# US 8,751,478 B1 · Systems and methods for associating brands with search queries that produce search results with malicious websites

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,751,478 B1
- Document ID: US8751478B1
- Status: Granted
- Kind: B1
- Application number: 13/339,109
- Filed: 2011-12-28
- Granted: 2014-06-10
- Earliest claimed: 2011-12-28
- Assignees: Symantec Corporation
- Applicants: Kaushik Ramajayam; Chandrasekhar Cidambi
- Inventors: Kaushik Ramajayam; Chandrasekhar Cidambi
- Web page: https://patentgrep.com/patent/US8751478B1

## CPC

- G06Q 30/02: Marketing; Price estimation or determination; Fundraising
- G06Q 30/018: Certifying business or products
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A computer-implemented method to associate a brand with search queries that produce search results with malicious websites is described. A plurality of search queries entered into a search engine is received from a plurality of devices. commonalities among the plurality of search queries received from the plurality of devices are identified. The commonalities from the search queries are associated with a brand. A notification regarding the association of the commonalities from the search queries with the brand is generated.

## Claims

### Claim 1

A computer-implemented method to associate a brand with search queries that produce search results with malicious websites, comprising:
receiving a plurality of search queries entered into a search engine from a plurality of devices;
receiving, from the plurality of devices, search results produced from the plurality of search queries;
comparing the search results to a list of known malicious websites in order to identify candidate search queries producing search results with malicious websites;
identifying commonalities among the identified candidate search queries producing search results with malicious websites;
associating the commonalities from the search queries with a brand; and
generating a notification regarding the association of the commonalities from the search queries with the brand.

### Claim 2 (depends on 1)

The method of claim 1, wherein the search results comprise a list of at least one uniform resource locator (URL).

### Claim 3 (depends on 1)

The method of claim 1, further comprising receiving the plurality of search queries over a pre-determined time period.

### Claim 4 (depends on 1)

The method of claim 1, further comprising receiving the plurality of search queries from the plurality of devices located in a pre-determined geographical location.

### Claim 5 (depends on 1)

The method of claim 1, further comprising identifying an owner of the brand.

### Claim 6 (depends on 5)

The method of claim 5, further comprising transmitting the notification to the identified owner of the brand.

### Claim 7 (depends on 1)

The method of claim 1, further comprising assigning a ranking to each of the plurality of search queries based on a number of occurrences of the search queries.

### Claim 8

A computing device configured to associate a brand with search queries that produce search results with malicious websites, comprising:
a processor;
memory in electronic communication with the processor;
instructions stored in the memory, the instructions being executable by the processor to:
receive a plurality of search queries entered into a search engine from a plurality of devices;
receive, from the plurality of devices, search results produced from the plurality of search queries;
compare the search results to a list of known malicious websites in order to identify candidate search queries producing search results with malicious websites;
identify commonalities among the identified candidate search queries producing search results with malicious websites;
associate the commonalities from the search queries with a brand; and
generate a notification regarding the association of the commonalities from the search queries with the brand.

### Claim 9 (depends on 8)

The computing device of claim 8, wherein the search results comprise a list of at least one uniform resource locator (URL).

### Claim 10 (depends on 8)

The computing device of claim 8, wherein the instructions are executable by the processor to
receive the plurality of search queries over a pre-determined time period.

### Claim 11 (depends on 8)

The computing device of claim 8, wherein the instructions are executable by the processor to
receive the plurality of search queries from the plurality of devices located in a pre-determined geographical location.

### Claim 12 (depends on 8)

The computing device of claim 8, wherein the instructions are executable by the processor to
identify an owner of the brand.

### Claim 13 (depends on 12)

The computing device of claim 12, wherein the instructions are executable by the processor to
transmit the notification to the identified owner of the brand.

### Claim 14 (depends on 8)

The computing device of claim 8, wherein the instructions are executable by the processor to
assign a ranking to each of the plurality of search queries based on a number of occurrences of the search queries.

### Claim 15

A computer-program product for associating a brand with search queries that produce search results with malicious websites, the computer-program product comprising a non-transitory computer-readable medium storing instructions thereon, the instructions being executable by a processor to:
receive a plurality of search queries entered into a search engine from a plurality of devices;
receive, from the plurality of devices, search results from the plurality of search queries;
compare the search results received to a list of known malicious websites in order to identify candidate search queries producing search results with malicious websites;
identify commonalities among the identified candidate search queries producing search results with malicious websites;
identify commonalities among the plurality of search queries received from the plurality of devices;
associate the commonalities from the search queries with a brand; and
generate a notification regarding the association of the commonalities from the search queries with the brand.