# US 10,320,816 B1 · Systems and methods for uniquely identifying malicious advertisements

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,320,816 B1
- Document ID: US10320816B1
- Status: Granted
- Kind: B1
- Application number: 15/185,104
- Filed: 2016-06-17
- Granted: 2019-06-11
- Earliest claimed: 2016-06-17
- Assignees: Symantec Corporation
- Applicants: Symantec Corporation
- Inventors: Spencer Smith
- Web page: https://patentgrep.com/patent/US10320816B1

## CPC

- G06F 16/951: Indexing; Web crawling techniques
- G06F 21/562: {Static detection}
- G06Q 30/0277: {Online advertisement}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 63/168: {above the transport layer}
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06F 2221/2115: Third party
- G06Q 30/0241: Advertisements
- G06Q 30/0248: {Avoiding fraud}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The disclosed computer-implemented method for uniquely identifying malicious advertisements may include (1) associating, by a browser advertisement platform, a browser advertisement with a unique identifier for the browser advertisement, (2) transmitting, by the browser advertisement platform, the browser advertisement to be displayed on at least one endpoint computing device in conjunction with the unique identifier, (3) receiving, at the browser advertisement platform, a message from the endpoint computing device that includes the unique identifier and that indicates that the browser advertisement was associated with malicious activity on the endpoint computing device, and (4) performing, by the browser advertisement platform, a security action on the browser advertisement in response to the message indicating that the browser advertisement with the unique identifier was associated with the malicious activity. Various other methods, systems, and computer-readable media are also disclosed.

## Claims

### Claim 1

A computer-implemented method for uniquely identifying malicious advertisements, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
associating, by a browser advertisement platform, a browser advertisement with a unique identifier for the browser advertisement;
transmitting, by the browser advertisement platform, the browser advertisement to be displayed on at least one endpoint computing device in conjunction with the unique identifier;
providing, by the browser advertisement platform, an application programming interface (API) comprising information for the endpoint computing device to detect the unique identifier, the information comprising identification information for a tag containing the unique identifier located within the browser advertisement, wherein the browser advertisement comprises multiple nested layers of tags representing multiple browser advertisement platforms including the browser advertisement platform;
receiving, at the browser advertisement platform, a message from the endpoint computing device that comprises the unique identifier detected using the API and that indicates that the browser advertisement was associated with malicious activity on the endpoint computing device; and
performing, by the browser advertisement platform, a security action on the browser advertisement in response to the message indicating that the browser advertisement with the unique identifier was associated with the malicious activity, wherein the security action comprises preventing the browser advertisement from being transmitted to additional endpoint computing devices by removing the browser advertisement from a list of browser advertisements that are intended to be transmitted.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein receiving the message from the endpoint computing device comprises receiving a message from an endpoint protection application on the endpoint computing device that determined that the browser advertisement was associated with the malicious activity.

### Claim 3 (depends on 2)

The computer-implemented method of claim 2, wherein performing the security action comprises sending information about the browser advertisement to a security vendor that distributes the endpoint protection application.

### Claim 4 (depends on 2)

The computer-implemented method of claim 2, wherein the message comprises an identifier of the endpoint protection application.

### Claim 5 (depends on 1)

The computer-implemented method of claim 1, wherein transmitting the browser advertisement to be displayed on the at least one endpoint computing device in conjunction with the unique identifier comprises transmitting a unique identifier of the browser advertisement platform in conjunction with the browser advertisement.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, wherein the identification information is intended to enable security applications to detect the unique identifier.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1, further comprising receiving, at the browser advertisement platform, from a gateway device that transmitted the browser advertisement to the computing device, an additional message that comprises the unique identifier and that indicates that the browser advertisement is potentially malicious.

### Claim 8 (depends on 1)

The computer-implemented method of claim 1, wherein transmitting the browser advertisement to be displayed on the at least one endpoint computing device in conjunction with the unique identifier comprises transmitting computer-readable code that comprises the browser advertisement and the tag containing the unique identifier.

### Claim 9 (depends on 1)

The computer-implemented method of claim 1, further comprising receiving, at the browser advertisement platform, an additional message from the endpoint computing device that comprises the unique identifier and that comprises additional information about how the browser advertisement interacted with the computing device.

### Claim 10

A computer-implemented method for uniquely identifying malicious advertisements, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying, by an endpoint protection application on an endpoint computing device, a browser advertisement received from a browser advertisement platform;
extracting, by the endpoint protection application, a unique identifier from the browser advertisement, wherein the unique identifier is associated by the browser advertisement platform with the browser advertisement;
detecting, by the endpoint protection application, malicious activity on the endpoint computing device, wherein the malicious activity is detected by an application programming interface (API), provided by the browser advertisement platform, the API comprising information for the endpoint computing device to detect the unique identifier, the information comprising identification information for a tag containing the unique identifier located within the browser advertisement, wherein the browser advertisement comprises multiple nested layers of tags representing multiple browser advertisement platforms including the browser advertisement platform;
determining, by the endpoint protection application, that the browser advertisement is associated with the malicious activity on the endpoint computing device; and
sending, by the endpoint protection application, a message to the browser advertisement platform that comprises the unique identifier of the browser advertisement detected using the API and that indicates that the browser advertisement was associated with the malicious activity on the endpoint computing device, wherein the browser advertisement platform, upon receiving the message from the endpoint protection application, prevents the browser advertisement from being transmitted to additional endpoint computing devices by removing the browser advertisement from a list of browser advertisements that are intended to be transmitted.

