US 11,381,596 B1Granted

Analyzing and mitigating website privacy issues by automatically classifying cookies

AssigneeNortonLifeLock Inc.

InventorsIskander Sanchez, Leylya Yumer

Life of this patent

Estimating the term…

Loading patent…

Abstract

Analyzing and mitigating website privacy issues by automatically classifying cookies. In some embodiments, a method may include identifying a cookie for a website, obtaining a cookie generation flow related to generation of the cookie, obtaining a cookie sharing flow related to sharing of the cookie, extracting features related to the cookie generation flow and the cookie sharing flow, determining flow patterns in the cookie generation flow and the cookie sharing flow, automatically creating a stratified classification for the cookie based on the features and the flow patterns that explains how the cookie interacts with a website and with third-party resources loaded on the website, determining whether the stratified classification for the cookie exceeds a weighted suspiciousness threshold value, and in response to determining that the stratified classification for the cookie exceeds the weighted suspiciousness threshold value, determining that the cookie is suspicious and initiating a security action on the cookie.

Claims18

Dependent claims

A computer-implemented method for analyzing and mitigating website privacy issues by automatically classifying cookies, at least a portion of the method being performed by a computing device comprising one or more processors, the method comprising:

identifying, by the computing device, a cookie for a website created on a web browser while browsing the website;
obtaining, by the computing device, a cookie generation flow related to generation of the cookie;
obtaining, by the computing device, a cookie sharing flow related to sharing of the cookie;
extracting, by the computing device, features related to the cookie generation flow and the cookie sharing flow;
determining, by the computing device, flow patterns in the cookie generation flow and the cookie sharing flow, including determining relationships between the cookie generation flow and the cookie sharing flow;
automatically creating, by the computing device, a stratified classification for the cookie, based on the features and the flow patterns, that explains how the cookie interacts with the website and with third-party resources loaded on the website;
determining, by the computing device, whether the stratified classification for the cookie exceeds a weighted suspiciousness threshold value;
and
in response to determining that the stratified classification for the cookie exceeds the weighted suspiciousness threshold value:
determining, by the computing device, that the cookie is suspicious;
and
initiating a security action on the suspicious cookie.

9 more elements

One or more non-transitory computer-readable media comprising one or more computer readable instructions that, when executed by one or more processors of a computing device, cause the computing device to perform a method for analyzing and mitigating website privacy issues by automatically classifying cookies, the method comprising:

identifying, by the computing device, a cookie for a website created on a web browser while browsing the website;
obtaining, by the computing device, a cookie generation flow related to generation of the cookie;
obtaining, by the computing device, a cookie sharing flow related to sharing of the cookie;
extracting, by the computing device, features related to the cookie generation flow and the cookie sharing flow;
determining, by the computing device, flow patterns in the cookie generation flow and the cookie sharing flow, including determining relationships between the cookie generation flow and the cookie sharing flow;
automatically creating, by the computing device, a stratified classification for the cookie, based on the features and the flow patterns, that explains how the cookie interacts with the website and with third-party resources loaded on the website;
determining, by the computing device, whether the stratified classification for the cookie exceeds a weighted suspiciousness threshold value;
and
in response to determining that the stratified classification for the cookie exceeds the weighted suspiciousness threshold value:
determining, by the computing device, that the cookie is suspicious;
and
initiating a security action on the suspicious cookie.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/712,081Filed 12 Dec 2019
Granted: 5 Jul 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic
H04L 63/1475
Countermeasures against malicious traffic: passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection