Patent ID: 9473531
Filing Date: 2016-10-18
CPC Classification: G06F,H04L

Claim Text:
1. A computer system for detecting malware in a network stream to at least one host computer, comprising: one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage medium, and program instructions stored on at least one of the one or more tangible storage medium for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system executes the program instructions to perform the steps comprising: initializing a browser profile corresponding with a first website having a first website source and a first plurality of content features; determining the first plurality of content features based on the first website, wherein a first content feature within the first plurality of content features has a first content feature internet protocol (IP) address indicating a first content feature source; recording in the browser profile the first plurality of content features, the first content feature IP address, and a trusted source based on the first website source; scanning the network stream to the at least one host computer for a second content feature within a second plurality of content features associated with a second website; determining if the second content feature matches the first content feature within the first plurality of content features recorded in the browser profile based on finding the second content feature while scanning the network stream, wherein the second content feature has a second content feature IP address indicating a second content feature source; determining if the second plurality of content features is consistent with the first plurality of content features based on determining the second content feature matches the first content feature, wherein determining if the second plurality of content features is consistent with the first plurality of content features comprises comparing the first content feature IP address recorded in the browser profile to the second content feature IP address; determining if a second website source associated with the second website matches the trusted source based on determining that the second plurality of content features is consistent with the first plurality of content features; generating an alert based on determining that the second plurality of features is inconsistent with the first plurality of content features or the second website source does not match the trusted source; generating, by the at least one host computer, a content signature based on the second plurality of features; sending the generated content signature to a proxy, wherein the proxy is connected to a plurality of enterprise hosts and the at least on host computer by a network within an enterprise; and forwarding the stored content signature from the proxy to the plurality of enterprise hosts within the enterprise, wherein the plurality of enterprise hosts individually store the sent content signature.