Real-Time Detection and Redirection from Counterfeit Websites

Abstract

Counterfeit uniform resource locators (URLs) are detected and blocked in real-time by a browser extension in communication with a counterfeit URL detection system. The browser extension receives a URL requested within a browser application. Content from a webpage associated with the received URL is extracted and transmitted to the counterfeit URL detection system, which is configured to analyze the content and return an assessment indicating whether the URL is counterfeit. If the assessment indicates that the URL is counterfeit, the browser extension blocks the browser application from accessing content associated with the URL and redirects the browser extension to a legitimate URL.

1 . A method comprising:
 receiving, at a browser extension operating in a browser application, a uniform resource locator (URL) requested within the browser application;   obtaining information indicating that the received URL is a counterfeit URL;   comparing content extracted from a website associated with the received URL with content associated with websites associated with each of a plurality of legitimate URLs based on obtaining information indicating that the received URL is counterfeit;   identifying a first legitimate URL included in the plurality of legitimate URLs whose associated website includes content that exceeds a threshold similarity to the content of the website associated with the received URL; and   redirecting the browser application to the first legitimate URL based on identifying the first legitimate URL with content exceeding the threshold similarity to the content of the website associated with the received URL.   
     
     
         2 . The method of  claim 1 , further comprising:
 transmitting the extracted content from the website associated with the received URL to a counterfeit URL detection system configured to analyze the extracted content, wherein said obtaining information includes receiving an assessment from the counterfeit URL detection system indicating that the received URL is counterfeit.   
     
     
         3 . The method of  claim 1 , further comprising:
 comparing the received URL with a listing of known counterfeit URLs, wherein said obtaining information includes matching the received URL with any counterfeit URL listed in the listing of known counterfeit URLs, indicating that the received URL is counterfeit.   
     
     
         4 . The method of  claim 1 , further comprising:
 responsive to obtaining information indicating that the received URL is counterfeit, blocking the browser application from accessing content associated with the received URL.   
     
     
         5 . The method of  claim 1 , wherein a portion of the plurality of legitimate URLs are included in a primary listing of legitimate URLs that represent legitimate entities that are subscribed to receive redirected URL requests, wherein the first legitimate URL is included in the primary listing of legitimate URLs. 
     
     
         6 . The method of  claim 1 , further comprising:
 identifying a first set of characteristics of the content extracted from the website associated with the received URL, the first set of characteristics including at least one of detected objects, detected text, and detected source information included in the content extracted from the website associated with the received URL; and   identifying a plurality of characteristics of the website associated with the first legitimate URL,   wherein said comparing includes:
 comparing the first set of characteristics with the plurality of characteristics to determine a number of common characteristics between the first set of characteristics and the plurality of characteristics; and 
 determining that the number of common characteristics between the first set of characteristics and the plurality of characteristics exceeds a threshold number of common characteristics representing that the website associated with first legitimate URL is within the threshold similarity to the website associated with the received URL. 
   
     
     
         7 . The method of  claim 1 , further comprising:
 determining that all websites associated with legitimate URLs included in a portion of the plurality of legitimate URLs listed in a primary listing of legitimate URLs do not exceed the threshold similarity to the extracted content of the website associated with the received URL;   comparing content extracted from the website associated with the received URL with content associated with web sites of a portion of the plurality of legitimate URLs listed in a secondary listing of legitimate URLs, wherein the first legitimate URL is included in the secondary listing of legitimate URLs.   
     
     
         8 . The method of  claim 7 , further comprising:
 identifying a primary characteristic of the extracted content of the website associated with the received URL;   identifying each legitimate URL included in the secondary listing of legitimate URLs whose associated website includes characteristics matching the primary characteristic,
 wherein said redirecting the browser application to the first legitimate URL is based on determining that the bid associated with the first legitimate URL is greater than any bids of the other legitimate URLs included in the secondary listing of legitimate URLs whose associated websites include characteristics matching the primary characteristic. 
   
     
     
         9 . The method of  claim 1 , further comprising:
 recording, by the browser extension, user interactions with one of the received URL and the first legitimate URL; and   generating analytics that quantify the user interactions with one of the received URL and the first legitimate URL.   
     
     
         10 . The method of  claim 9 , wherein the analytics include at least one of: a number of URL requests received, a number of instances that the browser application was redirected from any received URL to a legitimate URL, a number of instances in which the browser application was redirected to any legitimate URL listed on a primary listing of legitimate URLs, and a number of instances in which the browser application was redirected to any legitimate URL listed on a secondary listing of legitimate URLs. 
     
