a timestamp of the unwanted action attempt; and

feeding identification data of malicious creatives to intermediaries identified by the intermediary identifications based on the malicious code reports, wherein feeding comprises:

feeding the parsed pre-processed malicious code reports to intermediaries identified by the intermediary identifications based on the parsed pre-processed malicious code reports.

10. The apparatus of claim 9 , the instructions of the program further for:

adding to each malicious code report, internet protocol address information of the client computing devices; and

parsing from each malicious code report, user agent information of a type of browser of the client computing devices.

11. The apparatus of claim 9 ,

wherein the intermediary identification is one of a supply side platform (SSP) identification, a demand side platform (DSP) identification or an ad provider identification of an ad provider that sent the malicious creative; and

wherein each malicious code report includes:

at least two of a malicious code seat identification, a copy of malicious code programming code of each malicious creative and a malicious code chain of events that lead to the unwanted action attempt, the malicious code chain of events having the timestamp of the unwanted action attempt.

12. The apparatus of claim 9 , wherein feeding includes:

dividing the parsed pre-processed malicious code reports into subsets of unique samples of the parsed pre-processed malicious code reports based on the intermediary identifications, each subset of unique samples having the parsed pre-processed malicious code reports for a single intermediary of the intermediary identifications.

13. The apparatus of claim 12 , wherein parsing each pre-processed malicious code report to extract, and dividing the parsed pre-processed malicious code reports includes using parsing rules to detect and extract from different data formats due to the pre-processed malicious code reports being sent by different intermediaries.

14. An apparatus comprising a non-transitory machine readable medium storing a program having instructions which when executed by a processor will cause the processor to extract and feed identification data of malicious code existing in internet advertisements to intermediaries, the instructions of the program for:

receiving at a feeding computing device from client computing devices malicious code reports of attempted unwanted actions by malicious creatives of internet advertisements (ads) sent by the intermediaries to webpages being displayed to users, the internet advertisements promoting goods and/or services,

wherein executing each malicious creative in a browser activates an unwanted action attempt by malicious code;

each malicious code report including a malicious code creative identification and an intermediary identification for the malicious code;

parsing each malicious code report to extract the malicious code creative identification, and the intermediary identification for the malicious code; and

feeding identification data of malicious creatives to intermediaries identified by the intermediary identifications based on the malicious code reports, wherein feeding includes preparing identification data for each of the intermediaries by:

dividing subsets of unique samples into daily sets of unique creatives based on the malicious code creative identifications, each unique creative having the parsed pre-processed malicious code information for a single malicious code creative identification of the malicious code creatives and a count of the number of the creatives in the information having that single malicious code creative identification; and

wherein feeding includes displaying the identification data for each of the intermediaries, the identification data showing the daily set of unique creatives.

15. The apparatus of claim 14 , the instructions of the program further for:

monitoring the daily sets of unique creatives to detect a first malicious code creative identification that is new or a second malicious code creative identification that has existed for a predetermined time period;

sending a new creative alert to a first intermediary if the first malicious code creative identification is detected; and

sending an old creative alert to a second intermediary if the second malicious code creative identification that has existed for the predetermined time period is detected.

16. A system for extracting and feeding identification data of malicious code existing in internet advertisements to intermediaries, the system comprising a memory storing computer instructions that when executed by a processor include:

a receiver configured to receive from client computing devices malicious code reports of attempted unwanted actions by malicious creatives of internet advertisements (ads) sent by the intermediaries to webpages being displayed to users, the internet advertisements promoting goods and/or services,

wherein executing each malicious creative in a browser activates an unwanted action attempt by malicious code;

each malicious code report including a malicious code creative identification and an intermediary identification for the malicious code;

a parser configured to parse each malicious code report to extract the malicious code creative identification and the intermediary identification for the malicious code; and

a feeder configured to feed identification data of malicious creatives to the intermediaries identified by the intermediary identifications of the malicious code reports, wherein feeding includes preparing identification data for each of the intermediaries by dividing subsets of unique samples into daily sets of unique creatives based on the malicious code creative identifications, each unique creative having the parsed pre-processed malicious code information for a single malicious code creative identification of the malicious code creatives and a count of the number of the creatives in the information having that single malicious code creative identification; and

wherein feeding includes displaying the identification data for each of the intermediaries, the identification data showing the daily set of unique creatives.

17. The system of claim 16 , further comprising a pre-processor configured to pre-process each malicious code report to create pre-processed malicious code reports by:

adding to each malicious code report, internet protocol address information of the client computing devices; and

parsing from each malicious code report, user agent information of a type of browser of the client computing devices.

18. The system of claim 16 ,

wherein the intermediary identification is one of a supply side platform (SSP) identification, a demand side platform (DSP) identification or an ad provider identification of an ad provider that sent the malicious creative; and

wherein each malicious code report includes:

at least two of a malicious code seat identification, a copy of malicious code programming code of each malicious creative and a malicious code chain of events that lead to the unwanted action attempt, the malicious code chain of events having the timestamp of the unwanted action attempt.

Assignments (8)

Continuity (3)