Systems and methods for proactive analysis of artifacts associated with information resources
AssigneeMimecast Services Ltd.
InventorsLee Haworth, Simon Paul Tyler, Jackie Anne Maylor, Nathaniel S. Borenstein
Life of this patent
Estimating the term…
Abstract
The invention is related to security systems and methods for proactively informing a user about an artifact associated with a clickable object on a user interface with which the user is interacting, where such information is provided to the user prior to selection of the clickable object. The information includes a safety assessment of the clickable object, details about the underlying artifact, such as the contents of an archive file, and general information helpful in assisting the user with making a decision as to whether to select the clickable object.
Claims25
A system for proactively providing a user with an assessment of an information resource in advance of user selection of the information resource, the system comprising:
- at least one processor coupled to at least one memory containing instructions executable by the at least one processor to cause the system to:
- monitor user interaction with a user interface of a computing device displaying content;
- detect user input comprising positioning of a selection input proximate to a visual representation of an information resource for a predetermined amount of time;
- analyze contents of the information resource associated with the user input in advance of user selection of the visual representation of the information resource to determine if the information resource contains potentially harmful material;
- and
- output to the user, via the user interface, an assessment of the contents of the information resource based on the analysis in advance of user selection of the visual representation of the information resource.
A method for proactively providing a user with an assessment of an information resource in advance of user selection of the information resource, the method comprising:
- monitoring user interaction with a user interface of a computing device displaying content;
- detecting user input comprising positioning of a selection input proximate to a visual representation of an information resource for a predetermined amount of time;
- analyzing contents of the information resource associated with the user input in advance of user selection of the visual representation of the information resource to determine if the information resource contains potentially harmful material;
- and
- outputting to the user, via the user interface, an assessment of the contents of the information resource based on the analysis in advance of user selection of the visual representation of the information resource.
A method for proactively providing a user with information associated with an information resource in advance of user selection and viewing of the information resource, the method comprising:
- monitoring user interaction with a user interface of a computing device displaying content;
- detecting a hover event corresponding to user input with the user interface, the user input comprising positioning of a selection input proximate to a visual representation of an information resource for a predetermined period of time;
- analyzing one or more underlying artifacts associated with the information resource;
- and
- outputting to the user, via the user interface, information associated with the information resource based on the analysis of the one or more underlying artifacts,
- wherein the visual representation of the information resource is a selectable object associated with a domain;
- and
- wherein analyzing the one or more underlying artifacts associated with the information resource comprises analyzing the domain associated with the selectable object, such analyzing comprising:
- comparing the domain with a plurality of trusted domains;
- correlating metadata of the domain with metadata of at least one trusted domain if the domain is determined to be similar to at least one of the trusted domains;
- and
- flagging the domain as being legitimate or flagging the domain as being illegitimate based on the correlation, wherein the domain is flagged as being legitimate based on a positive correlation and the domain is flagged as being illegitimate based on a negative correlation.
Dependencies are inferred from the claim text.