Methods for safely detecting online fraud malware

Abstract

A method for securely detecting online fraud includes generating an encrypted profile representing browser activity, sending the encrypted profile to a secure multi-party computing system, receiving a trust token from the secure multi-party computing system, sending a request to redeem the trust token with the secure multi-party computing system based on a determination that the web browser is not engaging in online fraud, receiving an encrypted redemption record from the secure multi-party computing system based on a determination that a website associated with web content is not blocked, and sending a request for third-party content including the encrypted redemption record, wherein the third-party content is associated with the web content.

Description

Background Art

[0001] This document relates to a method for securely detecting online fraud malware. In some typical online fraud scenarios, malicious publishers and / or their partners manipulate many browsers infected with malware (or pay-to-click) to click on the malicious publisher's webpages for illicit financial gain. This type of online fraud is commonly referred to as publisher inflation. Once browser vendors oppose third-party cookies (small text files), there is currently no effective way to collect a browser's browsing or click history across multiple websites while maintaining data security. Therefore, anti-fraud vendors need to identify a set of browsers or web browsers that are infected with malware and participate in publisher inflation without using third-party cookies, while maintaining client data security.

[0002] For example, a user may browse web content from multiple publishers on multiple websites and domains. The content provided to the user is based on several factors, such as browsing history, currently browsed web content, publisher, etc. Clients affected by online fraud malware tend to repeatedly request web content from the same suspicious web content publishers and repeatedly engage in the same actions related to the web content of these suspicious web publishers. This may result in paying these suspicious web publishers for online content related to fraudulent access to their web content.

[0003] The IP address is one of the most important fingerprinting signals for tracking a client across websites. However, client security issues arise from the use of IP addresses. For example, the intentional IP blindness interpreter stipulates that any use of IP addresses will be counted against the privacy budget, with a few exceptions including anti-abuse / anti-fraud. By its nature, the IP address provides a unique identifier for the client, allowing the client to be found and routed to on the open Internet. Since the IP address is a passive source of information, the privacy budget interpreter describes that the IP address must be considered a consuming source of identification information for all websites and automatically deducted from the budget. In the face of growing concerns about the security of client data, this protocol feature has become a vulnerability, namely, if the IP address is stable over a period of time (which it often is), then the IP address can be used to identify the client on the first-party website.

[0004] Furthermore, for user data security reasons, using IP addresses to track users across multiple sites for any purpose may be impermissible. This is particularly problematic for APIs, which can themselves be a source of significant information, as the use of IP addresses by such systems would exceed any reasonable client data security budget. Websites facing privacy budgets that require more API access than is left after deducting IP address access require a way to opt out of exposing security-sensitive, client-identifiable IP addresses. Summary of the Invention

[0005] Generally speaking, one innovative aspect of the subject matter described in this specification can be embodied in a method for securely detecting online fraud malware. A mechanism is provided for blinding HTTP applications to IP addresses and other network information identifying clients (such as connection pool behavior), and publishing this fact to clients so that they can change their behavior accordingly. Another innovative aspect of the invention provides signed attestations that convey the fact that the IP address and other identifying network information is masked from the application layer of the service it hosts. A content delivery network (CDN) can provide this as a feature to the services it hosts, allowing the hosted services to access more APIs than would otherwise be available because their privacy budget has not been exhausted on IP addresses. Similarly, a reverse proxy can provide the same service without the burden of the hosted service.

[0006] The present invention provides a method for anti-abuse and anti-spam vendors to identify a set of IP addresses, or a combination of IP addresses and user agents, that consistently targets a small set of web pages, domains, or publishers while protecting client data. In this context, a user agent can be software that acts on behalf of a user, such as a web browser that retrieves, renders, and facilitates end-user interaction with web content. This method allows anti-abuse and anti-spam vendors to generalize browsers to preserve client data and other sensitive information, such as IP addresses.

[0007] The present invention also provides a method for enabling vendors to identify a set of IP addresses or combinations of IP addresses and user agents that consistently access or convert a small set of web pages, domains, or publishers, while promoting client data security. The method generalizes click-type activity to other activity types, such as page views or conversions.

[0008] The present invention also provides a method for enabling anti-abuse and anti-spam vendors to consistently identify a set of IP addresses, or combinations of IP addresses and user agents, with suspicious activity on a set of URLs, while protecting client data security. The method generalizes where suspicious activity occurs, for example, from individual URLs to websites to groups of related websites (such as those owned by the same entity). Advantageously, the method disclosed herein allows for identifying online fraud without requiring third-party cookies while maintaining data security.

