Symantec Corporation

Ian Oliver

Ryan Pereira

Rolf Repasi

Simon Clausen

Subhash Gaonkar

Adam Glick

Spencer Dale Smith

Nicholas Graf

Jonathan San Jose

Ryan Platt

Neil Younusov

A method, system, and computer program product for presenting content indicative of one or more entities which contributed to a window being displayed using a processing system. The method comprises determining one or more properties of the window; identifying, using the one or more properties and a set of rules, one or more entities which contributed to the window being displayed; and providing to a user, using the processing system, content indicative of the one or more entities which contributed to the window being displayed.

Determining a contributing entity for a window

A computer-implemented method to protect against the release of information is described. The processor monitors for a communication with an unverified number. Upon detection of the communication with an unverified number, the processor monitors the communication for a protected string. Upon detection of a protected string, the processor performs an intervention action.

Systems and methods to protect against the release of information

A computer-implemented method to provide a contextual message for a web-based service is described. An application executing on a computing device is monitored. A link between the application and a mobile telephone number is detected. Reputation information for a service provided by the application is determined. A first informational message regarding the service is generated based on the reputation information. The first informational message is displayed.

Systems and methods for providing a contextual message for a web-based service

A computer-implemented method for detecting illegitimate out-of-band authentication attempts may include 1) identifying a text message that includes a confirmation code for an out-of-band authentication procedure, 2) detecting an attempt to access the text message, 3) determining that the attempt to access the text message was configured to avoid user participation, and 4) performing, in response to determining that the attempt to access the text message was configured to avoid user participation, a remediation action that addresses an illegitimate out-of-band authentication attempt that includes the attempt to access the text message. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting illegitimate out-of-band authentication attempts

A computer-implemented method to determine whether user interaction activities are indicative of deceptive actions is described. Performance of at least one user interaction activity on a computing device is detected. The performance of the at least one user interaction activity is logged. A determination is made as to whether the logged user interaction activity matches a signature. A notification message is generated based on the determination that the logged user interaction activity matches the signature.

Systems and methods for detecting user activities to identify deceptive activity

A computer-implemented method to prevent fraudulent activity associated with typo-squatting procedures is described. An input of a uniform resource locator (URL) for a un-assessed website is detected. A data field on the un-assessed website for sensitive information is detected. The inputted URL is compared to a database of URLs for trusted websites associated with trusted entities. A determination is made as to whether a difference between the inputted URL and the URLs in the database satisfies a threshold. Upon determining that the difference satisfies the threshold, a message regarding the un-assessed website is generated.

Systems and methods for preventing fraudulent activity associated with typo-squatting procedures

A computer-implemented method to detect malicious code in a script attack, is described. An activity associated with calling a function is detected. An operation code set associated with the activity to call the function is identified. A predetermined sequence of characters included in the operation code set is identified. The identified predetermined sequence of characters is analyzed. The operation code set is classified as malicious or non-malicious based on the analysis of the predetermined sequence of characters.

Systems and methods for detecting malicious code in a script attack

A method of capturing data relating to a threat in a server processing system is described. Event history data that comprises a sequential chain of one or more events performed by a client processing system is received. Performance of the one or more events in the chain leads to a trigger event. The trigger event that occurred in the client processing system is also received. The server processing system receives the event history data in response to the client processing system detecting the trigger event. The events in the chain are analyzed in a reverse order to determine a starting point for the chain of events. The event history data is compared against past event history data received from a plurality of client processing systems in order to determine if the event history data and the past event history data comprise a series of common events. An entity associated with the series of common events is identified.

Capturing data relating to a threat

A computer-implemented method for automatically detecting and preventing phishing attacks may include (1) maintaining a credentials store for a user of the computing device that identifies both at least one known-legitimate website and credentials associated with the known-legitimate website, (2) detecting an attempt by the user to enter the same credentials that are associated with the known-legitimate website into a new website that is not associated with the credentials in the credentials store, and then, prior to allowing the credentials to pass to the new website, (3) automatically warning the user that the new website potentially represents an attempt to phish the credentials associated with the known-legitimate website from the user. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for automatically detecting and preventing phishing attacks

A method, and associated system and computer program product, of validating site data. The method includes the steps of, in a processing system, receivingan indication of site data, performing a comparisonof the indication to site data criteria, and validating or invalidatingthe indication based on a result of the comparison. The indication of site data could be at least part of a webpage, a link to a webpage, a Uniform Resource Locator, an IP address, at least part of an AJAX page, and/or at least part of a document.

Method and system for validating site data

A computer-implemented method to block a domain based on an Internet Protocol (IP) address serving the domain is described. A trigger event on a first domain is detected. The IP address serving the first domain is identified. The identified IP address is compared with a list of IP addresses. The trigger event is blocked based on a determination that the identified IP address matches at least one IP address on the list.

Systems and methods for blocking a domain based on the internet protocol address serving the domain

A computer-implemented method to detect scam on a communications device is described. An incoming communication is detected at the communications device. A determination is made as to whether a requested response message is detected. The requested response message is analyzed to determine whether the message is suspicious. A response message to the incoming communication is detected. The response message is blocked based on a determination that the requested response message is suspicious.

Systems and methods to detect a scam on a communications device

A method and apparatus for detecting system message misrepresentation using a keyword analysis is described. In one embodiment, the method of using one or more processors for detecting system message misrepresentation in memory by performing a keyword analysis, comprising monitoring visual representation object creation within a user interface, accessing keyword information comprising commonly used text for misrepresenting system messages, examining internet activity using the keyword information to produce an examination result, wherein the internet activity is for the created visual representation objects, identifying deceptive text within at least one of the created visual representation objects based on the examination result and producing indicia of detection as to the deceptive text.

Method and apparatus for detecting system message misrepresentation using a keyword analysis

A computer-implemented method to provide protection against a solicitation for information during a telephone call is described. A telephone call connection between a target device and a source device is monitored. A determination is made when sensitive information is provided via the target device. Characteristics of the source device are compared with characteristics stored in a first database. A warning message is generated based on the results of the comparison.

Systems and methods for providing protection against a solicitation for information during a telephone call

A computer-implemented method to detect malformed arguments in a function by hooking a generic object, is described. A predetermined argument to monitor is identified. An activity associated with a calling of a function to produce a called out function is detected. The called out function is mapped to a class identification of an object. An argument in the called out function is compared with the predetermined argument. When a match exists, a virtual method table identification is recorded for the called out function. The match between the argument in the called out function and the predetermined argument is reported.

Growing community of inventors

Manly Vale, Australia

Ian Oliver