# US 11,310,278 B2 · Breached website detection and notification

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,310,278 B2
- Document ID: US11310278B2
- Status: Granted
- Kind: B2
- Application number: 16/358,373
- Filed: 2019-03-19
- Published: 2020-09-24
- Granted: 2022-04-19
- Earliest claimed: 2019-03-19
- Assignees: Fortinet, Inc.
- Applicants: Fortinet, Inc.
- Inventors: Sameer Kumar Vasanthapuram
- Web page: https://patentgrep.com/patent/US11310278B2

## CPC

- G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
- G06F 16/953: Querying, e.g. by the use of web search engines
- G06F 16/955: using information identifiers, e.g. uniform resource locators [URL]
- G06F 21/554: {involving event detection and direct action}
- H04L 61/4511: using domain name system [DNS]
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/126: {the source of the received data}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/1433: {Vulnerability analysis}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

System and methods for a cloud-based approach to breached website detection and notification as a security service are provided. According to one embodiment, a network security device protecting a private network of an enterprise, intercepts information associated with an interaction with a website by a browser of a client device associated with the private network. The network security device, based on the information, proactively determines whether the website or a domain with which the website is associated has been reported as having been breached by querying a cloud-based security service that actively maintains a list of breached websites. In response to the determining being affirmative, the network security device notifies the user regarding an occurrence of a security breach involving the domain or the website by issuing a replacement Hypertext Transfer Protocol (HTTP) response message to the browser.

## Claims

### Claim 1

A method comprising:
intercepting, by a network security device protecting a private network of an enterprise, information associated with an interaction with a website by a browser of a client device associated with the private network;
based on the information, proactively determining, by the network security device, whether the website or a domain with which the website is associated has been a subject of a security breach by querying a cloud-based security service that actively maintains a list of breached websites; and
when said determining is affirmative, then causing, by the network security device, the user to be notified regarding the security breach involving the domain or the website by issuing a replacement Hypertext Transfer Protocol (HTTP) response message to the browser;
monitoring, by an endpoint security solution running on the client device, inputs by the user on login portals of public websites;
precluding the user from reusing passwords across public and intranet domains by comparing, by the endpoint security solution, the inputs to one or more user passwords for enterprise accounts of the user;
when said comparing results in detection of a match between a password for a particular public website and a password of a particular enterprise service, then:
causing, by the network security device, the user to reset the password for the particular public website by causing the browser to be redirected to a password change portal associated with the public website; and
causing, by the network security device, the user to reset the password for the particular enterprise service by causing the browser to be redirected to a password portal associated with the particular enterprise service.

### Claim 2 (depends on 1)

The method of claim 1, wherein the list of breached websites contains information regarding domains and websites for which confidential information of users has been exposed.

### Claim 3 (depends on 1)

The method of claim 1, wherein said intercepting is as a result of Domain Name System (DNS) based filtering or web filtering performed by the network security device.

### Claim 4 (depends on 1)

The method of claim 1, further comprising prior to said querying, parsing, by the network security device, the information to extract one or more of a Uniform Resource Locator (URL) associated with the website or a Common Name contained within a Secure Socket Layer (SSL) certificate of the website.

### Claim 5 (depends on 1)

The method of claim 1, further comprising causing, by the network security device, the user to reset passwords of their enterprise accounts by causing the browser to be redirected to a password portal associated with the enterprise.

### Claim 6

A network security system comprising:
a non-transitory storage device having embodied therein one or more routines operable to alert a user of a client device associated with a private network of an enterprise of security breaches relating to websites the user visits; and
one or more processors coupled to the non-transitory storage device and operable to execute the one or more routines to perform a method comprising:
intercepting, by a network security device protecting the private network, information associated with an interaction with a website by a browser of the client device;
based on the information, proactively determining, by the network security device, whether the website or a domain with which the website is associated has been a subject of a security breach by querying a cloud-based security service that actively maintains a list of breached websites; and
when said determining is affirmative, then causing, by the network security device, the user to be notified regarding the security breach involving the domain or the website by issuing a replacement Hypertext Transfer Protocol (HTTP) response message to the browser;
monitoring, by an endpoint security solution running on the client device, inputs by the user on login portals of public websites;
precluding the user from reusing passwords across public and intranet domains by comparing, by the endpoint security solution, the inputs to one or more user passwords for enterprise accounts of the user;
when said comparing results in detection of a match between a password for a particular public website and a password of a particular enterprise service, then:
causing, by the network security device, the user to reset the password for the particular public website by causing the browser to be redirected to a password change portal associated with the public website; and
causing, by the network security device, the user to reset the password for the particular enterprise service by causing the browser to be redirected to a password portal associated with the particular enterprise service.

### Claim 7 (depends on 6)

The network security system of claim 6, wherein the list of breached websites contains information regarding domains and websites for which confidential information of users has been exposed.

### Claim 8 (depends on 6)

The network security system of claim 6, wherein said intercepting is as a result of Domain Name System (DNS) based filtering or web filtering performed by the network security device.

### Claim 9 (depends on 6)

The network security system of claim 6, wherein the method further comprises prior to said querying, parsing, by the network security device, the information to extract one or more of a Uniform Resource Locator (URL) associated with the website or a Common Name contained within a Secure Socket Layer (SSL) certificate of the website.

### Claim 10 (depends on 6)

The network security system of claim 6, wherein the method further comprises causing, by the network security device, the user to reset passwords of their enterprise accounts by causing the browser to be redirected to a password portal associated with the enterprise.

### Claim 11

A non-transitory media strong computer-readable source code that, when executed by a processor, performs a method comprising:
intercepting, by a network security device protecting a private network of an enterprise, information associated with an interaction with a website by a browser of a client device associated with the private network;
based on the information, proactively determining, by the network security device, whether the website or a domain with which the website is associated has been a subject of a security breach by querying a cloud-based security service that actively maintains a list of breached websites; and
when said determining is affirmative, then causing, by the network security device, the user to be notified regarding the security breach involving the domain or the website by issuing a replacement Hypertext Transfer Protocol (HTTP) response message to the browser;
monitoring, by an endpoint security solution running on the client device, inputs by the user on login portals of public websites;
precluding the user from reusing passwords across public and intranet domains by comparing, by the endpoint security solution, the inputs to one or more user passwords for enterprise accounts of the user;
when said comparing results in detection of a match between a password for a particular public website and a password of a particular enterprise service, then:
causing, by the network security device, the user to reset the password for the particular public website by causing the browser to be redirected to a password change portal associated with the public website; and
causing, by the network security device, the user to reset the password for the particular enterprise service by causing the browser to be redirected to a password portal associated with the particular enterprise service.