Granted Patent B2

US 12,316,671 · App. 17/308,323 · Granted May 27, 2025

Inventors: Meni Farjon (Tel Aviv, IL); Yossi Sara (Rishon Le'Tsiyon, IL); Boris Vaynberg (Netanya, IL); Roi Panai (Ramat Gan, IL); Ido Bukra (Netanya, IL); Tomasz Kojm (Torun, PL); Jackie Maylor (London, GB)

Assignee: Mimecast Israel Ltd

H04L63/1483G06F40/221H04L63/0823

Abstract

Claims (81)

1. A method for identifying a malicious web page that impersonates a web page of a legitimate owner, comprising:

extracting HMTL source of a web page intended for access by a user via a web browser;

statically and lexically analyzing the extracted HTML source to identify at least one of objects, forms, links and templates embedded in the HTML source;

determining whether or not the HTML source harvests user credentials, based on the at least one of the objects, forms, links and templates identified by said analyzing;

when said determining is negative, enabling the web page of the URL to be accessed,

wherein said determining comprises:

further determining if any of the at least one of the objects, forms, links and templates identified by said analyzing elicit sensitive user data;

when said further determining is affirmative, indicating an affirmative determination; and

otherwise, indicating a negative determination,

further comprising:

when said determining is affirmative, then:

extracting a certificate for the web page intended for access;

validating the extracted certificate to determine a possibility of an impersonation attempt;

when said validating fails, then blocking the web page intended for access from being accessed;

when said validating is successful, then:

parsing the extracted HTML source to identify at least one of images and logos embedded in the HTML source;

matching the identified image and logos with known images and brand logos of legitimate owners that are stored in a data storage;

for each matched image or logo, comparing a certificate associated with the legitimate owner with the extracted certificate;

when said comparing is affirmative for at least one legitimate owner, then enabling the web page intended for access to be accessed; and

when said comparing is negative for all matched known images and brand logos, then blocking the web page intended for access from being accessed.

2. The method of claim 1 , wherein said matching comprises:

receiving an image or logo identified by said parsing;

extracting features of the received image or logo;

generating a feature data table from the extracted features;

building a feature vector from the feature data table;

further determining if the identified image or logo is similar to a known image or brand logo, using the feature vector;

when said further determining is affirmative, then:

marking the web page intended for access as a potential impersonation; and

providing a list of possible owners; and

when said further determining is non-affirmative, then marking the web page intended for access as legitimate.

3. The method of claim 1 , wherein said comparing comprises:

further extracting alternative subject name (ASN) values from the extracted certificate;

retrieving a domain list for the known image or brand logo from a second data storage that stores mappings of images and brand logos to their assigned domains;

comparing ASN values of the extracted certificate with the retrieved domain list;

when said comparing affirms at least one ASN value, then indicating an affirmative compare; and

otherwise, indicating a non-affirmative compare.

4. The method of claim 3 , wherein said retrieving retrieves from the second data storage subdomains of the assigned domains for the known image or brand logo.

5. The method of claim 1 further comprising:

marking the web page intended for access as being clean, when access to the web page intended for access is enabled; and

marking the web page intended for access as being suspicious, when access to the web page intended for access is blocked.

6. The method of claim 1 , wherein credentials comprise one or more of usernames, email addresses, passwords, social security numbers, and credit card information.

7. The method of claim 1 , wherein said validating comprises inspecting one or more of the expiry date, the revoke status, and the signature authority of the extracted certificate.

8. The method of claim 1 , wherein said comparing searches for mismatches between one or more of certificate validity, mathematical hash, DNS information, subject name, subject alternative name, certificate chain, and date of issuance, between the extracted certificate and the certificate associated with the known image or brand logo.

