Granted Patent B2

US 12,348,564 · App. 18/902,634 · Granted Jul 1, 2025

Inventors: Craig John Slusher (Havertown, PA); Marcus Roland McCurdy (Haddon Township, NJ); Joren B. McReynolds (Denver, CO)

Assignee: Obsidian Security, Inc.

H04L63/1483

Abstract

Claims (78)

1. A method, comprising:

installing, via a processor of a first compute device associated with a user, a browser extension for a browser at the first compute device, the browser extension associated with an identifier that uniquely identifies a combination of the browser and at least one of the first compute device or the user;

for each site visited via the browser, analyzing, via the processor, a respective site via the browser extension to determine whether the respective site is at least one of a phishing site or a suspected phishing site; and

for each request to a software as a service (SaaS) application at a second compute device via the browser,

updating, via the processor, a user-agent header associated with that request to include the identifier, and

sending, via the processor, the user-agent header to the second compute device to cause a third compute device to (1) receive the identifier from the second compute device, (2) receive an audit log indicating a set of activities performed at the SaaS application, (3) identify a subset of activities that is from the set of activities and that is performed via the browser using the identifier, (4) determine based on the subset of activities that the SaaS application is the at least one of the phishing site or the suspected phishing site, and (5) perform a remedial action in response to determining that the SaaS application is the at least one of the phishing site or the suspected phishing site.

2. The method of claim 1 , wherein, for each site visited via the browser, the analyzing the respective site includes:

identifying an element at the respective site that should only be included in a predetermined set of sites;

determining that the respective site is the at least one of the phishing site or the suspected phishing site in response to the identifying and the respective site not being included in the predetermined set of sites; and

determining that the respective site is not the at least one of the phishing site or the suspected phishing site in response to the identifying and the respective site being included in the predetermined set of sites.

3. The method of claim 1 , wherein, for each site visited via the browser, the analyzing the site includes:

determining whether the respective site includes any image from a plurality of images of a plurality of predetermined login pages;

determining that the respective site is the at least one of the phishing site or the suspected phishing site in response to determining that the respective site does not include any image from the plurality of images; and

determining that the respective site is not the at least one of the phishing site or the suspected phishing site in response to determining that the respective site does include an image from the plurality of images.

4. The method of claim 1 , wherein, for each site visited via the browser, the analyzing the site includes:

hashing at least one of a hypertext markup language (HTML) document portion associated with the respective site, a document object model (DOM) associated with the respective site, or a resource loaded on the respective site, to generate a hash;

comparing the hash to a predetermined set of hashes associated with blacklisted sites; and

in response to the hash being substantially similar to a hash from the predetermined set of hashes associated with blacklisted sites, identifying the respective site as the at least one of the phishing site or the suspected phishing site.

5. The method of claim 1 , wherein, for each site visited via the browser, the analyzing the site includes:

hashing at least one of a hypertext markup language (HTML) document portion associated with the respective site, a document object model (DOM) associated with the respective site, or a resource loaded on the respective site, to generate a hash;

comparing the hash to a predetermined set of hashes associated with whitelisted sites;

in response to the hash being substantially similar to a hash from the predetermined set of hashes associated with whitelisted sites, identifying a domain associated with the respective site;

in response to the domain not being included in a predetermined set of domains, identifying the respective site as the at least one of the phishing site or the suspected phishing site; and

in response to the domain being included in a predetermined set of domains, identifying the respective site as not the at least one of the phishing site or the suspected phishing site.

6. The method of claim 1 , wherein the browser is configured to allow the user to log into the browser based on a user profile, the method further comprising:

identifying, in response to installing the browser extension, an identity of the user based on the user profile.

7. The method of claim 1 , further comprising:

analyzing, in response to installing the browser extension, the SaaS application for an email address associated with at least one of a local storage, a session storage, or a cookie, to determine at least one of an identity of the user or the first compute device.

8. The method of claim 1 , further comprising:

analyzing, in response to installing the browser extension, a browser history of the browser for a title that includes an email address associated with the user, to determine an identity of the user.

9. A first compute device associated with a user, comprising:

a memory; and

a processor operatively coupled to the memory, the processor configured to:

install a browser extension for a browser at the first compute device, the browser extension associated with an identifier that uniquely identifies a combination of the browser and at least one of the first compute device or the user;

for each site visited via the browser, analyzing a respective site via the browser extension to determine whether the respective site is at least one of a phishing site or a suspected phishing site; and

for each request to a software as a service (SaaS) application at a second compute device via the browser,

update a header associated with that request to include the identifier, and

send the header to the second compute device to cause a third compute device to (1) receive the identifier from the second compute device, (2) receive an audit log indicating a set of activities performed at the SaaS application, (3) identify a subset of activities that is from the set of activities and that is performed via the browser using the identifier, (4) determine based on the subset of activities that the SaaS application is the at least one of the phishing site or the suspected phishing site, and (5) perform a remedial action in response to determining that the SaaS application is the at least one of the phishing site or the suspected phishing site.

