# US 2019/0171817 A1 · Proactive browser content analysis

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0171817 A1
- Document ID: US20190171817A1
- Status: Published application
- Kind: A1
- Application number: 16/036,022
- Filed: 2018-07-16
- Published: 2019-06-06
- Earliest claimed: 2011-10-03
- Assignees: Webroot Inc.
- Applicants: Webroot Inc.
- Inventors: Joe Jaroch; Harry Murphey McCloy, III; Robert Edward Adams
- Web page: https://patentgrep.com/patent/US20190171817A1

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A protection module operates to analyze threats, at the protocol level (e.g., at the HTML level), by intercepting all requests that a browser engine resident in a computing device sends and receives, and the protection agent completes the requests without the help of the browser engine. And then the protection module analyzes and/or modifies the completed data before the browser engine has access to it, to, for example, display it. After performing all of its processing, removing, and/or adding any code as needed, the protection module provides the HTML content to the browser engine, and the browser engine receives responses from the protection agent as if it was speaking to an actual web server, when in fact, browser engine is speaking to an analysis engine of the protection module.

## Claims

### Claim 1

A content analysis and malware prevention method comprising:
receiving web content from one or more web servers;
performing one or more of analyzing and modifying of the web content;
modifying, by a processor, any content identified as malware; and
providing the web content to a web browser application for rendering and display.

### Claim 2 (depends on 1)

The method of claim 1, further comprising a receiving a request for web content from the web browser application.

### Claim 3 (depends on 1)

The method of claim 1, further comprising supplementing the web content with indicators regarding a vulnerability of one or more links within the web content.

### Claim 4 (depends on 1)

The method of claim 1, wherein the analysis of the web content includes include one or more of URL (Uniform Resource Locator) analysis, IP (Internet Protocol) analysis, image analysis, and script/HTML analysis.

### Claim 5 (depends on 1)

The method of claim 1, further comprising determining whether a request for the web content from the web browser application is a first request.

### Claim 6 (depends on 1)

The method of claim 1, further comprising performing one or more of pre-process data decryption, de-chinking and decompressing.

### Claim 7 (depends on 1)

The method of claim 1, wherein the analysis is a protocol-level analysis.

### Claim 8 (depends on 1)

The method of claim 1, further comprising assembling a modified version of the web content and providing the modified version of the web content to the web browser application.

### Claim 9 (depends on 1)

The method of claim 1, further comprising performing cloud verification of the web content.

### Claim 10 (depends on 1)

The method of claim 1, further comprising allocating memory for caching of the web content.

### Claim 11

A content analysis and malware prevention system comprising:
a protection agent and processor that:
receive web content from one or more web servers;
perform one or more of analysis and modification of the web content;
modify any content identified as malware; and
provide the web content to a web browser application for rendering and display.

### Claim 12 (depends on 11)

The system of claim 11, wherein a request for web content is received from the web browser application.

### Claim 13 (depends on 11)

The system of claim 11, wherein the protection agent further supplements the web content with indicators regarding a vulnerability of one or more links within the web content.

### Claim 14 (depends on 11)

The system of claim 11, wherein the analysis of the web content includes include one or more of URL (Uniform Resource Locator) analysis, IP (Internet Protocol) analysis, image analysis, and script/HTML analysis.

### Claim 15 (depends on 11)

The system of claim 11, wherein the protection agent further determines whether a request for the web content from the web browser application is a first request.

### Claim 16 (depends on 11)

The system of claim 11, wherein the protection agent further performs one or more of pre-process data decryption, de-chinking and decompressing.

### Claim 17 (depends on 11)

The system of claim 11, wherein the analysis is a protocol-level analysis.

### Claim 18 (depends on 11)

The system of claim 11, further comprising a browser engine that receives a modified version of the web content and provides the modified version of the web content to the web browser application.

### Claim 19 (depends on 11)

The system of claim 11, further comprising a security center that performs cloud verification of the web content.

### Claim 20 (depends on 11)

The system of claim 11, wherein memory for caching of the web content is allocated by the protection agent.