Proactive browser content analysis

Inventors: Joe Jaroch (Elk Grove Village, IL); Harry Murphey McCloy, III (Longmont, CO); Robert Edward Adams (Sunnyvale, CA)

Assignee: Webroot Inc.

G06F21/566

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 11,593,484
App. No.: 17/221,028
Granted: Feb 28, 2023
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A protection module operates to analyze threats, at the protocol level (e.g., at the HTML level), by intercepting all requests that a browser engine resident in a computing device sends and receives, and the protection agent completes the requests without the help of the browser engine. And then the protection module analyzes and/or modifies the completed data before the browser engine has access to it, to, for example, display it. After performing all of its processing, removing, and/or adding any code as needed, the protection module provides the HTML content to the browser engine, and the browser engine receives responses from the protection agent as if it was speaking to an actual web server, when in fact, browser engine is speaking to an analysis engine of the protection module.

Claims (58)

1. A malware protection agent method, comprising:

at a protection agent executing on a client,

receiving a request for content stored on a server device, the content comprising protocol level source code;

forwarding, over a network, the request for content to the server device;

requesting, over the network from a malware management agent, information regarding a plurality of malware threats including malware threats from a malware source;

receiving the information from the malware management agent;

receiving, over the network, the content from the server device, the content comprising at least one malware threat from the plurality of malware threats from the malware source;

identifying the at least one malware threat in the content based on the received malware threat information; and

regenerating the content according to the protocol level source code, comprising:

modifying the content by removing or deactivating the at least one malware threat in the content; and

forwarding the modified content for display.

2. The method of claim 1 , wherein the request for content stored on the server device is received from a web browser, the server device comprises a web server, and the protection agent forwards the modified content to the web browser for display.

3. The method of claim 2 , wherein the protocol level source code comprises at least one of: Hypertext Markup Language formatting information, JavaScript code, web server script code and Cascading Style Sheets formatting information.

4. The method of claim 2 , further comprising, by the protection agent, annotating the modified content to denote whether a website reference is malicious.

5. The method of claim 1 , wherein the identifying the at least one malware threat in the content based on the received malware threat information comprises:

performing a Uniform Resource Locator analysis on the content to identify the at least one malware threat;

performing an Internet Protocol analysis on the content to identify the at least one malware threat;

performing an image analysis on the content to identify the at least one malware threat; and

performing a JavaScript and Hypertext Markup Language analysis to identify the at least one malware threat.

6. The method of claim 5 , wherein modifying the content by removing or deactivating the at least one malware threat in the content, comprises:

aggregating the results of the Uniform Resource Locator analysis, the Internet Protocol analysis, the image analysis, and the JavaScript and Hypertext Markup Language analysis to remove the at least one malware threat in the aggregated result.

7. The method of claim 5 , wherein the Uniform Resource Locator analysis, the Internet Protocol analysis, the image analysis, and the JavaScript and Hypertext Markup Language analysis are performed asynchronously.

8. The method of claim 1 , wherein the identifying the at least one malware threat in the content based on the received malware threat information comprises:

parsing the content into blocks;

organizing the blocks into a hierarchy; and

traversing the hierarchy to identify the at least one malware threat.

9. The method of claim 8 , wherein the content comprises Hypertext Markup Language and parsing the content into blocks comprises: parsing the content into blocks based on distinct tagged portions in the Hypertext Markup Language content.

10. The method of claim 1 , wherein the at least one malicious threat comprises: an illicit image, an illicit advertisement, a fake password request form, a cross-site scripting attack, spam content, or a phishing request.

11. A malware protection agent system comprising:

at least one processor; and

memory encoding computer executable instructions that, when executed by the at least one processor, perform a method comprising: