Gen Digital Inc.

Nortonlifelock Inc.

Iskander Sanchez Rola

David Luz Silva

Leylya Yumer

Petros Efstathopoulos

Daniel Marino

Johann Roturier

Bahaa Naamneh

Kevin Alejandro Roundy

Platon Kotzias

Michalis Pachilakis

Acar Tamersoy

Pierre-Antoine Vervier

Venkadesan Marimuthu

Leyla Bilge

Christopher Gates

Systems and methods for detecting fraudulent e-commerce websites by identifying fake review systems are disclosed. In particular, some embodiments may identify an e-commerce website and download content contained on one or more product web pages of the e-commerce website. These web pages may be analyzed to identify a product review feature that is within the one or more product web pages. Attributes of the product review feature may then be evaluated to determine that the e-commerce website is fraudulent and a security action may be performed to protect consumers from the e-commerce website.

Identifying fake review systems to protect consumers from fraudulent e-commerce websites

Methods for protecting against malicious websites using repetitive data signatures are disclosed. Some embodiments may identify known malicious websites and known safe websites. A first dataset containing data from one or more artifacts within the known malicious websites and a second dataset containing data from the one or more artifacts within the known safe websites may be created. One or more signatures may be identified from the first dataset. A first frequency of signature repetition within the first dataset and a second frequency of signature repetition within the second dataset may be determined. A level of confidence may be determined based on the frequencies. If a rule establishment threshold for confidence is met or exceeded, a rule may be established that websites containing the one or more signatures are malicious. The rule may be applied to identify a new malicious website. A security action may also be performed.

Protecting against malicious websites using repetitive data signatures

A computer-implemented method for dynamically generating fingerprint signatures may include (i) detecting data associated with fingerprinting functions called in a target web page, (ii) associating, based on the data, fingerprints generated by the fingerprinting functions with a corresponding action, (ii) identifying, based on the data, callee information associated with each of the fingerprinting functions, and (iv) performing a security action that protects against malicious activity by calculating a cryptographic hash of a list including the fingerprinting functions and the corresponding actions to generate a fingerprint signature for the target web page. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for dynamically generating fingerprint signatures

The disclosed computer-implemented method for utilizing contextual digital fingerprints to protect against browser-based malicious attacks may include (i) detecting an execution of one or more fingerprinting application programming interface (API) calls utilized by a target website for providing access to a user, (ii) generating identity data comprising specific values for each of the fingerprinting API calls to create a contextual digital fingerprint, (iii) storing the contextual digital fingerprint for consecutive accesses to the target website, and (iv) performing a security action that, based on the identity data in the contextual digital fingerprint, protects against browser-based malicious attacks attempting to access the target website. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for utilizing contextual digital fingerprints to protect against browser-based malicious attacks

The disclosed computer-implemented method for detecting cross-site leaks and restricting execution timing may include detecting, by at least one processor, one or more cross-site leak candidates. The method may additionally include determining, by the at least one processor, that at least one of the one or more cross-site leak candidates is related to one or more timers. The method may also include restricting, by the at least one processor, at least one of accuracy or precision of the one or more timers in response to the determination. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting cross-site leaks and restricting execution timing

The disclosed computer-implemented method for dynamic data protection may include intercepting a submit request for sensitive data to a destination, inserting dummy data into the intercepted submit request. The method may also include determining whether the destination is a trusted destination and when the destination is determined to be the trusted destination, replacing the dummy data with real data to complete the submit request to the destination, wherein the real data was previously collected isolated from the submit request. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for dynamic formjacking protection

The disclosed computer-implemented method for protecting against credential theft by impersonator applications may include (i) identifying an ownership relationship between each of a group of applications and a group of websites, (ii) generating a preliminary list containing the applications identified as having the ownership relationship with the websites, (iii) determining missing ownership relationships for the applications and the websites in the preliminary list, (iv) updating the preliminary list with the missing ownership relationships to create a trusted list of applications and websites, and (v) performing a security action that protects against a credential theft attack by referencing the trusted list to detect potential impersonator applications attempting to steal user credentials. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting against credential theft by impersonator applications

Preserving web page functionality through dynamic analysis of host web pages. Web pages accessed by a user device may be monitored. The web browser may apply a blocking policy that blocks an external domain from loading functional content into the web page, which results in a breakage in the web page. The breakage in the web page may be identified through a dynamic analysis of the web page and correlated with the functional content from the blocked external domain. Once identified and correlated, the blocking policy may be modified to allow the external domain to load the functional content and reloading the web page.

