Morgan Stanley Services Group Inc.

Eric Mudge

Joseph Edmonds

Russell Moriarty

A method for generating hashes associated with web domains and reacting to transmissions from those web domains is disclosed. When artifacts from a first web domain and artifacts from a second web domain have been transmitted over a network, a system generates, via a hashing or fingerprinting function that uses registry information, a first hash for the first web domain and a second hash for the second web domain and identifies a correlation between the first web domain and the second web domain based on shared subsets of the first hash and second hash. Upon receiving a notification that artifacts from the first web domain had been determined to negatively impact the functioning of a secondary computing system, based on the identified correlation between the first web domain and the second web domain, the system automatically quarantines artifacts from the second web domain from interacting with the secondary computing system.

Web domain correlation hashing method

A computer-implemented method of analyzing the contents of a file in a visual document format to identify a potentially-fraudulent overlay is disclosed. The method includes receiving the file, iterating over a set of visually rendered elements within the file, and calculating, for each element in the set, a bounding box. Based on identifying a pair of elements having at least partially overlapping bounding boxes, such that a visible item in an overlaid element at least partially obscures an item in an underlying element that would otherwise be visible, an attack vector ontology is updated to include information on the overlaid and underlying element. This attack vector ontology may be used in training an automatic system to identify fraudulent documents and prevent their being printed, signed, and/or further used.

Fraudulent overlay detection in electronic documents

A method for generating fingerprints of web domains and reacting to artifacts electronically received from those web domains is disclosed. When artifacts from a first web domain and artifacts from a second web domain have been transmitted over a network, a system generates, via a hashing function that consults registry information, a first hash for the first web domain and a second hash for the second web domain and identifies a correlation between the first web domain and the second web domain based on shared subsets of the first hash and second hash. Upon receiving a notification that artifacts from the first web domain had been determined to negatively impact the functioning of a secondary computing system; and based on the identified correlation between the first web domain and the second web domain, the system automatically quarantines artifacts from the second web domain from interacting with the secondary computing system.

Growing community of inventors

Woodstock, MD, United States of America

Eric Mudge