Method and apparatus for detecting legitimate computer operation misrepresentation
AssigneeSymantec Corporation
InventorBhaskar Krishnappa
Life of this patent
Estimating the term…
Abstract
A method for detecting legitimate computer operation misrepresentation is provided. In some embodiments, the method comprises monitoring internet activity associated with a user computer, comparing the internet activity with suspicious feature information to produce a comparison result, wherein the suspicious feature information comprises at least one image that misrepresents at least one legitimate computer operation, identifying fraudulent software based on the comparison result, wherein the comparison result indicates a portion of the internet activity that misrepresents the at least one legitimate computer operation and mitigating activities associated with the identified fraudulent software.
Claims20
A method for using one or more processors to detect legitimate computer operation misrepresentation in memory, comprising:
- monitoring internet activity associated with a user computer;
- comparing, using at least one computer processor, a first set of at least one computer graphical image received from the internet activity with a second set of at least one computer graphical image associated with electronically stored suspicious feature information to produce a comparison result, wherein the at least one computer graphical image of the second set misrepresents at least one legitimate computer operation to increase a likelihood of malicious computer functions;
- identifying fraudulent software based on the comparison result between the first and second sets of computer graphical images, wherein the comparison result indicates a portion of the internet activity associated with the user computer that misrepresents the at least one legitimate computer operation;
- and
- mitigating, on the user computer, activities associated with the identified fraudulent software.
An apparatus for using one or more processors to detect legitimate computer operation misrepresentation in memory, comprising:
- means for monitoring internet activity associated with a user computer;
- means for comparing a first set of at least one computer graphical image received from the internet activity with a second set of at least one computer graphical image associated with electronically stored suspicious feature information to produce a comparison result, wherein the at least one computer graphical image of the second set misrepresents a legitimate computer operation to increase a likelihood of malicious computer functions;
- means for identifying fraudulent software based on the comparison result between the first and second sets of computer graphical images, wherein the comparison result indicates a portion of the internet activity associated with the user computer that misrepresents the at least one legitimate computer operation;
- and
- means for handling, on the user computer, activities associated with the identified fraudulent software.
A non-transitory computer-readable-storage medium comprising one or more processor executable instructions that, when executed by at least one processor, causes the at least one processor to:
- monitor internet activity associated with a user computer;
- compare a first set of at least one computer graphical image received from the internet activity with a second set of at least one computer graphical image associated with electronically stored suspicious feature information to produce a comparison result, wherein the at least one computer graphical image of the second set misrepresents a legitimate computer operation to increase a likelihood of malicious computer functions;
- identify fraudulent software based on the comparison result between the first and second sets of computer graphical images, wherein the comparison result indicates a portion of the internet activity associated with the user computer that misrepresents the at least one legitimate computer operation;
- and
- mitigate, on the user computer, activities associated with the identified fraudulent software.
Dependencies are inferred from the claim text.