Threat protection in documents
AssigneeMicrosoft Technology Licensing, LLC
InventorsVaragur Karthikeyan Sriram IYER, Willson Kulandai Raj DAVID, Vinayak GOYAL, Matthew Bryan JEFFRIES
Life of this patent
Estimating the term…
Abstract
A threat protection system provides for detecting links in a document and analyzing whether one of the detected links is a malicious link that may direct a user of the document to a malicious universal resource locator (URL). In one implementation of the described technology, when a user selects a link in a document, a link activation module calls a threat protection client module that performs a reputation check for the link. If the selected link is malicious, the threat protection client module sends a URL of a warning page to the link activation module.
Claims20
A method for providing threat protection in documents, the method comprising:
- determining that a link in a document is selected, wherein the document is received as an attachment to an email at a machine with a work identity;
- in response to determining that a link in a document is selected, calling a threat protection client module with the selected link;
- and
- in response to receiving an indication from the threat protection client module that the selected link is directed to a malicious uniform resource locator (URL), sending a URL of a warning page to the document.
A method comprising:
- analyzing a document to generate a batch of links in the document, wherein the document is received at a computer as an attachment to an incoming message and is opened using a software that is associated with the work identity;
- calling a threat protection client module with the batch of links;
- and
- receiving the batch of links with their associated URLs, wherein one or more links of the batch of links directed to a malicious URL are associated with a URL of a warning page.
A physical article of manufacture including one or more tangible computer-readable storage media, encoding computer-executable instructions for executing on a computer system a computer process, the computer process comprising:
- determining that a link in a document is selected, wherein the document is received as an attachment to an incoming message and opened on a machine with a work identity using a software that is associated with the work identity;
- in response to determining that a link in a document is selected, calling a threat protection client module with the selected link;
- and
- in response to receiving an indication from the threat protection client module that the selected link is directed to a malicious URL, sending a URL of a warning page to the document.
Dependencies are inferred from the claim text.