Preserving web page functionality through dynamic analysis of host web pages

Systems and methods for protecting against an estimated level of online tracking are disclosed. In one embodiment, a method may include collecting data relating to a plurality of known users. This first data may include browser histories and a level of online tracking for each known user. The known users may be organized into clusters and second data relating to an unknown user may be received. The second data may include an identification of one or more categories of websites that the unknown user visits, and one or more websites within each of the one or more categories of websites that the unknown user visits. A matching cluster for the unknown user may be identified and levels of online tracking for similar known users within the matching cluster may be used to estimate a level of online tracking for the unknown user.

Protecting against an estimated level of online tracking

The disclosed computer-implemented method for automated testing for domain blocking assessment may include performing a website analysis at least once without blocking any domains and repeatedly while blocking one domain at a time. The method may additionally include detecting discrepancies by comparing outcomes of performances of the website analysis, thereby identifying one or more domain blockages that cause one or more of the plurality of websites to be broken. The method may also include performing the website analysis repeatedly while performing and not performing the domain blockages. The method may further include comparing outcomes of performances of the website analyses for the other plurality of websites. The method may further include performing, in response to the comparison, a security action. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for automated testing for domain blocking assessment

The disclosed computer-implemented method for protecting user data privacy against anti-tracking evasion techniques for web trackers may include (i) detecting hypertext markup language (HTML) associated with a website displayed in a browser application, (ii) identifying one or more elements in the HTML capable of executing web tracking code from the website, (iii) determining, based on information describing scripting programming code responsible for embedding the HTML elements in the website, a presence of a hidden web tracking script, and (iv) performing a security action that protects against a potential invasion of user data privacy by preventing the hidden web tracking script from executing the web tracking code in the browser application. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting user data privacy against anti-tracking evasion techniques for web trackers

The disclosed computer-implemented method for identifying security threats in smart contract-based services to protect against malicious attacks utilizing off-blockchain resources may include (i) identifying a reference associated with a transaction on a smart contract-based platform, (ii) detecting content describing one or more smart contracts associated with the reference on the platform, (iii) extracting an identifier from the content to locate off-blockchain resources utilized by the smart contracts, (iv) determining potential security threats associated with the off-blockchain resources, and (v) performing a security action that protects against the potential security threats. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for identifying security threats in smart contract-based services to protect against malicious attacks utilizing off-blockchain resources

The disclosed computer-implemented method for enforcing strict network connectivity and storage access during online payments may include (i) determining that a webpage in a tab of a browser application executing on the computing device includes a payment page for an e-commerce website, (ii) based on determining that the webpage includes a payment page, providing formjacking attack protection by monitoring network connectivity and storage access by the browser tab, (iii) based on the formjacking attack protection, identifying a potentially malicious attempt to hijack information entered into at least one web form included in the payment page, and (iv) in response to identifying the potentially malicious attempt, preventing the potentially malicious attempt from hijacking the information entered into the at least one web form included in the payment page. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for enforcing strict network connectivity and storage access during online payments

The disclosed computer-implemented method for protecting user data privacy against web tracking on Wi-Fi captive portals may include (i) detecting telemetry data generated from establishing a connection with a network access device associated with a captive portal, (ii) determining, based on the telemetry data, a target set of domains associated with a service set identifier assigned to the network access device, (iii) analyzing web tracking behavior data associated with the target set of domains to identify web trackers on the captive portal for a dataset of potential users, (iv) calculating a privacy risk score associated with the web trackers on the captive portal, and (v) performing a security action that protects against a potential invasion of user data privacy by presenting a privacy risk score notification associated with the web trackers on the captive portal. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting user data privacy against web tracking on Wi-Fi captive portals

The disclosed computer-implemented method for automatically identifying server-side tracking on websites may include collecting, by at least one processor, tracker parameters requested by websites. The method may additionally include inferring, by the at least one processor based on the collected tracker parameters, event forwarding by detecting two or more of the websites that request a similar set of the tracker parameters. The method may also include comparing, by the at least one processor, content of the two or more of the websites. The method may further include performing, by the at least one processor, a security action in response to the comparison. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Antibes, France

Iskander Sanchez Rola