### Claim 11 (depends on 10)

The computer-implemented method of claim 10, wherein extracting the unique identifier from the browser advertisement comprises:
identifying the API provided by the browser advertisement platform; and
querying the API provided by the browser advertisement platform to determine the location of the unique identifier within the browser advertisement.

### Claim 12 (depends on 10)

The computer-implemented method of claim 10, wherein sending the message to the browser advertisement platform comprises:
identifying the API provided by the browser advertisement platform;
querying the API with the unique identifier to determine whether the browser advertisement was served by the browser advertisement platform; and
sending the message to the browser advertisement platform in response to determining that the browser advertisement was served by the browser advertisement platform.

### Claim 13

A system for uniquely identifying malicious advertisements, the system comprising:
an association module, stored in memory, that associates, by a browser advertisement platform, a browser advertisement with a unique identifier for the browser advertisement;
a transmission module, stored in memory, that transmits, by the browser advertisement platform, the browser advertisement to be displayed on at least one endpoint computing device in conjunction with the unique identifier;
a receiving module, stored in memory, that receives, at the browser advertisement platform, a message from the endpoint computing device that comprises the unique identifier detected using an application programming interface (API) and that indicates that the browser advertisement was associated with malicious activity on the endpoint computing device;
a security module, stored in memory, that performs, by the browser advertisement platform, a security action on the browser advertisement in response to the message indicating that the browser advertisement with the unique identifier was associated with the malicious activity, wherein the security action comprises preventing the browser advertisement from being transmitted to additional endpoint computing devices by removing the browser advertisement from a list of browser advertisements that are intended to be transmitted, wherein the security module provides, by the browser advertisement platform, the AP comprising information for the endpoint computing device to detect the unique identifier, the information comprising identification information for a tag containing the unique identifier located within the browser advertisement, wherein the browser advertisement comprises multiple nested layers of tags representing multiple browser advertisement platforms including the browser advertisement platform; and
at least one physical processor configured to execute the association module, the transmission module, the receiving module, and the security module.

### Claim 14 (depends on 13)

The system of claim 13, wherein the receiving module receives the message from the endpoint computing device by receiving a message from an endpoint protection application on the endpoint computing device that determined that the browser advertisement was associated with the malicious activity.

### Claim 15 (depends on 13)

The system of claim 13, wherein the security module performs the security action by sending information about the browser advertisement to a security vendor that distributes an endpoint protection application.

### Claim 16 (depends on 13)

The system of claim 13, wherein the transmission module transmits the browser advertisement to be displayed on the at least one endpoint computing device in conjunction with the unique identifier by transmitting a unique identifier of the browser advertisement platform in conjunction with the browser advertisement.

### Claim 17 (depends on 13)

The system of claim 13, wherein the identification information is intended to enable security applications to detect the unique identifier.

### Claim 18 (depends on 13)

The system of claim 13, wherein the receiving module receives, at the browser advertisement platform, from a gateway device that transmitted the browser advertisement to be displayed on the at least one endpoint computing device, an additional message that comprises the unique identifier and that indicates that the browser advertisement is potentially malicious.

### Claim 19

A system for uniquely identifying malicious advertisements, the system comprising:
an identification module, stored in memory, that identifies, by an endpoint protection application on an endpoint computing device, a browser advertisement received from a browser advertisement platform;
an extraction module, stored in memory, that extracts, by the endpoint protection application, a unique identifier from the browser advertisement, wherein the unique identifier is associated by the browser advertisement platform with the browser advertisement;
a detection module, stored in memory, that detects, by the endpoint protection application, malicious activity on the endpoint computing device, wherein the malicious activity is detected by an application programming interface (API), provided by the browser advertisement platform, the API comprising information for the endpoint computing device to detect the unique identifier, the information comprising identification information for a tag containing the unique identifier located within the browser advertisement, wherein the browser advertisement comprises multiple nested layers of tags representing multiple browser advertisement platforms including the browser advertisement platform;
a determination module, stored in memory, that determines, by the endpoint protection application, that the browser advertisement is associated with the malicious activity on the endpoint computing device;
a sending module, stored in memory, that sends, by the endpoint protection application, a message to the browser advertisement platform that comprises the unique identifier of the browser advertisement detected using the API and that indicates that the browser advertisement was associated with the malicious activity on the endpoint computing device, wherein the browser advertisement platform, upon receiving the message from the endpoint protection application, prevents the browser advertisement from being transmitted to additional endpoint computing devices by removing the browser advertisement from a list of browser advertisements that are intended to be transmitted; and
at least one physical processor configured to execute the identification module, the extraction module, the detection module, the determination module, and the sending module.

### Claim 20 (depends on 1)

The computer-implemented method of claim 1, wherein the security action further comprises removing other browser advertisements from a same source associated with the browser advertisement with the unique identifier.

### Claim 21 (depends on 13)

The system of claim 13, wherein the security action further comprises removing other browser advertisements from a same source associated with the browser advertisement with the unique identifier.