Intelligent Pop-Up Blocker
A pop-up blocker application detects and remediates malicious pop-up loops. The pop-up blocker application intercepts a call from a web page for initiating a pop-up browser window in a web browser. The pop-up blocker application updates a count of pop-up initiating calls associated with the web page occurring within a pre-defined time window. The updated count is compared to a threshold to determine whether the count meets a threshold indicative of a malicious pop-up loop. Responsive to the count meeting the threshold, the pop-up blocker applications takes a remedial action, such as navigating away from the web page.
1 . A computer-implemented method for detecting and remediating a pop-up loop having malicious characteristics, the method comprising:
identifying a call as a request for initiating a pop-up browser window;
updating, based on the call, a count tracking a number of calls initiating pop-up browser windows, wherein the calls are associated with a webpage and occurred within a predefined time window;
determining whether the count exceeds a threshold count indicative of the pop-up loop;
responsive to the count exceeding the threshold count, classifying the calls as indicative of a malicious pop-up loop; and
responsive to classifying the calls as indicative of a malicious pop-up loop, performing a remedial action to remediate the pop-up loop.
2 . The method of claim 1 , wherein remediating the pop-up loop comprises:
causing the browser to navigate away from the webpage and close the pop-up browser window.
3 . The method of claim 1 , wherein updating the count of calls comprises:
recording, in a call log, an identifier for the webpage and a time associated with the call;
identifying, based on the call log, a subset of log entries pertaining to historical calls made by the web page associated with initiating the pop-up browser window and occurring within the predefined time window; and
generating the count based on the identified subset.
4 . The method of claim 1 , further comprising:
responsive to the count exceeding the threshold, updating, by the computer, a blacklist of malicious webpages for blocking by the web browser to include the web page.
5 . The method of claim 1 , further comprising:
intercepting the call;
comparing an identifier of the webpage against a whitelist of trusted webpages; and
determining that the webpage is not included on the whitelist prior to intercepting the call.
6 . The method of claim 5 , wherein intercepting the call comprises:
comparing the call to a list of predefined calls; and
determining that the call is included on the list of predefined calls.
7 . The method of claim 1 , wherein performing the remedial action comprises:
sending an identifier of the web page to a central malware detection server to cause the server to add the web page to a blacklist.
8 . A non-transitory computer-readable storage medium storing instructions for detecting and remediating a pop-up loop, the instructions when executed by a processor cause the processor to perform steps including:
identifying a call as a request for initiating a pop-up browser window;
updating, based on the call, a count tracking a number of calls initiating pop-up browser windows, wherein the calls are associated with a webpage and occurred within a predefined time window;
determining whether the count exceeds a threshold count indicative of the pop-up loop;
responsive to the count exceeding the threshold count, classifying the calls as indicative of a malicious pop-up loop; and
responsive to classifying the calls as indicative of a malicious pop-up loop, performing a remedial action to remediate the pop-up loop.
9 . The non-transitory computer-readable storage medium of claim 8 , wherein the instructions when executed further cause the processor to perform steps including:
causing the browser to navigate away from the webpage and close the pop-up browser window.
10 . The non-transitory computer-readable storage medium of claim 8 , wherein updating the count of calls comprises:
recording, in a call log, an identifier for the webpage and a time associated with the call;
identifying, based on the call log, a subset of log entries pertaining to historical calls made by the web page associated with initiating the pop-up browser window and occurring within the predefined time window; and
generating the count based on the identified subset.
11 . The non-transitory computer-readable storage medium of claim 8 , wherein the instructions when executed further cause the processor to perform steps including:
responsive to the count exceeding the threshold, updating a blacklist of malicious webpages for blocking by the web browser to include the web page.
12 . The non-transitory computer-readable storage medium of claim 8 , wherein the instructions when executed further cause the processor to perform steps including:
intercepting the call;
comparing an identifier of the webpage against a whitelist of trusted webpages; and
determining that the webpage is not included on the whitelist prior to intercepting the call.
13 . The non-transitory computer-readable storage medium of claim 12 , wherein intercepting the call comprises:
comparing the call to a list of predefined calls; and
determining that the call is included on the list of predefined calls.
14 . The non-transitory computer-readable storage medium of claim 8 , wherein performing the remedial action comprises:
sending an identifier of the web page to a central malware detection server to cause the server to add the web page to a blacklist.
15 . A computing system comprising:
a processor; and
a non-transitory computer-readable storage medium storing instructions for detecting and blocking a pop-up loop, the instructions when executed by the processor cause the processor to perform steps including:
identifying a call as a request for initiating a pop-up browser window;
updating, based on the call, a count tracking a number of calls initiating pop-up browser windows, wherein the calls are associated with a webpage and occurred within a predefined time window;
determining whether the count exceeds a threshold count indicative of the pop-up loop;
responsive to the count exceeding the threshold count, classifying the calls as indicative of a malicious pop-up loop; and
responsive to classifying the calls as indicative of a malicious pop-up loop, performing a remedial action to remediate the pop-up loop.
16 . The computing system of claim 15 , further comprising:
causing the browser to navigate away from the webpage and close the pop-up browser window.
17 . The computing system of claim 15 , wherein updating the count of calls comprises:
recording, in a call log, an identifier for the webpage and a time associated with the call;
identifying, based on the call log, a subset of log entries pertaining to historical calls made by the web page associated with initiating the pop-up browser window and occurring within the predefined time window; and
generating the count based on the identified subset.
18 . The computing system of claim 15 , further comprising:
responsive to the count exceeding the threshold, updating a blacklist of malicious webpages for blocking by the web browser to include the web page.
19 . The computing system of claim 15 , further comprising:
comparing an identifier of the webpage against a whitelist of trusted webpages; and
determining that the webpage is not included on the whitelist prior to intercepting the call.
20 . The computing system of claim 15 , wherein intercepting the call comprises:
intercepting the call;
comparing the call to a list of predefined calls; and
determining, by the computer, that the call is included on the list of predefined calls.