[0009] The method relies on a general audience machine learning (ML) infrastructure. According to the method, the browser, under the direction of a fraud detection vendor, creates a user profile based on the browser's activity (e.g., page views, clicks, or conversions) on a web page, domain, or multiple domains owned by the same publisher. After the browser sends the encrypted user profile to a secure multi-party computation (MPC) cluster, the MPC cluster can optionally aggregate the user profile based on the browser's IP address and / or browser user agent string.

[0010] The method includes: creating two models, such as two k-NN or k-means models, using an MPC cluster. In one model, each neighbor is a browser or a set of browsers aggregated by IP address and / or user-agent string. The model finds all browsers or browsers aggregated by IP address and / or user-agent string that have similar online activity (e.g., page views, clicks, or conversions) at the same set of locations. A location can be a webpage, a domain, or multiple domains owned by the same publisher. In the second model, each neighbor is a location. The model finds all locations where similar groups of browsers (or browsers aggregated by IP address and / or user-agent string) have similar activity.

[0011] Combining these two models enables fraud detection vendors to identify fraudulent entities, such as browsers or browsers behind the same IP address and / or browser user agent. The fraud detection vendor can then create a block list for these fraudulent entities. Based on the block list, the MPC cluster can become a trust token issuer that issues trust tokens to entities that are not on the block list.

[0012] These and other embodiments may each optionally include one or more of these features.

[0013] Other embodiments of this aspect include corresponding systems, apparatus, and computer programs configured to perform the actions of the methods encoded on computer storage devices.

[0014] Certain embodiments of the subject matter described in this document can be implemented to achieve one or more of the following advantages. In certain environments, it was previously impossible to detect online fraud without third-party cookies while keeping client data secure. The techniques, devices, and systems discussed herein address this shortcoming. Among other use cases, the techniques described in this document enable systems to detect and overcome online fraud.

[0015] The details of one or more embodiments of the subject matter described in this specification are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the subject matter will become apparent from the description, drawings, and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 is a block diagram and flow chart of an example environment for performing online fraud detection while maintaining client data security.

[0017] Figure 2 A representation depicting the browser activity history.

[0018] Figure 3 A representation depicting the history of browser activity across locations.

[0019] Figure 4 is a block diagram and flow chart of an example process for detecting and mitigating online fraud malware.

[0020] Like reference numbers and designations in the various drawings indicate like elements. DETAILED DESCRIPTION

[0021] This document describes methods, systems, and devices that allow for secure detection of online fraudulent malware.

[0022] In some embodiments, the method utilizes a system that allows for the detection of online fraud malware while maintaining client privacy and client IP address obfuscation. According to the method, an anti-abuse and anti-spam vendor identifies a set of IP addresses or combinations of IP addresses and user agents that consistently click on a small set of domains, while keeping client data secure by generalizing browsers to other privacy-sensitive information (such as IP addresses). Additionally, according to the method, an anti-abuse and anti-spam vendor identifies a set of IP addresses or combinations of IP addresses and user agents that consistently visit or convert a small set of domains, while keeping client data secure by generalizing client activity across web content accesses. Additionally, according to the method, an anti-abuse and anti-spam vendor identifies a set of IP addresses or combinations of IP addresses and user agents that consistently have suspicious activity on a set of URLs, while keeping client data secure by generalizing the locations where the suspicious activity occurs.

