Rendered image collection of potentially malicious web pages
AssigneeMicrosoft Technology Licensing, LLC
InventorRoderic C. Deyo
Life of this patent
Estimating the term…
Abstract
Techniques are described which may provide a rendered image of a website from a potentially malicious party. In an implementation, a rendered image is collected of a web page that is identified as potentially malicious from a frame buffer. A communication is then formed to be communicated over a network that includes the collected image.
Claims20
One or more computer-readable storage memories for use at a computer system, the one or more computer-readable storage memories embodying processor-executable instructions which, responsive to execution by at least one processor, are configured to:
- cause the computer system to:
- receive a compressed image associated with a webpage, the compressed image comprising a plurality of pixels associated with an image taken from a frame buffer of a computing device, wherein a first portion of the compressed image has less compression than a second portion of the compressed image;
- decompress the compressed image into a decompressed image by using a decompression algorithm on the compressed image;
- output a rendered image associated with the decompressed image in a user interface;
- obtain, directly from a website that originated the webpage, the webpage;
- output an image of the directly obtained webpage;
- analyze the rendered image and the image of the directly obtained webpage to identify one or more differences between the rendered image and the image of the directly obtained webpage;
- and
- indicate, in the user interface, the one or more differences.
A method for use at a computer system, the computer system including a hardware processor and system memory, the method comprising:
- the hardware processor:
- receiving a compressed image associated with a webpage, the compressed image comprising a plurality of pixels associated with an image taken from a frame buffer of a computing device, wherein a first portion of the compressed image has less compression than a second portion of the compressed image;
- decompressing the compressed image into a decompressed image by using a decompression algorithm on the compressed image;
- outputting a rendered image associated with the decompressed image in a user interface;
- obtaining, directly from a website that originated the webpage, the webpage;
- and
- outputting an image of the directly obtained webpage;
- analyzing the rendered image and the image of the directly obtained webpage to identify one or more differences between the image of the directly obtained webpage and the rendered image;
- and
- indicate, in the user interface, the one or more identified differences.
A computer system, the computer system comprising:
- one or more hardware processors;
- system memory coupled to the one or more processors, the system memory storing instructions that are executable by the one or more processors;
- and
- the one or more processors configured to execute the instructions stored in the system memory to determine the likelihood a webpage was provided by a malicious party, including the following:
- receive a compressed image associated with a webpage, the compressed image comprising a plurality of pixels associated with an image taken from a frame buffer of a computing device, wherein a first portion of the compressed image has less compression than a second portion of the compressed image;
- decompress the compressed image into a decompressed image by using a decompression algorithm on the compressed image;
- output a rendered image associated with the decompressed image in a user interface;
- obtain, directly from a website that originated the webpage, the webpage;
- output an image of the directly obtained webpage;
- analyze the rendered image and the image of the directly obtained webpage to identify one or more differences between the rendered image and the image of the directly obtained webpage;
- and
- indicate, in the user interface, the one or more identified differences.
Dependencies are inferred from the claim text.