# US 11,444,967 B2 · Method and system for identifying malicious activity of pre-determined type

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,444,967 B2
- Document ID: US11444967B2
- Status: Granted
- Kind: B2
- Application number: 16/866,832
- Filed: 2020-05-05
- Published: 2021-03-11
- Granted: 2022-09-13
- Earliest claimed: 2019-09-05
- Assignees: Yandex Europe AG
- Applicants: Yandex Europe AG
- Inventors: Sergey Vyacheslavovich Statyev; Anton Olegovich Chigin
- Web page: https://patentgrep.com/patent/US11444967B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 16/215: Improving data quality; Data cleansing, e.g. de-duplication, removing invalid entries or correcting typographical errors
- G06F 16/957: Browsing optimisation, e.g. caching or content distillation
- G06F 16/986: {Document structures and storage, e.g. HTML extensions}
- G06Q 30/0185: {Product, service or business identity fraud}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 63/168: {above the transport layer}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

There is disclosed a method for identifying malicious activity of a pre-determined type. The method comprises acquiring, an indication of a plurality of web resources, each of the plurality of web resources being accessible via a communication network at a respective network address; analyzing, the plurality of web resources to identify a subset of web resources being candidates for being associated with the malicious activity; executing, an automated browser application, the automated browser application being configured to: access each of the web resources within the subset of web resources; and analyzing, by the server, a log associated with the automated browser application accessing each of the web resources, the log comprising an indication of a presence of a cookie unrelated to each of the web resources; determining, for a given web resource included within the subset of web resources, a presence of malicious activity based on the log.

## Claims

### Claim 1

A computer implemented method for identifying malicious activity of a pre-determined type, the pre-determined type being cookie-stuffing of a cookie, the method being executable by a server, the server being couplable to a web service and an electronic device, the cookie being associated with the web service, the method comprising:
acquiring, by the server, a navigational history from the electronic device, the navigational history comprising an indication of a plurality of web resources, each of the web resources in the plurality of web resources having been previously accessed by the electronic device;
in response to determining a presence of the cookie within a memory associated with the electronic device, the cookie having been acquired prior to accessing the web service, analyzing, by the server, the plurality of web resources to identify a subset of web resources being candidates for being associated with the malicious activity;
executing, by the server, an automated browser application, the automated browser application being configured to:
access each of the web resources within the subset of web resources; and
analyze, by the server, a log associated with the automated browser application accessing each of the web resources, the log comprising an indication of a presence of a cookie unrelated to each of the web resources; and
determine, for a given web resource included within the subset of web resources, a presence of malicious activity based on the log.

### Claim 2 (depends on 1)

The method of claim 1, wherein the acquiring the navigational history is executed in response to the electronic device executing a predetermined action associated with the web service.

### Claim 3 (depends on 2)

The method of claim 2, wherein the predetermined action is one of:
accessing the web service;
executing a transaction on the web service; and
exiting the web service.

### Claim 4 (depends on 1)

The method of claim 1, wherein the analyzing the plurality of web resources comprises at least one of:
removing duplicate web resources within the one or more web resources;
removing web resources having page views above a predetermined threshold.

### Claim 5 (depends on 1)

The method of claim 1, wherein the automated browser application has not accessed the web service and the cookie has been assigned by virtue of the visit to a given one of the web resources within the subset of web resources.

### Claim 6 (depends on 5)

The method of claim 5, wherein in response to the presence of the cookie within the log of the automated browser application, the method further comprises retrieving an HTML source code of a one of the plurality of web resources associated with the web service.

### Claim 7 (depends on 6)

The method of claim 6, wherein the determining the presence of the malicious activity comprises, analyzing the HTML source code to determine a presence of a pre-determined code pattern indicative of the malicious activity.

### Claim 8 (depends on 7)

The method of claim 7, wherein to determine the presence of the pre-determined code pattern comprises determining the presence of a cookie assigning trigger within a portion of the HTML source code.

### Claim 9 (depends on 8)

The method of claim 8, wherein the cookie assigning trigger corresponds to a uniform resource locator including a domain name of the web service and a user identification ID, the user identification ID associated with an affiliate entity in an affiliate relationship with the web service, the user identification ID causing the storing of the cookie within the log.

### Claim 10 (depends on 9)

The method of claim 9, wherein the portion of the HTML source code corresponds to an HTML image tag within the HTML source code.

### Claim 11 (depends on 9)

The method of claim 9, wherein the portion of the HTML source code corresponds to an HTML iframe tag within the HTML source code.

### Claim 12 (depends on 9)

The method of claim 9, wherein in response to determining the presence of the malicious activity, the method further comprises:
executing, by the server, a restrictive action against the affiliate entity.

### Claim 13 (depends on 12)

The method of claim 12, wherein the restrictive action is one of:
temporarily suspending the affiliate relationship with the affiliate entity;
removing the affiliate relationship with the affiliate entity.

### Claim 14 (depends on 1)

The method of claim 1, wherein the web service is an online marketplace web resource.

### Claim 15 (depends on 6)

The method of claim 6, wherein the HTML, source code is retrieved from the log.

### Claim 16

A hardware server for identifying malicious activity of a pre-determined type, the pre-determined type being cookie-stuffing of a cookie, the hardware server being couplable to a web service and an electronic device, the cookie being associated with the web service, the hardware server comprising a hardware processor configured to:
acquire a navigational history from the electronic device, the navigational history comprising an indication of a plurality of web resources, each of the web resources in the plurality of web resources having been previously accessed by the electronic device;
in response to determining a presence of the cookie within a memory associated with the electronic device, the cookie having been acquired prior to accessing the web service, analyze, the plurality of web resources to identify a subset of web resources being candidates for being associated with the malicious activity;
execute, an automated browser application, the automated browser application being configured to:
access each of the web resources within the subset of web resources; and
analyze a log associated with the automated browser application accessing each of the web resources, the log comprising an indication of a presence of a cookie unrelated to each of the web resources; and
determine for a given web resource included within the subset of web resources, a presence of malicious activity based on the log.