Clean.io, Inc.

Alexey Stoletny

Seth Mitchell Demsey

Iván Soroka

There are disclosed devices, system and methods for feeding identification data of malicious creatives existing in internet advertisements to a supply side platform (SSP) by receiving reports of unwanted actions without user action by malicious creatives of internet advertisements (ads) requested from the SSP by webpages being displayed to users. The reports include a creative identification (ID), a malicious code chain of events, and a demand side platform (DSP) ID or a seat ID. The reports are pre-processed by classifying the unwanted action attempts based on the chain of events. The pre-processed reports are parsed to extract the creative IDs, the SSP IDs and the DSP IDs; and then stored in a searchable database. The stored parsed pre-processed reports are feed to SSPs based on the SSP identifications. The feed includes the creative IDs, the SSP IDs, the DSP IDs, timestamps of the unwanted action attempt and the classifications.

Identifying malicious creatives to supply side platforms (SSP)

There are disclosed devices, system and methods for detecting malicious scripts received from malicious client side vectors. First, a script received from a client side injection vector and being displayed to a user in a published webpage is detected. The script may have malicious code configured to cause a browser unwanted action without user action. The script is wrapped in a java script (JS) closure and/or stripped of hyper-text markup language (HTML). The script is then executed in a browser sandbox that is capable of activating the unwanted action, displaying execution of the script, and stopping execution of the unwanted action if a security error resulting from the unwanted action is detected. When a security error results from this execution in the sandbox, executing the malicious code is discontinued, displaying the malicious code is discontinued, and execution of the unwanted action is stopped.

Detecting malicious code received from malicious client side injection vectors

There are disclosed devices, system and methods for detecting malicious code existing in an internet advertisement (ad) requested by a published webpage viewed by a user. First, receipt of malicious code of the ad is detected, where that code may be malicious code that causes a browser unwanted action without user action. If the internet ad is an SCR type document, the malicious code may be wrapped in a java script (JS) closure to detect an unwanted action requested by the malicious code. The malicious code is executed a browser sandbox that activates the unwanted action, that displays execution of the internet ad and that allows execution of the unwanted action. When a security error resulting from the unwanted action is detected, executing the malicious code in the browser sandbox is discontinued, displaying of the internet ad on the display is discontinued, and execution of the unwanted action is stopped.

Detecting malicious code existing in internet advertisements by ongoing sandbox monitoring

There are disclosed devices, system and methods for detecting cross-origin malicious code existing in an internet advertisement (ad) requested by a published webpage viewed by a user. First, receipt of the ad is detected, where that ad includes cross-origin malicious code that causes a browser cross-origin unwanted action without user action. The ad is then executed in a browser sandbox that displays the cross-origin malicious code and intercepts the cross-origin unwanted action. When a cross-origin security error results from this execution, the cross-origin malicious code is discontinued and the cross-origin unwanted action is intercepted.

Detecting cross-origin malicious code existing in internet advertisements

There are disclosed devices, system and methods for detecting malicious code existing in an internet advertisement (ad) requested by a published webpage viewed by a user. First, receipt of malicious code of the ad is detected, where that code may be malicious code that causes a browser unwanted action without user action. The content is wrapped in a java script (JS) closure and stripped of hyper-text markup language (HTML) content that would provide an extraneous count impression for the ad. The content is then executed in a behavior sandbox that prevents display of the malicious code and the unwanted action. When a security error results from this execution, it is discontinued, the content is not displayed and the unwanted action is intercepted. After execution in the behavior sandbox begins, the ad may be executed in browser sandbox that causes a first count impression for the ad.

Growing community of inventors

New York, NY, United States of America

Alexey Stoletny