Neutralizing malicious locators
AssigneeRapid7, Inc.
InventorsRoy Hodgman, Aditya Kuppa, Suchin Gururangan, Andrew Reece
Life of this patent
Estimating the term…
Abstract
Methods and systems for neutralizing malicious locators. Threat actors may shut down their web pages or applications (i.e., resources) that serve malicious content upon receiving request(s) configured to be perceived by the resource as non-browser requests. Therefore, initiating (large-scale) non-browser requests, or requests that are at least perceived as non-browser requests, may effectively act to inhibit, or even nullify, intended attack vectors.
Claims15
A method for neutralizing at least one malicious locator accessible through a network, the method comprising:
- identifying, through a computer interface within a computing device comprising a non-transitory computer-readable medium that is not a transitory signal, a locator referring to a location of a potentially malicious network-accessible resource;
- requesting content from the locator via a program that at least appears to be a non-browser program until the potentially malicious network-accessible resource discontinues serving content;
- and
- issuing an alert to inform an end-user that the potentially malicious network-accessible resource has discontinued serving content or adding the locator to a list of malicious network locations.
A system for neutralizing at least one malicious locator accessible through a network, the system comprising:
- an interface to a computer-readable medium that is not a signal;
- a network interface;
- and
- a hardware processor in communication with the computer-readable medium and the network interface, the hardware processor configured to:
- identify a locator referring to a location of a potentially malicious network-accessible resource,
- request content from the locator via a program that at least appears to be a non-browser program until the potentially malicious network-accessible resource discontinues serving content, and
- issue an alert to inform an end-user that the potentially malicious network-accessible resource has discontinued serving content or adding the locator to a list of malicious network locations.
The system of 9 wherein the program is a non-browser program exclusively and is configured to selectively use a browser-based application user agent string to not be detected.
A non-transitory computer readable medium containing computer-executable instructions for performing a method for neutralizing at least one malicious locator accessible through a network, the method comprising:
- computer-executable instructions for identifying, through a computer interface within a computing device comprising a non-transitory computer-readable medium that is not a transitory signal, a locator referring to a location of a potentially malicious network-accessible resource;
- computer-executable instructions for requesting content from the locator via a program that at least appears to be a non-browser program until the potentially malicious network-accessible resource discontinues serving content;
- and computer-executable instructions for issuing an alert to inform an end-user that the potentially malicious network-accessible resource has discontinued serving content or adding the locator to a list of malicious network locations.
Dependencies are inferred from the claim text.