[0023] In one embodiment, the method involves a browser maintaining a user profile on a client. The browser may include in the user profile information requests for web content, actions taken in response to the web content, the location of the web content, IP address, browser identification and version information, user agent string, etc. The browser securely shares the user profile with an anti-fraud vendor system, while maintaining user data security. The browser may be configured to send user profile information at a specified frequency (e.g., daily). The anti-fraud vendor system receives the user profile information. The anti-fraud vendor system may periodically send portions of the user profile information to an MPC server. In some embodiments, the browser, under the direction of the anti-fraud vendor system, securely sends the user profile directly to the MPC server. The MPC server participates in a multi-step secure computation based on similarities between user profiles to build a model. This model assists the anti-fraud vendor system in identifying clusters of IP addresses with similar browsing behavior. The MPC server sends the aggregated user profile results to the anti-fraud vendor. The anti-fraud vendor utilizes the aggregated user profile results when conducting anti-spam or anti-abuse analysis. Based on the anti-spam or anti-abuse analysis, the anti-fraud vendor may create one or more block lists. A blocklist may include a list of websites or website publishers determined to be involved in online fraud. The blocklist may also include clients, IP addresses, or combinations of IP addresses and user agents determined to be involved in online fraud. Based on the determination of fraud, the MPC server may issue a trust token indicating whether the client is determined to be involved in online fraud to clients, groups of clients, or all clients with the same IP address, group of IP addresses, or combination of IP addresses and user agents, based on the blocklist from the anti-fraud vendor system. Upon accessing the publisher's website, the browser may redeem the trust token from the MPC server. In the signed redemption record (SRR) issued to the browser at the end of the redemption process, the MPC server may carry an additional signal indicating whether the browser is fraudulent or whether the publisher website is fraudulent, based on the blocklist from the anti-fraud vendor system. The browser may include the SRR associated with the request for web content in a request to a digital component provider (such as an advertising technology provider). In some embodiments, based on a block list from an anti-fraud vendor system, the MPC server may refuse to issue a trust token to a browser on the block list, or may refuse to redeem a trust token while the browser is on a publisher website on the block list.

[0024] In one embodiment, a set of anti-fraud use cases to be detected and prevented according to the present invention can be viewed as an access graph, that is, a bipartite graph, the vertices of which can be divided into two unrelated and independent sets U and V, such that each edge connects a vertex in U with one of the vertices in V. In such an access graph, each vertex in U represents a cookie, a browser, an IP address, a combination of an IP address and a user agent, or some other set of client information related to a user. In such an access graph, each vertex in V represents a location, such as a uniform resource locator (URL), a domain, or a group of domains belonging to the same publisher. In such an access graph, each edge between a vertex in U and a vertex in V represents a particular user (e.g., a cookie, a browser, an IP address, a combination of an IP address and a user agent, or some other set of client information related to a user) engaging in an activity (e.g., a visit, a click, a conversion) at a particular location. Online fraud can be prevented by finding and To detect, such that a significant portion of the edges out of U' go to V', and / or a significant portion of the edges into V' are from U'. The significant portion can be 70% or more, however heuristic adjustments or ML may reveal other significant portions that are greater or less than 70%. This appropriate subset relationship indicates that the client and location are likely involved in online fraud. Various other methods can be used to determine whether a client, group of clients, IP address, group of IP addresses, or combination of IP address and user agent has been or is involved in online fraud, and the above method is one example.

[0025] In one embodiment, the method utilizes a generalized ML architecture. This generalized ML architecture may include two or more secure multi-party computation (MPC) servers, or MPC server clusters. The generalized MPC servers may be affiliated with one or more third-party entities. Generalized MPC servers affiliated with multiple third parties have the added benefit of obfuscating client IP data, browser activity, and location data across multiple independent servers, thereby reducing or inhibiting the risk of compromising client data security. MPC is a cryptographic mechanism that allows multiple parties to jointly compute inputs while revealing only limited, well-defined outputs. This guarantees that no data is compromised as long as at least a threshold number of parties remain honest. For example, MPC distributes trust among several assisting servers to meet the high-level goal of minimally trusted infrastructure on the assisting servers while enabling the computation of aggregated private outputs. The MPC protocol offers advantages in maintaining data security. For example, in a secure two-party computation setting, assisting servers cannot see data unimpeded unless both assisting servers collude, and data security is still maintained if one assisting server colludes with a third party.

[0026] In an optional embodiment, a trust token issuer that issues a trust token based on a device or application-level signal enables the receiving domain to verify that the HTTP request comes from an official version of the browser running on the trusted device. In this embodiment, the operating system may be involved in the definition or processing of the trust token.

[0027] Figure 1 The present invention is a block diagram and flow chart of an example environment for online fraud detection while maintaining client data security. The environment includes a browser 100, an anti-fraud vendor 110, and an MPC 120. Device 100 requests and displays web content based on a request from a user 130. User 130 can be a human user or a software entity such as an application, process, thread, program, etc.

[0028] Device 100 updates the user profile at the request of anti-fraud vendor 110. The frequency of updates may occur according to a formula that applies exponential decay to reduce the amount of stored user profile data to a constant:

[0029]

[0030] For each monitored event (e.g., ad request, impression, click, conversion, web content request), the anti-fraud vendor 110 provides a feature vector FV to the device 100 via a JavaScript API. i The event age (age) is record_age_in_seconds i The decay rate decay_rate_in_seconds controls how quickly old events lose weight and have less impact on the calculated user profile. Alternatively, the device 100 may calculate the number of events that require storage and FV i The number of user profiles is linearly related.

