Back to results
US 8,997,228 B1Granted
Techniques for detecting infected websites
AssigneeSymantec Corporation
InventorsSourabh Satish, Nishant A. Doshi
Life of this patent
Estimating the term…
Abstract
Techniques for detecting infected websites are disclosed. In one particular embodiment, the techniques may be realized as a method for detecting an infected website comprising receiving at least one redirection report from at least one security agent, receiving at least one malware report from the at least one security agent, analyzing correlation between the at least one redirection report and the at least one malware report, aggregating information from the at least one redirection report, the at least one malware report, and the correlation analysis, and detecting an infected website based on the aggregated information.
Claims19
A method for detecting an infected website comprising:
- receiving, by at least one hardware computer processor, a plurality of redirection reports from a plurality of security agents, wherein each redirection report comprises information about a redirection from a first website to a malicious website and information about a plurality of website navigation parameters associated with a request for the first website;
- determining a first value of a website navigation parameter of the plurality of website navigation parameters that at least partially satisfies a condition of a conditional redirection from the first website to the malicious website based on the plurality of redirection reports;
- determining that the first website is infected with malicious code that causes the conditional redirection based on the plurality of redirection reports, wherein the malicious code causes the conditional redirection from the first website to the malicious website when at least one condition of the conditional redirection is satisfied;
- and
- selectively permitting access to the first website infected with the malicious code that causes the conditional redirection when the at least one condition of the conditional redirection is not satisfied.
2 more elements
A system for detecting an infected website comprising:
- at least one processor configured to:
- receive a plurality of redirection reports from a plurality of security agents, wherein each redirection report comprises information about a redirection from a first website to a malicious website and information about a plurality of website navigation parameters associated with a request for the first website;
- determine a first value of a website navigation parameter of the plurality of website navigation parameters that at least partially satisfies a condition of a conditional redirection from the first website to the malicious website based on the plurality of redirection reports;
- determine that the first website is infected with malicious code that causes the conditional redirection based on the plurality of redirection reports, wherein the malicious code causes the conditional redirection from the first website to the malicious website when at least one condition of the conditional redirection is satisfied;
- and
- selectively permit access to the first website infected with the malicious code that causes the conditional redirection when the at least one condition of the conditional redirection is not satisfied;
- and
- at least one memory, coupled to the at least one processor, configured to provide the at least one processor with instructions.
5 more elements
An article of manufacture for detecting an infected website, the article of manufacture comprising:
- at least one non-transitory processor readable storage medium;
- and
- instructions stored on the at least one medium;
- wherein the instructions are configured to be readable from the at least one medium by at least one processor and thereby cause the at least one processor to operate so as to:
- receive a plurality of redirection reports from a plurality of security agents, wherein each redirection report comprises information about a redirection from a first website to a malicious website and information about a plurality of website navigation parameters associated with a request for the first website;
- determine a first value of a website navigation parameter of the plurality of website navigation parameters that at least partially satisfies a condition of a conditional redirection from the first website to the malicious website based on the plurality of redirection reports;
- determine that the first website is infected with malicious code that causes the conditional redirection based on the plurality of redirection reports, wherein the malicious code causes the conditional redirection from the first website to the malicious website when at least one condition of the conditional redirection is satisfied;
- and
- selectively permitting access to the first website infected with the malicious code that causes the conditional redirection when the at least one condition of the conditional redirection is not satisfied.
6 more elements
Dependencies are inferred from the claim text.