10. The first compute device of claim 9 , wherein, for each site visited via the browser, the analyzing the respective site includes:

identifying an element at the respective site that should only be included in a predetermined set of sites;

determining that the respective site is the at least one of the phishing site or the suspected phishing site in response to the identifying and the respective site not being included in the predetermined set of sites; and

determining that the respective site is not the at least one of the phishing site or the suspected phishing site in response to the identifying and the respective site being included in the predetermined set of sites.

11. The first compute device of claim 9 , wherein, for each site visited via the browser, the analyzing the respective site includes:

determining whether the respective site includes any image from a plurality of images of a plurality of predetermined login pages;

determining that the respective site is the at least one of the phishing site or the suspected phishing site in response to determining that the respective site does not include any image from the plurality of images; and

determining that the respective site is not the at least one of the phishing site or the suspected phishing site in response to determining that the respective site does include an image from the plurality of images.

12. The first compute device of claim 9 , wherein, for each site visited via the browser, the analyzing the respective site includes:

hashing at least one of a hypertext markup language (HTML) document portion associated with the respective site, a document object model (DOM) associated with the respective site, or a resource loaded on the respective site, to generate a hash;

comparing the hash to a predetermined set of hashes associated with blacklisted sites; and

in response to the hash being substantially similar to a hash from the predetermined set of hashes associated with blacklisted sites, identifying the respective site as the at least one of the phishing site or the suspected phishing site.

13. The first compute device of claim 9 , wherein, for each site visited via the browser, the analyzing the respective site includes:

hashing at least one of a hypertext markup language (HTML) document portion associated with the respective site, a document object model (DOM) associated with the respective site, or a resource loaded on the respective site, to generate a hash;

comparing the hash to a predetermined set of hashes associated with whitelisted sites;

in response to the hash being substantially similar to a hash from the predetermined set of hashes associated with whitelisted sites, identifying a domain associated with the respective site;

in response to the domain not being included in a predetermined set of domains, identifying the respective site as the at least one of the phishing site or the suspected phishing site; and

in response to the domain being included in a predetermined set of domains, identifying the respective site as not the at least one of the phishing site or the suspected phishing site.

14. The method of claim 1 , further comprising:

generating a first log indicating activities tracked by the browser extension as being performed at the SaaS application via the browser and by the user; and

sending a representation of the first log to the third compute device to cause the third compute device to perform cyber attestation by comparing (1) the first log and (2) a second log (a) sent to the third compute device via the second compute device associated with the SaaS application and (b) representing activities determined by the second compute device as being performed at the SaaS application via the browser and by the user.

15. The method of claim 1 , further comprising:

storing a private key of a keypair; and in response to a request to the SaaS application,

causing, via the browser extension, the identifier to be hashed using the private key to generate a hashed identifier, and

sending the hashed identifier to the third compute device to cause the third compute device to use a public key of the keypair to obtain the identifier, the determining that the SaaS application is the at least one of the phishing site or the suspected phishing site based on the identifier.

16. The method of claim 1 , wherein the:

determining that the SaaS application is the at least one of the phishing site or the suspected phishing site is further based on the SaaS application not having predefined data identifiably associated with at least one SaaS application from a predetermined set of SaaS applications.

17. The method of claim 1 , further comprising:

determining whether the SaaS application includes any image from a plurality of images of a plurality of predetermined login pages,

the determining that the SaaS application is the at least one of the phishing site or the suspected phishing site further based on determining that the SaaS application does not include any image from the plurality of images.

18. The method of claim 1 , further comprising:

hashing at least one of a hypertext markup language (HTML) document portion associated with the SaaS application, a document object model (DOM) associated with the SaaS application, or a resource loaded on the SaaS application, to generate a hash; and

comparing the hash to a predetermined set of hashes associated with blacklisted sites, the determining the SaaS application as the at least one of the phishing site or the suspected phishing site further based on the hash being substantially similar to a hash from the predetermined set of hashes associated with blacklisted sites.

19. The method of claim 1 , further comprising:

hashing at least one of a hypertext markup language (HTML) document portion associated with the SaaS application, a document object model (DOM) associated with the SaaS application, or a resource loaded on the SaaS application, to generate a hash;

comparing the hash to a predetermined set of hashes associated with whitelisted sites; and

in response to the hash being substantially similar to a hash from the predetermined set of hashes associated with whitelisted sites, identifying a domain associated with the SaaS application, the determining the SaaS application as the at least one of the phishing site or the suspected phishing site further based on the domain not being included in a predetermined set of domains.

20. The method of claim 14 , further comprising:

receiving an indication from the third compute device that the first log and the second log are substantially different; and

leaving the SaaS application in response to receiving the indication.

Assignments (2)

Continuity (2)

References Cited (28)