[0031] There are multiple ways to define the feature vector FV in the anti-fraud supplier system i One method is one-hot encoding. Figure 2As shown, the one-hot encoding is a feature vector 200 of a group of bits, where the only allowed combinations of values ​​220 are those with a single high (1) bit and all others low (0). In the case where there are a total of m ad-supported locations 210 (e.g., URLs, websites, domains, or publishers) that are prone to online fraud, the feature vector FV will be a sparse vector of m dimensions. Each element in the sparse vector corresponds to one location 210. For example, all elements in the sparse vector are 0, except for the element corresponding to the website just visited by the browser, which is 1. Alternatively, the feature vector 230 may have element values ​​250 representing the number of clicks on the location 240 during the study period. There are many popular methods for representing sparse vectors that require minimal storage space. For example, by storing only the non-zero entries of the sparse vector, significant reductions in memory requirements can be achieved. Depending on the number and distribution of the non-zero entries, different data structures can be used and significant memory savings can be achieved compared to the basic approach. The cost of efficient storage is that accessing individual elements becomes more complicated and additional structures are required to unambiguously recover the original vector. A storage format that supports efficient modification, such as DOK (Dictionary of Keys), LIL (List of Lists), or COO (List of Coordinates), is often used to construct matrices. Other storage formats include CSR (Compressed Sparse Row) or CSC (Compressed Sparse Column).

[0032] In one embodiment, the user profile can be calculated based on the feature vector. As described above with reference to the feature vector definition, the calculated user profile P i will be an m-dimensional sparse vector, where all elements in the vector are 0, except for the elements corresponding to the websites visited by the browser that are greater than 0. In order to detect a group of browsers that commit online fraud, it is sufficient for the browser to calculate the user profile locally according to the above formula. The MPC cluster 120 can use the profile to calculate the user profile of P based on the user profile. i and P j The cosine similarity between them is used to identify browsers with similar behaviors.

[0033] In one embodiment, the browser 100 may encrypt the user profile P i Divide into [P i ,1] and [P i ,2]. The cryptographic design ensures that each share itself appears to be identical to the secret user profile P i There is no similarity between the pseudo-random numbers. In order to reconstruct P i , the entity must have both the plaintext [P i ,1] and [P i ,2]. Then, the browser 100 will PublicKeyEncrypt([P i ,1],MPC1) and PublicKeyEncrypt([Pi ,2],MPC2) is sent to the anti-fraud vendor 110. In one embodiment, the anti-fraud vendor 110 sends all PublicKeyEncrypt ([P i ,1],MPC1) are uploaded to MPC1120 in batches, and all PublicKeyEncrypt([P i ,2],MPC2)Upload to MPC2.

[0034] In one embodiment, MPC1 and MPC2 participate in a multi-step secure computation to i and P j The k-NN model is established based on the cosine similarity between two vectors. A probabilistic algorithm based on random projections and Hamming distance calculates the cosine similarity of ciphertexts to keep user data secure under the honest-but-curious security model. Cosine similarity measures the similarity between two non-zero vectors in the inner product space. It is defined as the cosine of the angle between them, which is also the same as the inner product of the same vector normalized to have length 1. Random projections are designed to approximate the cosine distance between two vectors. For example, a random hyperplane (defined by the normal unit vector r) is selected at the beginning and used to hash the two input vectors to obtain the cosine distance. The cosine distance between two vectors indicates similarity. For example, if the angle between two vectors is 0°, the two vectors are similar or identical. If the angle is 90°, there is no similarity between the two vectors. Moreover, if the angle is 180°, the two vectors are opposite to each other. The Hamming distance between two vectors of equal length is the number of positions where the corresponding signs differ, which also indicates the similarity or dissimilarity between the two vectors. An honest but curious (HBC) adversary is a legitimate participant in a communication protocol that does not deviate from the defined protocol but will attempt to learn all possible information from legitimately received messages. According to the object of the present invention, encoding user profiles and operating on encoded shares of user profiles can keep user data secure.

