Deceptive Ad Mitigation via Metadata-Based Advertiser Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deceptive advertisements pose a security risk and nuisance to users by insulating software vendors from bad advertiser behavior, making it difficult to identify and mitigate malicious ads, especially since unscrupulous advertisers frequently change URLs, rendering existing security solutions ineffective.
Innovation Solution
A system and method that utilize campaign and partner identifiers to assign reputations, leveraging existing security infrastructures, such as antivirus applications, to identify and block deceptive advertisements by querying reputation caches and taking remedial actions, including blocking URLs and disabling interactions with deceptive ads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security solutions use URL-based identification to block deceptive advertisements, then they can identify malicious ads, but unscrupulous advertisers can frequently change URLs to evade detection, rendering the security solutions ineffective
Solution Approach 1:
The patent introduces an intermediary identifier (advertiser ID extracted from metadata) that mediates between the user and the advertiser. Instead of directly tracking URLs which change frequently, the system uses this intermediary identifier to consistently identify the advertiser across multiple URL changes. The intermediary acts as a stable reference point that connects varying URLs to a single advertiser entity, enabling reliable blocking despite URL manipulation.
Solution Approach 2:
The system performs preliminary action by extracting and storing the advertiser ID from metadata before the user interacts with the advertisement. By pre-identifying the advertiser through metadata analysis and querying the reputation cache in advance, the system establishes a baseline for identification that remains valid even after the advertiser changes URLs. This preliminary identification creates a persistent reference that outlasts URL changes.
2Reliability
If security systems inspect metadata objects to identify advertisers, then they can consistently identify malicious advertisers, but the inspection and parsing process increases system complexity
Solution Approach 1:
The patent extracts only the essential advertiser identification string from the metadata object, separating this critical information from the rest of the complex metadata structure. By taking out just the necessary identifier portion and using it for reputation checking, the system reduces the complexity burden while maintaining reliable identification. This extraction approach focuses computational effort on the most relevant data element.
Solution Approach 2:
The metadata object contains the advertiser identification information in a structured format that can be automatically parsed without extensive manual intervention. The system leverages the self-organizing nature of the metadata structure, where the advertiser ID is readily accessible through standard parsing operations, reducing the need for complex analysis algorithms.
3Object-affected harmful factors
If security solutions block all advertisements from advertisers with deceptive reputations, then they protect users from malicious software, but they may also block legitimate advertisements and reduce user access to useful software
Solution Approach 1:
The system implements feedback through the reputation cache mechanism, where advertisers are evaluated based on their historical behavior and reputation scores. This feedback loop allows the system to distinguish between genuinely malicious advertisers and those who may have had isolated incidents. The reputation system provides nuanced feedback that enables selective blocking, protecting users from consistently harmful advertisers while potentially allowing advertisers with good or neutral reputations to continue operating.
Data Source
AI summary
There is disclosed in one example a computing apparatus, including: a processor and a memory; instructions encoded within the memory to instruct the processor to: identify a downloaded file on a file system; inspect a metadata object attached to the downloaded file; parse the metadata object to extract an advertiser identification string from a GET code portion of a uniform resource locator (URL); query a reputation cache for a reputation for the advertiser identification string; receive a deceptive reputation for the advertiser identification string; and take a remedial action against the downloaded file.