9. A method for identifying a malicious web page that impersonates a web page of a legitimate owner, comprising:

extracting HMTL source of a web page intended for access by a user via a web browser;

statically and lexically analyzing the extracted HTML source to identify at least one of objects, forms, links and templates embedded in the HTML source;

determining whether or not the HTML source harvests user credentials, based on the at least one of the objects, forms, links and templates identified by said analyzing;

when said determining is negative, enabling the web page of the URL to be accessed,

parsing the extracted HTML source to identify at least one of images and logos embedded in the HTML source;

extracting a certificate for the web page intended for access;

examining the behavior of a web site that is expected to belong to a legitimate owner, the legitimate owner being inferred from logos that appear in the web page intended for access, or from a web page certificate that bears the name of the legitimate owner, the behavior comprising a path of links followed by a user to reach a login page of a website;

comparing the examined web site behavior to behaviors for known web sites of the legitimate owner;

when said comparing is affirmative for at least one known website of the legitimate owner, then enabling the web page intended for access to be accessed; and

when said comparing is negative for known websites of the legitimate owner, then blocking the web page intended for access from being accessed.

10. A method for identifying a malicious web page that impersonates a web page of a legitimate owner, comprising:

extracting HMTL source and a certificate of a web page intended for access by a user via a web browser;

statically and lexically tokenizing the extracted HTML source to identify (i) at least one of objects, forms, links and templates embedded in the HTML source, and (ii) at least one of images and logos embedded in the HTML source;

determining whether or not the HTML source harvests user credentials, based on the at least one of the objects, forms, links and templates identified by said tokenizing;

validating the extracted certificate, to determine a possibility of an impersonation attempt;

matching the at least one of the images and logos identified by said tokenizing, with known images and brand logos of legitimate owners; and

comparing a known certificate associated with the legitimate owner with the extracted certificate, for each image or logo matched by said matching.

11. The method of claim 10 , wherein said determining comprises:

further determining if any of the at least one of the objects, forms, links and templates identified by said parsing elicit sensitive user data;

when said further determining is affirmative, then indicating an affirmative determination; and

otherwise, indicating a negative determination.

12. The method of claim 10 , further comprising when said determining is affirmative, then comparing identified links of the HTML source to a list of domains and IP addresses of the legitimate owner, the legitimate owner being inferred from the identified logos, or from the extracted web page certificate.

13. The method according to claim 10 , further comprising:

examining the login type of a web site appearing to belong to the legitimate owner, the legitimate owner being inferred from logos that appear in the web site or from a web site certificate that bears the name of the legitimate owner, the login type comprising the type and form of user credentials that are input; and

comparing the examined web site login type to a known login type of the legitimate owner.

14. The method of claim 13 wherein a user credential comprises an e-mail address & a password, a token, or a centralized single sign-on.

15. The method of claim 10 , further comprising blocking the web page intended for access from being accessed when at least one of (a) the HTML source is determined to harvest user credentials, (b) the extracted certificate is validated as a possible impersonation attempt, (c) the at least one of the identified images and logos does not match with known images or brand logos of legitimate owners, or (d) the known certificate associated with the legitimate owner does not match with the extracted certificate for at least one image or logo matched by said matching.

16. A system for identifying a malicious web page that impersonates a legitimate web page, comprising:

a lexical analyzer extracting HMTL source and a certificate for a web page intended for access by a user via a web browser, and statically and lexically tokenizing the extracted HTML source to identify (i) at least one of objects, forms, links and templates embedded in the HTML source, and (ii) at least one of images and logos embedded in the HTML source;

a sensitive-input detector determining whether or not the HTML source harvests user credentials, based on the at least one of the objects, forms links and templates identified by said lexical analyzer;

a certificate validator validating the certificate extracted by said parser, to determine a possibility of an impersonation attempt;

a data storage storing known images and brand logos of legitimate owners, and certificates associated with the legitimate owners;

a logo detector matching the at least one of the images and logos identified by said lexical analyzer, with the known images and brand logos of legitimate owners in said data storage; and

an ownership validator comparing a certificate associated with the owner of the legitimate web page with the extracted certificate, for each image or logo matched by said logo detector.

17. The system of claim 16 , wherein credentials comprise personal identification information comprising one or more of usernames, email addresses, passwords, social security numbers, and credit card information.

18. The system of claim 16 , wherein said certificate validator inspects one or more of an expiry date, a revoke status, and a signature authority of the certificate extracted by said lexical analyzer.

19. The method of claim 13 , further comprising blocking the web page intended for access from being accessed when the examined web site login type does not match a known login type of the legitimate owner.

Assignments (1)

Continuity (2)

References Cited (16)