# US 9,521,157 B1 · Identifying and assessing malicious resources

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,521,157 B1
- Document ID: US9521157B1
- Status: Granted
- Kind: B1
- Application number: 14/748,493
- Filed: 2015-06-24
- Published: 2016-12-29
- Granted: 2016-12-13
- Earliest claimed: 2015-06-24
- Assignees: Bank of America Corporation
- Applicants: Bank of America Corporation
- Inventors: Robert D'Aveta; Chris Camacho
- Web page: https://patentgrep.com/patent/US9521157B1

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 16/285: {Clustering or classification}
- G06F 16/9566: {URL specific, e.g. using aliases, detecting broken or misspelled links}
- G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F 21/552: {involving long-term monitoring or reporting}
- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods, systems, and computer-readable media for analyzing and indicating network resources as potentially malicious are disclosed. Some aspects of the disclosure provide ways for threat-analyzing individuals and/or organizations to transmit information about potentially malicious resources in a safe manner. Users or computing devices may transmit non-resolvable “de-fanged” resource identifiers, which lessens the likelihood that the receiving computing device will download malicious data or applications from the resource. Some aspects disclosed herein provide ways to correctly and accurately “re-fang” the resource identifier for threat analysis of the resource, for example by selecting one or more re-fangers to apply and applying the re-fangers to the identifier. Data may be retrieved from the resource (for example via a headless or non-interactive browser), and the resource and/or resource identifier may be categorized as malicious. Indications of a resource as malicious may be transmitted to other computing devices to reduce or eliminate malicious activity.

## Claims

### Claim 1

A method comprising:
receiving, at a computing device and via a user interface, a string of text comprising a de-fanged uniform resource locator, wherein the de-fanged uniform resource locator includes a pair of brackets surrounding a dot (.);
converting, by the computing device, the de-fanged uniform resource locator into a resolvable uniform resource locator, wherein converting the de-fanged uniform resource locator into the resolvable uniform resource locator includes removing the pair of brackets;
retrieving, by the computing device, data from a network location identified by the resolvable uniform resource locator, wherein retrieving the data comprises instantiating a headless browser and rendering the data via the headless browser, resulting in rendered data;
categorizing, by the computing device, based on the rendered data, the location as a malicious location;
generating, by the computing device, one or more notifications based on the categorizing; and
transmitting, by the computing device, the one or more notifications to another device to update a record stored at the another device and associated with the network location to include information indicating that the network location is malicious.

### Claim 2 (depends on 1)

The method of claim 1, wherein the de-fanged uniform resource locator further includes an unknown protocol indicator and converting further includes replacing the unknown protocol indicator with a known protocol indicator.

### Claim 3 (depends on 2)

The method of claim 2, wherein the known protocol indicator identifies a hypertext transport protocol (HTTP).

### Claim 4 (depends on 1)

The method of claim 1, wherein categorizing the location comprises categorizing a domain name associated with the location.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
retrieving, by the computing device, based on the data, geographic information associated with the network location, wherein categorizing the network location is based on the geographic information.

### Claim 6

An apparatus comprising:
a processor; and
one or more memories storing computer-readable instructions that, when executed by the processor, cause the processor to:
receive via a user interface a string of text that comprises a de-fanged uniform resource identifier (URI), wherein the de-fanged URI partially identifies a malicious location and wherein the de-fanged uniform resource locator includes a pair of brackets surrounding a dot (.);
convert the de-fanged URI into a re-fanged URI, wherein the re-fanged URI fully identifies the malicious location and wherein the re-fanged URI does not include the pair of brackets;
retrieve data from the malicious location identified by the re-fanged URI, wherein retrieving the data comprises operating a headless browser to render the data via the headless browser, resulting in rendered data;
categorize, by the computing device, based on the rendered data, the malicious location;
generate, by the computing device, one or more notifications based on the categorizing;
transmit, by the computing device, the one or more notifications to another device to update a record stored at the another device and associated with the network location to include information indicating that the network location is malicious.

### Claim 7 (depends on 6)

The apparatus of claim 6, wherein the de-fanged URI further includes an unknown protocol indicator and the re-fanged URI further includes a known protocol indicator.

### Claim 8 (depends on 7)

The apparatus of claim 7, wherein the known protocol indicator identifies a Hypertext Transport Protocol (HTTP).

### Claim 9 (depends on 6)

The apparatus of claim 6, wherein the re-fanged URI includes a fully qualified domain name (FQDN).

### Claim 10 (depends on 9)

The apparatus of claim 9, wherein categorizing the malicious location comprises categorizing the FQDN.

### Claim 11 (depends on 6)

The apparatus of claim 6, wherein the re-fanged URI includes a uniform resource locator (URL).

### Claim 12

One or more non-transitory computer readable media storing instructions that, when executed by a processor, cause the processor to:
receive via a user interface a string of text that comprises a de-fanged uniform resource identifier (URI) associated with a potentially malicious location, wherein the de-fanged URI includes a pair of brackets surrounding a dot (.);
convert the de-fanged URI into a clickable URI, wherein the clickable URI does not include the pair of brackets;
retrieve data from the malicious location identified by the clickable URI, wherein retrieving the data comprises launching a browser in a non-display mode to receive the data;
render the data, resulting in rendered data;
categorize, based on the rendered data, the malicious location;
generate one or more notifications based on the categorizing;
transmit, the one or more notifications to another device to update a record stored at the another device and associated with the network location to include information indicating that the network location is malicious.

### Claim 13 (depends on 12)

The computer readable media of claim 12, wherein the de-fanged URI further includes an unknown protocol indicator and the clickable URI further includes a known protocol indicator.

### Claim 14 (depends on 13)

The computer readable media of claim 13, wherein the known protocol indicator identifies a Hypertext Transport Protocol (HTTP).