[0035] In one embodiment, to detect a group of IP addresses (or crosses between IP addresses and user agents) with similar suspicious behavior, the user profile calculated by the above formula may not be sufficient. Instead, the MPC cluster can aggregate the user profiles reported by individual browsers by IP address (or crosses between IP addresses and user agents). Taking MPC1 as an example, the aggregation may occur as follows. MPC1 receives an encrypted report with the following information: browser IP address, browser user agent string (optional), user profile [P i ,1], the secret share of user profile ti timestamp. MPC1 computes the aggregate key of the user profiles' secret shares as HMAC(browser_ip_address||optional_user_agent_string, secret_key_for_model_version). For all secret shares of user profiles that share the same aggregate key, MPC1 computes the sum of all profiles associated with the IP address (or the intersection between the IP address and the user agent). The combined profiles of the IP addresses (or the intersection between the IP addresses and the user agent) enable the construction of a k-NN model that identifies clusters of IP addresses with similar behavior. For clarity, "user profile" in this document refers to any of a browser's user profile, a combined profile of an IP address, or a combined profile of the intersection between an IP address and a user agent.

[0036] In one embodiment, the MPC cluster builds multiple models to detect fraudulent browser activity and fraudulent locations using the same training data set. For example, the MPC cluster may attempt to identify clusters of browsers that commit online fraud on a small number of websites. To do this, the MPC cluster may build two models, one model that identifies browsers with similar behavior, and another model that identifies websites that interact with a set of similar browsers. To determine browsers with similar behavior, the MPC server may receive a list of user profiles from an anti-fraud vendor. Each user profile is a sparse vector of m dimensions, corresponding to m websites. Each user profile is represented as a row vector of size n for the list of user profiles. By computing the cosine distance between pairs of user profiles and building k-NN models accordingly, MPC1 and MPC2 can identify clusters of browsers with similar behavior. Reference Figure 3 To identify websites that interact with a similar set of browsers, MPC1 can stack n user profiles 320 into an n×m matrix 300. In this matrix 300, each column vector 310 encodes the entire browser behavior on the corresponding website. By calculating the cosine distance between pairs of column vectors 310 and building a k-NN model accordingly, MPC1 and MPC2 can identify clusters of websites with similar user interactions, for example, websites that receive most clicks from the same set of browsers.

[0037] In one embodiment, the MPC cluster returns aggregated results (e.g., two k-NN models) to the anti-fraud system. The anti-fraud system uses these aggregated results to identify clusters of browsers that commit online fraud on a small number of websites. The anti-fraud system applies queries to the two k-NN models. These queries identify: a small number of websites that have high cosine similarities (as discussed herein) between them (e.g., columns in an n×m sparse matrix); a small number of browsers, or IP addresses, or IP addresses across user agent strings that have high cosine similarities between these clusters (e.g., rows in an n×m matrix); and a small number of browser clusters that contribute most of the clicks or interactions received by the small number of websites identified in response to the first query. In the matrix representation, within the n×m sparse matrix, most of the non-zero elements in the columns corresponding to the small number of websites are concentrated on the rows corresponding to the browsers.

[0038] In one embodiment, heuristics can be applied to query results to identify browsers and locations that are involved in online fraud. Based on actual results, these heuristics can be adjusted to reduce false positives while eliminating the majority of online fraud. For example, if 90% of a website's page views come from 1,000 browsers, and 80% of those browsers' page views are on that website, then those 1,000 browsers and websites are suspected of online fraud.

[0039] In one embodiment, once the heuristic method reveals the results of aggregation and analysis, measures can be taken to prevent online fraud. For example, browsers and locations determined by the anti-fraud vendor system to be involved in online fraud can be placed on a shield list. Browsers, IP addresses, or IP addresses across user agent strings determined to be involved in online fraud will be added to a browser shield list. Locations determined to be involved in online fraud will be added to a location shield list. Browsers on the browser shield list do not display digital components, such as revenue-generating content (e.g., advertisements). Locations on the location shield list are not provided with digital components (also such as revenue-generating content) by the vendor, so digital components, such as revenue-generating content, are not displayed at locations on the shield list. Advantageously, in the case where the digital component is revenue-generating content, the location on the shield list does not display the revenue-generating content. In the case of more general digital components, preventing these components from being displayed at locations on the shield list can reduce network traffic and processing load because these components do not need to be transmitted or rendered, and reduce the possibility of exposure to malware. Without the claimed method, traditional systems may transmit all digital components without first filtering them through the fraud entity's shield list, significantly increasing network bandwidth and processing requirements, and increasing exposure to malware.

