Google Inc.

Niels Provos

Fritz Schneider

Eric L Davis

Panayiotis Mavrommatis

Yunkai Zhou

Mark Matthew Palatucci

Clayton Woodward Bavor, Jr

Kamal P Nigam

Rachel Nakauchi

Christopher K Monson

Jeffrey Adgate Dean

Sanjay Ghemawat

Georges R Harik

Eric Russell Fredricksen

Matt Cutts

Adam Dingle

Gokul Rajaram

Kourosh Gharachorloo

Victor Bennett

Shrish Agrawal

Jayesh Sharma

Xin Zhao

Shumeet Baluja

Oliver Griffith Fisher

Chris Barton

Navdeep Jagpal

Sean Harvey

Ashish Bhatia

Avichal Garg

Moheeb Abu Rajab

Jie Ren

Qi Sun

Min Gyung Kang

Monirul Islam Sharif

Sruthi Bandhakavi

Clayton W Bavor Jr

Jr Clayton W Bavor

Intrusion features of a landing page associated with sponsored content are identified. A feature score for the landing page based on the identified intrusion features is generated, and if the feature score for the landing page exceeds a feature threshold, the landing page is classified as a candidate landing page. A sponsor account associated with the candidate landing page can be suspended, or sponsored content associated with the candidate landing page can be suspended.

Detection of malware features in a content item

A system and method for verifying content on a network site is provided. A document such as a website is identified. The document is accessed over a network from a content provider system connected to the network to obtain information about the document. Through an automated process, using the information about the document to determine whether the document conforms to one or more predetermined rules associated with the content provider system governing the usage of content in the document.

Method and system for using a network analysis system to verify content on a website

Intrusive software management

Systems and methods for automatically analyzing and predicting behavior of binary executable programs are provided. A virtual machine receives a URL or content based feature corresponding to a binary executable program and the virtual machine analyzes the behavior of the binary executable program. The safety information of the binary executable program is determined based on the analysis report generated by the virtual machine and its impact on the virtual machine. A binary explorer selects a URL or content based feature corresponding to the binary executable program to be analyzed. A binary analyzer automatically records the behavior of the binary executable program to generate a report containing safety information describing the interaction occurred between the binary executable program and the analysis virtual machine. A result interpreter determines and predicts whether the binary executable program is safe based on the information generated by the binary analyzer.

Exploration system and method for analyzing behavior of binary executable programs

In a computer-implemented method, a digital content item to be tested is received. A display of a visual representation of the digital content item is simulated, where the visual representation is selectable and the digital content item is associated with a code snippet that is executed when the visual representation is selected. A simulated user click on the visual representation is received and the code snippet is executed in response. Processing actions of the code snippet are monitored, and it is determined whether the processing actions violate one or more predetermined system policies indicative of a content item unsuitable for service. A score for the code snippet is calculated based on one or more violations of the one or more predetermined system policies. The digital content item is suspended to prevent service of the digital content item if the score exceeds a predetermined threshold score, and validated for service otherwise.

System policy violation detection

A method includes receiving a plurality of trusted assets, generating a first signature set for a known software application, and generating a second signature set for a subject software application. Each trusted asset is associated with at least a threshold number of trusted authors. Each signature in the first signature set corresponds to a known asset that is associated with the known software application. Each signature in the second signature set corresponds to a subject asset that is associated with the subject software application. The method further includes generating first and second filtered signature set based on the first and second signature sets, respectively, by excluding signatures corresponding to the trusted assets. The method also includes generating a similarity rating for the subject application based on a comparison of the first filtered signature set and the second filtered signature set.

Detecting pirated applications

Upon receipt of a document request, a client assistant examines its cache for the document. If not successful, a server searches for the requested document in its cache. If the server copy is still not fresh or not found, the server seeks the document from its host. If the host cannot provide the copy, the server seeks it from a document repository. Certain documents are identified from the document repository as being fresh or stable. Information about each of these identified documents is transmitted to the server which inserts entries into an index if the index does not already contain an entry for the document. If and when this particular document is requested, the document will not be present in the server, however the server will contain an entry directing the server to obtain the document from the document repository rather than the document's web host.

System and method of accessing a document efficiently through multi-tier web caching

A system includes a data repository and a processing unit. The data repository stores data associated with a corpus of documents hosted on one or more servers. The processing unit analyzes data associated with a suspect document from the corpus of documents. The processing unit further assigns a score, based on the analyzed data, to the suspect document that indicates whether the suspect document is potentially fraudulent.

Systems and methods for detecting potential communications fraud

Upon receipt of a document request, a client assistant examines its cache for the document. If not successful, a server searches for the requested document in its cache. If the server copy is still not fresh or not found, the server seeks the document from its host. If the host cannot provide the copy, the server seeks it from a document repository. Certain documents are identified from the document repository as being fresh or stable. Information about each these identified documents is transmitted to the server which inserts entries into an index if the index does not already contain an entry for the document. If and when this particular document is requested, the document will not be present in the server, however the server will contain an entry directing the server to obtain the document from the document repository rather than the document's web host.

Users may be protected from scumware included on or associated with web sites indexed by a search engine. The search engine may, for instance take the presence of scumware into account when ranking or determining whether a document matches a search query or provide information with search results that indicates that a particular search result link may be associated with scumware. In one implementation, a search engine generates search results for a search query to obtain documents that are relevant to the search query. The search engine may then format the search results as a web page that includes visual indicators associated with those of the relevant documents that have been determined to be associated with scumware.

Identification of possible scumware sites by a search engine

Detecting an intrusive landing page

Growing community of inventors

Mountain View, CA, United States of America

Niels Provos