Granted Patent B2

US 12,407,724 · App. 18/164,056 · Granted Sep 2, 2025

Inventors: Charlene Moss Gorter (Concord, NC); Kyle Andrew Mayers (Charlotte, NC); Sanjay Arjun Lohar (Charlotte, NC); James Siekman (Charlotte, NC); Connor Thomas McCormick (Westminster, CO)

Assignee: Bank of America Corporation

H04L63/1483H04L63/1425

Abstract

Claims (96)

1. A system comprising:

a user device comprising:

a first memory configured to store a client application; and

a first processor communicatively coupled to the first memory, wherein the first processor, when executing the client application, is configured to:

intercept a message comprising a quick response (QR) code or a uniform resource locator (URL), wherein the QR code corresponds to the URL;

send the message to a cloud computing system;

receive a status of the message from the cloud computing system; and

release the message to be displayed along with the status; and

the cloud computing system communicatively coupled to the user device, wherein the cloud computing system comprises:

a second memory configured to store:

known safe URLs;

known malicious URLs;

known safe sources;

known malicious sources;

known malicious codes; and

hashes of known malicious files; and

a second processor communicatively coupled to the second memory, the second processor configured to:

receive the message from the user device;

determine the status of the message, wherein determining the status of the message comprises:

determining a source of the message;

comparing the source of the message to the known malicious sources;

in response to the source of the message not matching any of the known malicious sources, comparing the source of the message to the known safe sources;

in response to the source of the message not matching any of the known safe sources, comparing the URL to the known malicious URLs; and

in response to the URL matching a respective one of the known malicious URLs, determining the status of the message as malicious;

in response to the URL not matching any of the known malicious URLs, compare the URL to the known safe URLs;

in response to the URL matching a respective one of the known safe URLs, determine the status of the message as safe;

in response to the URL not matching any of the known safe URLs, analyze the URL for spelling errors;

in response to identifying at least one spelling error in the URL, determine the status of the message as suspicious;

in response to identifying no spelling errors in the URL, determine a destination identified by the URL;

in response to determining that the destination identified by the URL is a file, determine a hash of the file;

compare the hash of the file to the hashes of known malicious files; and

in response to the hash of the file matching a hash of one of the known malicious files, determine the status of the message as malicious; and

send the status of the message to the user device.

2. The system of claim 1 , wherein determining the status of the message further comprises:

in response to the hash of the file not matching any of the hashes of known malicious files, analyzing contents of the file for spelling errors;

in response to identifying at least one spelling error in the file, determining the status of the message as suspicious; and

in response to identifying no spelling errors in the file, determining the status of the message as safe.

3. The system of claim 2 , wherein determining the status of the message further comprises:

in response to determining that the destination identified by the URL is a webpage, analyzing a source code of the webpage for malicious codes; and

in response to identifying at least one malicious code, determining the status of the message as malicious.

4. The system of claim 3 , wherein determining the status of the message further comprises:

in response to identifying no malicious code, analyzing contents of the webpage for spelling errors;

in response to identifying at least one spelling error in the webpage, determining the status of the message as suspicious; and

in response to identifying no spelling errors in the webpage, determine the status of the message as safe.

5. A method comprising:

intercepting a message comprising a quick response (QR) code or a uniform resource locator (URL), wherein the QR code corresponds to the URL;

determining a status of the message, wherein determining the status of the message comprises:

determining a source of the message;

comparing the source of the message to known malicious sources;

in response to the source of the message not matching any of the known malicious sources, comparing the source of the message to known safe sources;

in response to the source of the message not matching any of the known safe sources, comparing the URL to known malicious URLs; and

in response to the URL matching a respective one of the known malicious URLs, determining the status of the message as malicious;

in response to the URL not matching any of the known malicious URLs, comparing the URL to known safe URLs;

in response to the URL matching a respective one of the known safe URLs, determining the status of the message as safe;

in response to the URL not matching any of the known safe URLs, analyzing the URL for spelling errors;

in response to identifying at least one spelling error in the URL, determining the status of the message as suspicious;

in response to identifying no spelling errors in the URL, determining a destination identified by the URL;

in response to determining that the destination identified by the URL is a file, determining a hash of the file;

comparing the hash of the file to hashes of known malicious files; and

in response to the hash of the file matching a hash of one of the known malicious files, determining the status of the message as malicious; and

releasing the message to be displayed along with the status.

6. The method of claim 5 , further comprising:

in response to the hash of the file not matching any of the hashes of known malicious files, analyzing contents of the file for spelling errors;

in response to identifying at least one spelling error in the file, determining the status of the message as suspicious; and

in response to identifying no spelling errors in the file, determining the status of the message as safe.

7. The method of claim 6 , further comprising:

in response to determining that the destination identified by the URL is a webpage, analyzing a source code of the webpage for malicious codes; and

in response to identifying at least one malicious code, determining the status of the message as malicious.

8. The method of claim 7 , further comprising:

in response to identifying no malicious code, analyzing contents of the webpage for spelling errors;

in response to identifying at least one spelling error in the webpage, determining the status of the message as suspicious; and

in response to identifying no spelling errors in the webpage, determine the status of the message as safe.

9. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:

intercept a message comprising a quick response (QR) code or a uniform resource locator (URL), wherein the QR code corresponds to the URL;

determine a status of the message, wherein determining the status of the message comprises:

determining a source of the message;

comparing the source of the message to known malicious sources;

in response to the source of the message not matching any of the known malicious sources, comparing the source of the message to known safe sources;

in response to the source of the message not matching any of the known safe sources, comparing the URL to known malicious URLs; and

in response to the URL matching a respective one of the known malicious URLs, determining the status of the message as malicious;

in response to the URL not matching any of the known malicious URLs, compare the URL to known safe URLs;

in response to the URL matching a respective one of the known safe URLs, determine the status of the message as safe;

in response to the URL not matching any of the known safe URLs, analyze the URL for spelling errors; and

in response to identifying at least one spelling error in the URL, determine the status of the message as suspicious;

in response to identifying no spelling errors in the URL, determine a destination identified by the URL;

in response to determining that the destination identified by the URL is a file, determine a hash of the file;

compare the hash of the file to hashes of known malicious files; and

in response to the hash of the file matching a hash of one of the known malicious files, determine the status of the message as malicious; and

release the message to be displayed along with the status.

10. The non-transitory computer-readable medium of claim 9 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:

in response to the hash of the file not matching any of the hashes of known malicious files, analyze contents of the file for spelling errors;

in response to identifying at least one spelling error in the file, determine the status of the message as suspicious; and

in response to identifying no spelling errors in the file, determine the status of the message as safe.

11. The non-transitory computer-readable medium of claim 10 , wherein the instructions, when executed by the one or more processors, further cause the one or more processors to:

in response to determining that the destination identified by the URL is a webpage, analyze a source code of the webpage for malicious codes; and

in response to identifying at least one malicious code, determine the status of the message as malicious.

Assignments (1)

Continuity (1)

References Cited (23)