[0040] In one embodiment, after querying and heuristic analysis, the anti-fraud vendor can create a list of locations (e.g., URLs, websites, or publishers) corresponding to a subset of the columns in the n×m sparse matrix that are involved in online fraud. Consequently, the provider of the digital component can block these locations from receiving the digital component. For example, an ad tech company can block these locations from serving ads. Because the identification of these locations determined to be involved in online fraud is generally not sensitive to data security or privacy, the digital component provider (such as an ad tech company) can receive the list of these locations directly from the anti-fraud vendor or MPC cluster in plain text and build a block list accordingly.

[0041] For reasons of data security and privacy, it may be undesirable to share a list of browsers, IP addresses, or the intersection of IP addresses and user agents in plain text. In one embodiment, to address data security and privacy issues, an embodiment of a trust token may be desirable.

[0042] In one embodiment, the trust token API notifies a digital component provider (such as an ad technology provider) whether a browser, a browser associated with a particular IP address, or a browser associated with a particular IP address and user agent string is determined to be engaging in online fraud. Figure 4 A block diagram and flow chart for utilizing a trust token mechanism are provided. The anti-fraud system 420 queries two k-NN models created and owned by the MPC cluster 400. The anti-fraud system 420 analyzes the aggregated reports received from the MPC cluster 400 to identify clusters of browsers that are likely to be involved in online fraud. The anti-fraud system 420 uploads clusters of browsers to be blocked to the MPC cluster 400. Each cluster can be identified by the maximum Hamming distance from the cluster center represented by a bit vector. The MPC cluster 400 calculates the Hamming distance between the bit vector of the user profile uploaded by the browser and the center of any cluster to be blocked. If any Hamming distance is less than the corresponding Hamming distance threshold, the browser is likely to be involved in online fraud and should be blocked. The MPC cluster 400 can issue a trust token to the browser 430 accordingly, for example, encoding whether the browser 430 is likely to be involved in online fraud in a hidden bit. Later, when the browser visits the publisher's website, the browser 430 redeems the trust token and makes a signed redemption record (SRR) (also referred to as a redeemed record) available in a request to the digital component provider 410 (such as an ad-tech provider). Because the trust token relies on a specially designed issuance and redemption process that employs encryption technology, ad-tech companies cannot use the trust token to track individuals, browsers, IP addresses, etc., ensuring data security and privacy.

[0043] An electronic document (which for brevity will simply be referred to as a document) does not necessarily correspond to a file. A document may be stored in a portion of a file that holds other documents, in a single file dedicated to the document in question, or in multiple coordinated files.

[0044] The subject matter and embodiments of the operations described in this specification may be implemented in digital electronic circuits, or in computer software, firmware, or hardware including the structures disclosed in this specification and their structural equivalents, or in a combination of one or more of these. The embodiments of the subject matter described in this specification may be implemented as one or more computer programs, i.e., one or more modules of computer program instructions, encoded on a computer storage medium (or media) for execution by a data processing device or to control the operation of the data processing device. Additionally or alternatively, the program instructions may be encoded on an artificially generated propagated signal, such as a machine-generated electrical, optical, or electromagnetic signal, which is generated to encode information for transmission to an appropriate receiving device for execution by the data processing device. The computer storage medium may be a computer-readable storage device, a computer-readable storage substrate, a random or serial access memory array or device, or a combination of one or more of these, or be included therein. Furthermore, although a computer storage medium is not a propagated signal, a computer storage medium may be a source or destination of computer program instructions encoded in an artificially generated propagated signal. The computer storage medium may also be one or more separate physical components or media (e.g., multiple CDs, disks, or other storage devices), or be included therein.

[0045] The operations described in this specification can be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

[0046] The term "data processing apparatus" encompasses all types of apparatus, devices, and machines for processing data, including, for example, a programmable processor, a computer, a system on a chip, or a plurality or combination thereof. The apparatus may include dedicated logic circuitry, such as an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit). In addition to hardware, the apparatus may also include code that creates an execution environment for the relevant computer program, such as code constituting processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or a combination of one or more thereof. The apparatus and execution environment may implement a variety of different computing model infrastructures, such as network services, distributed computing, and grid computing infrastructures.