     
         11 . The method of  claim 1 , wherein the browser extension operating in the browser application is configured to execute on a smartphone. 
     
     
         12 . A non-transitory computer-readable storage medium storing a browser extension that comprises computer program instructions, the computer program instructions when executed by a processor causing the processor to:
 receive a uniform resource locator (URL);   obtain information indicating that the received URL is a counterfeit URL;   extract content from a webpage associated with the received URL and from webpages associated with each of a plurality of legitimate URLs associated with legitimate entities;   compare the extracted content from the webpage associated with the received URL and the extracted content from the webpages associated with each of the plurality of legitimate URLs to identify a first legitimate URL included in the plurality of legitimate URLs whose associated webpage has a similarity to the content of the webpage associated with the received URL that exceeds a threshold similarity; and   redirect a browser application to the first legitimate URL based on identifying the first legitimate URL.   
     
     
         13 . The non-transitory computer-readable storage medium of  claim 12 , wherein the computer program instructions, when executed by the processor, further cause the processor to:
 compare the received URL with a listing of known counterfeit URLs; and   transmit the extracted content of the webpage associated with the received URL to a counterfeit URL detection system configured to analyze the extracted content based on failing to match the received URL with any known counterfeit URL listed on the listing of known counterfeit URLs, wherein said obtaining information includes receiving an assessment from the counterfeit URL detection system indicating that the received URL is counterfeit.   
     
     
         14 . The non-transitory computer-readable storage medium of  claim 12 , wherein the computer program instructions, when executed by the processor, further cause the processor to:
 identify no legitimate URL, included in a listing of known legitimate URLs that have subscribed to receive redirected browser extensions, that has an associated webpage having a similarity to the extracted content of the webpage associated with the received URL that exceeds the threshold similarity; and   inspect extracted content from webpages associated with legitimate URLs included in a secondary listing of legitimate URLs, wherein the first legitimate URL is included in the secondary listing of legitimate URLs.   
     
     
         15 . The non-transitory computer-readable storage medium of  claim 12 , wherein the computer program instructions, when executed by the processor, further cause the processor to:
 record, by the browser extension, user behaviors and interactions with the received URL and the first legitimate URL;   generate analytics that quantify the user behaviors and interactions with the received URL and the first legitimate URL; and   display the analytics on a webpage.   
     
     
         16 . A method comprising:
 receiving a request to access a webpage associated with a requested uniform resource locator (URL) at a browser extension operating in a browser application on a user device;   applying a first model to content extracted from the webpage, the first model trained to output an assessment indicating that the requested URL is counterfeit;   determining that content extracted from a webpage associated with a legitimate URL has a similarity to content extracted from the webpage associated with the requested URL that exceeds a threshold similarity;   redirecting the browser application from the requested URL to the legitimate URL based on the exceeded threshold similarity;   recording interactions between the user device and the requested URL and the legitimate URL; and   generating one or more analytics based on the recorded interactions.   
     
     
         17 . The method of  claim 16 , wherein the analytics include at least one of: a number of URL requests received, a number of instances that the browser application was redirected from any requested URL to a legitimate URL, a number of instances in which the browser application was redirected to any legitimate URL listed on a primary listing of legitimate URLs, and a number of instances in which the browser application was redirected to any legitimate URL listed on a secondary listing of legitimate URLs. 
     
     
         18 . The method of  claim 16 , wherein the extracted content of any of the webpage associated with the requested URL and the webpage associated with the legitimate URL comprises at least one of: an object detected in an image extracted from the webpage, text extracted from the webpage, a hypertext transfer protocol (HTTP) request header or body, and an HTTP response header or body. 
     
     
         19 . The method of  claim 16 , further comprising:
 determining, from the recorded interactions, that a number of instances in which the browser application was redirected from a requested URL to a legitimate URL exceeds a threshold number; and   displaying a social engineering module on the user device, the social engineering module providing instructions to identify legitimate URLs and avoid counterfeit URLs.   
     
     
         20 . The method of  claim 16 , further comprising:
 determining, from the recorded interactions, that a number of instances in which the browser application was redirected from a requested URL to a legitimate URL exceeds a threshold number; and   implementing a training module on the user device, the training module providing a series of instructions to train a user to identify legitimate URLs and avoid counterfeit URLs, wherein the training module tracks a progression of the user through the series of instructions.