# US 8,544,090 B1 · Systems and methods for detecting a potentially malicious uniform resource locator

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,544,090 B1
- Document ID: US8544090B1
- Status: Granted
- Kind: B1
- Application number: 13/011,077
- Filed: 2011-01-21
- Granted: 2013-09-24
- Earliest claimed: 2011-01-21
- Assignees: Symantec Corporation
- Applicants: Joseph Huaning Chen
- Inventors: Joseph Huaning Chen
- Web page: https://patentgrep.com/patent/US8544090B1

## CPC

- H04L 63/14: {for detecting or protecting against malicious traffic}
- G06F 11/00: Error detection; Error correction; Monitoring (error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00)
- G06F 11/30: Monitoring
- H04L 63/168: {above the transport layer}
- G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A computer-implemented method to detect a potentially malicious uniform resource locator (URL) is described. A presentation of a URL on a display of a computing device is detected. An actual URL associated with the URL presented on the display is obtained. The URL presented on the display is compared to the actual URL associated with the presented URL. If the URL presented on the display does not match the actual URL, the actual URL is prevented from being accessed.

## Claims

### Claim 1

A computer-implemented method to detect a potentially malicious uniform resource locator (URL), comprising:
detecting a presentation of a URL on a display of a computing device;
obtaining an actual URL associated with the URL presented on the display;
isolating an extension type of the actual URL, wherein an extension type includes a type of file;
determining whether the extension type of the actual URL matches a predetermined type of file;
upon determining the extension type of the actual URL matches a predetermined type of file, comparing the isolated extension type of the actual URL with at least a portion of the URL presented on the display; and
if the at least a portion of the URL presented on the display does not match the isolated extension type of the actual URL, preventing the actual URL from being accessed.

### Claim 2 (depends on 1)

The method of claim 1, further comprising determining an extension type of the URL presented on the display.

### Claim 3 (depends on 1)

The method of claim 1, further comprising determining whether an extension type of the actual URL comprises an executable extension.

### Claim 4 (depends on 3)

The method of claim 3, wherein if the extension type of the actual URL comprises an executable extension, comparing the extension type of the URL presented on the display to the extension type of the actual URL.

### Claim 5 (depends on 1)

The method of claim 1, wherein if the URL presented on the display does not match the actual URL, removing the presented URL from the display.

### Claim 6 (depends on 1)

The method of claim 1, wherein if the URL presented on the display does not match the actual URL, generating a notification message indicating that the actual URL is not accessible.

### Claim 7 (depends on 1)

The method of claim 1, wherein if the URL presented on the display matches the actual URL, allowing the actual URL to be accessed, wherein the actual URL is accessed by clicking on the URL presented on the display using an input device.

### Claim 8

A computing device configured to detect a potentially malicious uniform resource locator (URL), comprising:
a processor;
memory in electronic communication with the processor;
a display;
instructions stored in the memory, the instructions being executable by the processor to:
detect a presentation of a URL on the display of the computing device;
obtain an actual URL associated with the URL presented on the display;
isolate an extension type of the actual URL, wherein an extension type includes a type of file;
determine whether the extension type of the actual URL matches a predetermined type of file;
upon determining the extension type of the actual URL matches a predetermined type of file, compare the isolated extension type of the actual URL with at least a portion of the URL presented on the display; and
if the at least a portion of the URL presented on the display does not match the isolated extension type of the actual URL, prevent the actual URL from being accessed.

### Claim 9 (depends on 8)

The computing device of claim 8, wherein the instructions are executable by the processor to:
determine an extension type of the URL presented on the display.

### Claim 10 (depends on 8)

The computing device of claim 8, wherein the instructions are executable by the processor to:
determine whether an extension type of the actual URL comprises an executable extension.

### Claim 11 (depends on 10)

The computing device of claim 10, wherein if the extension type of the actual URL comprises an executable extension, the instructions are executable by the processor to:
compare the extension type of the URL presented on the display to the extension type of the actual URL.

### Claim 12 (depends on 8)

The computing device of claim 8, wherein if the URL presented on the display does not match the actual URL, the instructions are executable by the processor to:
remove the presented URL from the display.

### Claim 13 (depends on 8)

The computing device of claim 8, wherein if the URL presented on the display does not match the actual URL, the instructions are executable by the processor to:
generate a notification message indicating that the actual URL is not accessible.

### Claim 14 (depends on 8)

The computing device of claim 8, wherein if the URL presented on the display matches the actual URL, the instructions are executable by the processor to:
allow the actual URL to be accessed, wherein the actual URL is accessed by clicking on the URL presented on the display using an input device.

### Claim 15

A computer-program product for detecting a potentially malicious uniform resource locator (URL), the computer-program product comprising a non-transitory computer-readable medium storing instructions thereon, the instructions being executable by the processor to:
detect a presentation of a URL on a display of a computing device;
obtain an actual URL associated with the URL presented on the display;
isolate an extension type of the actual URL, wherein an extension type includes a type of file;
determine whether the extension type of the actual URL matches a predetermined type of file;
upon determining the extension type of the actual URL matches a predetermined type of file, compare the isolated extension type of the actual URL with at least a portion of the URL presented on the display; and
if the at least a portion of the URL presented on the display does not match the isolated extension type of the actual URL, prevent the actual URL from being accessed.

### Claim 16 (depends on 15)

The computer-program product of claim 15, wherein the instructions are executable by the processor to:
determine an extension type of the URL presented on the display.