[0047] A computer program (also referred to as a program, software, software application, script, or code) may be written in any form of programming language (including compiled or interpreted languages, declarative or procedural languages), and it may be deployed in any form, including as a stand-alone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program may be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files that store portions of one or more modules, subroutines, or code). A computer program may be deployed to execute on one computer or on multiple computers located in one location or distributed across multiple locations and interconnected by a communications network.

[0048] The processes and logic flows described in this specification can be performed by one or more programmable processors executing one or more computer programs to perform actions by operating on input data and generating output. The processes and logic flows can also be performed by, and the apparatus can be implemented as, special purpose logic circuitry, such as an FPGA (field programmable gate array) or an ASIC (application-specific integrated circuit).

[0049] For example, processors suitable for executing computer programs include general-purpose and special-purpose microprocessors. Generally, a processor will receive instructions and data from read-only memory or random access memory, or both. The essential elements of a computer are a processor for performing actions according to instructions and one or more memory devices for storing instructions and data. Generally, a computer also includes one or more mass storage devices (e.g., magnetic, magneto-optical, or optical disks) for storing data, or is operatively coupled thereto to receive data from or transfer data to the mass storage devices. However, a computer need not have such devices. Furthermore, a computer may be embedded in another device, such as a mobile phone, personal digital assistant (PDA), mobile audio or video player, game console, global positioning system (GPS) receiver, or portable storage device (e.g., universal serial bus (USB) flash drive), among others. Devices suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and storage devices, including, for example: semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in, special purpose logic circuitry.

[0050] To provide for interaction with a user, embodiments of the subject matter described herein may be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices may also be used to provide for interaction with the user; for example, feedback provided to the user may be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user may be received in any form, including voice, speech, or tactile input. Furthermore, a computer may interact with a user by sending documents to and receiving documents from a device used by the user; for example, by sending a web page to a web browser on a user's client device in response to a request received from the web browser.

[0051] Embodiments of the subject matter described in this specification can be implemented on a computing system that includes a back-end component (e.g., as a data server) or includes a middleware component (e.g., an application server) or includes a front-end component (e.g., a client computer having a graphical user interface or a web browser through which a user can interact with an implementation of the subject matter described in this specification), or any combination of one or more such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include local area networks ("LANs") and wide area networks ("WANs"), internetworks (e.g., the Internet), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks).

[0052] A computing system may include a client and a server. The client and server are generally remote from each other and typically interact via a communication network. The relationship between client and server arises from computer programs running on respective computers and having a client-server relationship with each other. In some embodiments, the server transmits data (e.g., an HTML page) to a client device (e.g., to display data to a user interacting with the client device and to receive user input from the user). Data generated at the client device (e.g., a result of user interaction) may be received at the server from the client device.

[0053] Although this specification contains many specific implementation details, these should not be understood as limitations on the scope of any invention or what may be claimed, but rather as descriptions of features that are unique to particular embodiments of particular inventions. Specific features described in this specification in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented separately or in any appropriate sub-combination in multiple embodiments. Furthermore, although features may be described above as functioning in a particular combination, and even initially claimed as such, in some cases one or more features in the combination may be removed from the claimed combination, and the claimed combination may be directed to a sub-combination or a variant of the sub-combination.

[0054] Similarly, although the drawings depict operations in a particular order, this should not be construed as requiring that the operations be performed in the particular order shown, or in sequential order, or that all of the illustrated operations be performed to achieve the desired result. In certain circumstances, multitasking and parallel processing may be advantageous. Furthermore, the separation of the various system components in the above-described embodiments should not be construed as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product, or packaged into multiple software products.

[0055] Thus, specific embodiments of the present subject matter have been described. Other embodiments are also within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired results. Furthermore, the processes depicted in the accompanying figures do not necessarily require the specific order shown or sequential order to achieve the desired results. In certain embodiments, multitasking and parallel processing may be advantageous.

Claims

1. A method for detecting online fraud malware, comprising: generating an encrypted profile representing web browser activity; The encrypted profile is sent to a secure multi-party computation system, wherein: The first share of the encryption profile is sent to a first server of the secure multi-party computation system; The second share of the encryption profile is sent to a second server of the secure multi-party computation system; and Both the first share and the second share are required to reconstruct the encryption profile; receiving a trust token from a secure multi-party computing system, the trust token indicating whether the web browser is involved in online fraud; When preparing to send a request for web content through a web browser, sending a request to redeem the trust token to the secure multi-party computing system; In response to the request to redeem the trust token, based on determining that the website associated with the web content is not blocked, receiving a signed redemption record from the secure multi-party computing system; and A request including a signed redemption record is sent for third-party content, wherein the third-party content is associated with the network content.

