Systems and methods for uniquely identifying malicious advertisements

A computer-implemented method for uniquely identifying malicious advertisements, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

• identifying, by an endpoint protection application on an endpoint computing device, a browser advertisement received from a browser advertisement platform;
• extracting, by the endpoint protection application, a unique identifier from the browser advertisement, wherein the unique identifier is associated by the browser advertisement platform with the browser advertisement;
• detecting, by the endpoint protection application, malicious activity on the endpoint computing device, wherein the malicious activity is detected by an application programming interface (API), provided by the browser advertisement platform, the API comprising information for the endpoint computing device to detect the unique identifier, the information comprising identification information for a tag containing the unique identifier located within the browser advertisement, wherein the browser advertisement comprises multiple nested layers of tags representing multiple browser advertisement platforms including the browser advertisement platform;
• determining, by the endpoint protection application, that the browser advertisement is associated with the malicious activity on the endpoint computing device;
• and
• sending, by the endpoint protection application, a message to the browser advertisement platform that comprises the unique identifier of the browser advertisement detected using the API and that indicates that the browser advertisement was associated with the malicious activity on the endpoint computing device, wherein the browser advertisement platform, upon receiving the message from the endpoint protection application, prevents the browser advertisement from being transmitted to additional endpoint computing devices by removing the browser advertisement from a list of browser advertisements that are intended to be transmitted.

A system for uniquely identifying malicious advertisements, the system comprising:

• an association module, stored in memory, that associates, by a browser advertisement platform, a browser advertisement with a unique identifier for the browser advertisement;
• a transmission module, stored in memory, that transmits, by the browser advertisement platform, the browser advertisement to be displayed on at least one endpoint computing device in conjunction with the unique identifier;
• a receiving module, stored in memory, that receives, at the browser advertisement platform, a message from the endpoint computing device that comprises the unique identifier detected using an application programming interface (API) and that indicates that the browser advertisement was associated with malicious activity on the endpoint computing device;
• a security module, stored in memory, that performs, by the browser advertisement platform, a security action on the browser advertisement in response to the message indicating that the browser advertisement with the unique identifier was associated with the malicious activity, wherein the security action comprises preventing the browser advertisement from being transmitted to additional endpoint computing devices by removing the browser advertisement from a list of browser advertisements that are intended to be transmitted, wherein the security module provides, by the browser advertisement platform, the AP comprising information for the endpoint computing device to detect the unique identifier, the information comprising identification information for a tag containing the unique identifier located within the browser advertisement, wherein the browser advertisement comprises multiple nested layers of tags representing multiple browser advertisement platforms including the browser advertisement platform;
• and
• at least one physical processor configured to execute the association module, the transmission module, the receiving module, and the security module.

A system for uniquely identifying malicious advertisements, the system comprising:

• an identification module, stored in memory, that identifies, by an endpoint protection application on an endpoint computing device, a browser advertisement received from a browser advertisement platform;
• an extraction module, stored in memory, that extracts, by the endpoint protection application, a unique identifier from the browser advertisement, wherein the unique identifier is associated by the browser advertisement platform with the browser advertisement;
• a detection module, stored in memory, that detects, by the endpoint protection application, malicious activity on the endpoint computing device, wherein the malicious activity is detected by an application programming interface (API), provided by the browser advertisement platform, the API comprising information for the endpoint computing device to detect the unique identifier, the information comprising identification information for a tag containing the unique identifier located within the browser advertisement, wherein the browser advertisement comprises multiple nested layers of tags representing multiple browser advertisement platforms including the browser advertisement platform;
• a determination module, stored in memory, that determines, by the endpoint protection application, that the browser advertisement is associated with the malicious activity on the endpoint computing device;
• a sending module, stored in memory, that sends, by the endpoint protection application, a message to the browser advertisement platform that comprises the unique identifier of the browser advertisement detected using the API and that indicates that the browser advertisement was associated with the malicious activity on the endpoint computing device, wherein the browser advertisement platform, upon receiving the message from the endpoint protection application, prevents the browser advertisement from being transmitted to additional endpoint computing devices by removing the browser advertisement from a list of browser advertisements that are intended to be transmitted;
• and
• at least one physical processor configured to execute the identification module, the extraction module, the detection module, the determination module, and the sending module.