Systems and methods for risk rating and pro-actively detecting malicious online ads

A system comprising:

• an extraction module to extract a SWF file from a web page requested by a web browser communicatively coupled to the extraction module;
• an analysis engine communicatively coupled to the extraction module and configured to:
• determine a risk rating for the SWF file;
• and
• send the risk rating to the web browser for display within the web page;
• wherein determining the risk rating includes,
• locating an embedded redirection uniform resource locator (URL), and
• determining a risk rating for the embedded redirection URL;
• and
• a filter module to determine, based on the risk rating, whether to filter the SWF file and to send a warning to the browser for display within the web page.

A system comprising:

• a gateway server communicatively coupled to the Internet and an internal network, the gateway server including:
• an extraction module to extract a SWF file from a web page requested by a client on the internal network;
• an analysis engine to analyze the SWF file in order to locate an embedded redirection uniform resource locator (URL), wherein the SWF file originates from a different server than the requested web page;
• a risk rating module to determine a risk rating for the embedded redirection URL;
• and
• a filter module to determine, based on the risk rating, whether to filter the SWF file and send a warning and the risk rating within the web page requested by the client.

A system comprising:

• a client computer communicatively coupled to a network and running a web browser;
• an extraction module, running in conjunction to the web browser, to extract a SWF file from a web page accessed by the web browser;
• an analysis engine communicatively coupled to the extraction module and configured to:
• determine a risk rating for the SWF file;
• and
• send the risk rating to the web browser for display within the web page;
• wherein determining the risk rating includes,
• locating an embedded redirection uniform resource locator (URL), and determining a risk rating for the embedded redirection URL;
• and
• a filter module to block, based on the risk rating, the SWF file and to send a warning for display within the web page.

An article of manufacture including a machine-readable medium containing instructions that when executed on a computer system cause the computer system to perform a method, the method comprising:

• receiving a web page including a SWF file, the SWF file originating from a different server than the web page;
• extracting the SWF file from the web page;
• analyzing the SWF file to determine a risk rating for the SWF file, wherein analyzing includes locating an embedded redirection uniform resource locator (URL) and determining a risk rating for the embedded redirection URL;
• displaying, within the web page, the risk rating for the SWF file;
• and
• determining, based on the risk rating, whether to filter the SWF file.