2. The method according to claim 1, wherein Based on determining that the website associated with the web content is blocked, a signed redemption record is not received from the secure multi-party computation system in response to a request to redeem the trust token.

3. The method according to claim 1, further comprising: generating a second encrypted profile representing browser activity; as well as sending a second cryptographic profile to the secure multi-party computing system to request a second trust token, In response to determining that the web browser is involved in online fraud, the second trust token is not received from the secure multi-party computing system, or if the web browser is determined to be involved in online fraud, the second trust token with a hidden bit indicating "fraud" is received.

4. The method according to claim 1, wherein Signed redemption records contain indications that determine whether a browser, or a browser aggregated across IP addresses, or a user agent string, has engaged in online fraud.

5. The method according to claim 1, wherein The third party content is displayed via the web browser upon signing a redemption record of a predetermined value indicating that the browser, or the browser aggregated on an IP address or user agent string, is determined to not be engaged in online fraud.

6. The method according to claim 1, wherein The trust token contains an encoded indicator that the web browser has been determined to be involved in online fraud.

7. The method according to claim 1, wherein A cryptographic profile represents browser activity on a web page, domain, or multiple domains owned by the same publisher.

8. The method according to claim 1, wherein Browser activity includes page views, clicks, or conversions.

9. The method according to claim 1, wherein Sending the encrypted profile to the secure multi-party computing system results in the aggregation of the encrypted profile representing the browser history based on the IP address or browser user agent string.

10. The method according to claim 1, wherein Sending the encryption profile to the secure multi-party computation system results in the generation of a shield list.

11. The method according to claim 10, wherein: Blocklists identify webpages, domains, or multiple domains owned by the same publisher that are determined to be associated with online fraud.

12. The method according to claim 10, wherein: Blocklists identify browsers, browsers aggregated across IP addresses, or user-agent strings identified as being associated with online fraud.

13. The method according to claim 1, wherein The encryption profile includes a feature vector that indicates a web page or domain or indicates the number of times a user visited or otherwise interacted with the web page or domain.

14. A non-transitory computer storage medium encoded with instructions that, when executed by a distributed computing system, cause the distributed computing system to perform operations comprising: generating an encrypted profile representing web browser activity; The encrypted profile is sent to a secure multi-party computation system, wherein: The first share of the encryption profile is sent to a first server of the secure multi-party computation system; The second share of the encryption profile is sent to a second server of the secure multi-party computation system; and Both the first share and the second share are required to reconstruct the encryption profile; receiving a trust token from a secure multi-party computing system, the trust token indicating whether the web browser is involved in online fraud; When preparing to send a request for web content through a web browser, sending a request to redeem the trust token to the secure multi-party computing system; In response to the request to redeem the trust token, based on determining that the website associated with the web content is not blocked, receiving a signed redemption record from the secure multi-party computing system; and A request including a signed redemption record is sent for third-party content, wherein the third-party content is associated with the network content.

15. The non-transitory computer storage medium of claim 14, wherein: A cryptographic profile represents browser activity on a web page, domain, or multiple domains owned by the same publisher.

16. The non-transitory computer storage medium of claim 14, wherein: Based on determining that the website associated with the web content is blocked, a signed redemption record is not received from the secure multi-party computation system in response to a request to redeem the trust token.

17. The non-transitory computer storage medium of claim 14, the operations further comprising: generating a second encrypted profile representing browser activity; as well as sending a second cryptographic profile to the secure multi-party computing system to request a second trust token, In response to determining that the web browser is involved in online fraud, the second trust token is not received from the secure multi-party computing system, or if the web browser is determined to be involved in online fraud, the second trust token with a hidden bit indicating "fraud" is received.

18. The non-transitory computer storage medium of claim 14, wherein: Signed redemption records contain indications that determine whether a browser, or a browser aggregated across IP addresses, or a user agent string, has engaged in online fraud.

19. The non-transitory computer storage medium of claim 14, wherein: The third party content is displayed via the web browser upon signing a redemption record of a predetermined value indicating that the browser, or the browser aggregated on an IP address or user agent string, is determined to not be engaged in online fraud.

20. The non-transitory computer storage medium of claim 14, wherein: Sending the encryption profile to the secure multi-party computation system results in the generation of a shield list.

Images