Detecting an intrusive landing page

A method comprising:

• identifying a landing page associated with sponsored content;
• identifying intrusion features of the landing page;
• generating a feature score for the landing page based on the identified intrusion features;
• determining that the feature score for the landing page exceeds a feature threshold;
• classifying the landing rage as a candidate landing page when the feature score for the landing page exceeds the feature threshold;
• submitting the candidate landing page to an intrusion detection engine;
• receiving an intrusion score for the candidate landing page from the intrusion detection engine;
• precluding serving of the sponsored content associated with the candidate landing page when the intrusion score exceeds an intrusion threshold;
• and
• receiving an appeal request and in response to receiving the appeal request:
• re-submitting the candidate landing page to the intrusion detection engine;
• receiving another intrusion score for the candidate landing page from the intrusion detection engine;
• precluding the serving of the sponsored content associated with the candidate landing page when the other intrusion score exceeds the intrusion threshold;
• and
• allowing the serving of the sponsored content associated with the candidate landing page when the another intrusion score does not exceed the intrusion threshold.

A system, comprising:

• a scoring engine comprising software instructions stored in computer readable medium and executable by a processing system, and upon such execution causes the processing system to:
• identify a landing page associated with sponsored content;
• identify malware intrusion features of the landing page, the malware intrusion features being characterized by one or more redirects, in response to an input to access the sponsored content, to an exploit server that is different from a server serving the sponsored content;
• generate a feature score for the landing page based on the identified malware intrusion features;
• determine that the feature score for the landing page exceeds a feature threshold;
• classify the landing page as a candidate landing page when the feature score for the landing page exceeds the feature threshold;
• and
• a malware evaluation engine comprising software instructions stored in computer readable medium and executable by a processing system, and upon such execution causes the processing system to:
• submit the candidate landing page to an intrusion detection engine;
• receive an intrusion score for the candidate landing page from the intrusion detection engine;
• and
• preclude the serving of the sponsored content associated with the candidate landing page when the intrusion score exceeds an intrusion threshold.

A system comprising:

• a malware evaluation engine comprising software instructions stored in computer readable medium and executable by a processing system, and upon such execution causes the processing system to:
• submit a candidate landing page to an intrusion detection engine, the candidate landing page associated with sponsored content;
• receive an intrusion score for the candidate landing page from the intrusion detection engine;
• and
• preclude serving of the sponsored content associated with the candidate landing page when the intrusion score of the candidate landing page exceeds an intrusion threshold;
• and
• an appeal processing evaluation engine comprising software instructions stored in computer readable medium and executable by the processing system, and upon such execution causes the processing system to:
• receive an appeal request for a sponsor account associated with the candidate landing page and in response to the appeal request cause the malware evaluation engine to:
• re-submit the candidate landing page to the intrusion detection engine;
• receive another intrusion score for the candidate landing page from the intrusion detection engine;
• preclude serving of the sponsored content associated with the candidate landing page when the another intrusion score exceeds the intrusion threshold;
• and
• allow serving of the sponsored content associated with the candidate landing page when the another intrusion score does not exceed the intrusion threshold.

A method, comprising:

• identifying a landing page associated with sponsored content;
• identifying malware intrusion features of the landing page, the malware intrusion features being characterized by one or more redirects, in response to an input to access the sponsored content, to an exploit server that is different from a server serving the sponsored content;
• evaluating the landing page to determine that a likelihood that the landing page includes malware exceeds a first threshold based on a presence of the malware intrusion features;
• when the likelihood that the landing page includes malware exceeds the first threshold, further evaluating the landing page, the further evaluating including performing at least one additional evaluation process on the landing page;
• and
• based on the further evaluation, classifying the landing page as one of including malware or not including malware.

A computer program product tangibly stored on a storage device, operable to cause data processing apparatus to perform operations comprising:

• identifying a landing page associated with sponsored content;
• identifying malware intrusion features of the landing page, the malware intrusion features being characterized by one or more redirects, in response to an input to access the sponsored content, to an exploit server that is different from a server serving the sponsored content;
• generating a feature score for the landing page based on the identified malware intrusion features;
• determining that the feature score for the landing page exceeds a feature threshold;
• classifying the landing page as a candidate landing page when the feature score for the landing page exceeds the feature threshold;
• submitting the candidate landing page to an intrusion detection engine;
• receiving an intrusion score for the candidate landing page from the intrusion detection engine;
• and
• precluding the serving of the sponsored content associated with the candidate landing page when the intrusion score exceeds an intrusion threshold.