Back to results
US 8,621,613 B1Granted
Detecting malware in content items
AssigneeAmazon Technologies, Inc.
InventorsJon A. McClintock, Eric J. Martin, Karl A. McCabe, Thibault Candebat, Adam J. Cecchetti, David Erdmann
Life of this patent
Estimating the term…
Abstract
Disclosed are various systems, methods, and other embodiments directed to detection of malware in content items. To detect the malware, for example, an environment is simulated in a computing device configured to render a network page having a container for content placement. The existence of malware in a content item is detected in the computing device by implementing a rendering of the network page in the environment with the content item inserted in the container to detect an unauthorized action by the content item.
Claims21
A system, comprising:
- at least one computing device;
- a virtual machine executable on the at least one computing device;
- a browser application executable by the virtual machine, the browser application being configured to render a network page having a container, the container being configured for placement of a content item;
- and
- an application executable on the at least one computing device configured to detect an existence of malware in the content item by:
- initiating the virtual machine;
- initiating the execution of the browser application on the virtual machine;
- causing the browser application to implement a first rendering of the network page with the container empty, a portion of the network page outside the container having no malware;
- causing the browser application to implement a second rendering of the network page with the content item inserted in the container;
- obtaining a first document object model (DOM) associated with the first rendering of the network page;
- obtaining a second DOM associated with the second rendering of the network page;
- and
- comparing the first DOM with the second DOM to identify an alteration to the portion of the network page outside the container that results from the second rendering of the network page.
10 more elements
A method, comprising the steps of:
- simulating an environment in a computing device configured to render a network page having a container for content placement, a portion of the network page outside the container having no malware;
- and
- detecting in the computing device an existence of malware in a content item by:
- implementing, in the environment, a first rendering of the network page and a second rendering of the network page, the first rendering having the container empty and the second rendering having the content item inserted in the container;
- obtaining a first document object model (DOM) associated with the first rendering and a second DOM associated with the second rendering;
- and
- comparing the first DOM with the second DOM to identify an alteration to the portion of the network page outside the container resulting from an unauthorized action by the content item.
4 more elements
A system, comprising:
- at least one computing device;
- a virtual machine executable on the at least one computing device;
- a browser application executable by the virtual machine;
- and
- an application executable on the at least one computing device configured to:
- initiate the virtual machine;
- initiate the execution of the browser application on the virtual machine, the browser application configured to render a network page having a container for a content item, a portion of the network page outside the container having no malware;
- cause the browser application to implement a first rendering of the network page and a second rendering of the network page, the first rendering having the container empty and the second rendering having the content item inserted in the container to detect a predefined unauthorized action;
- obtain a first document object model (DOM) associated with the first rendering and a second DOM associated with the second rendering;
- and
- detect an existence of malware in the content item by comparing the first DOM with the second DOM to identify an alteration to the portion of the network page outside the container resulting from the predefined unauthorized action.
8 more elements
Dependencies are inferred from the claim text.