Systems and methods for providing user interfaces based on actions associated with untrusted emails

Patent metadata

Field	Value
Publication number	US-10659487-B2
Application number	US-201916517135-A
Country	US
Kind code	B2
Filing date	Jul 19, 2019
Priority date	May 8, 2017
Publication date	May 19, 2020
Grant date	May 19, 2020

Abstract

The present disclosure describes a system that notifies users regarding specific user decisions with respect to solution phishing emails. The system notifies users when users perform specific actions with respect to the untrusted phishing emails. The system pauses execution of these actions and prompts the user to confirm whether to take the actions or to revert back to review the actions. In contrast from anti-ransomware technologies which are entirely in control, the system gives the user autonomy in deciding actions relating to untrusted phishing emails. The system interrupts execution of actions related to untrusted phishing emails in order to give users a choice on whether to proceed with actions.

First claim

What is claimed is:

1. A method comprising
(a) detecting, by a driver, that an application received a request of a user to take an action with respect to one of an untrusted domain or an untrusted email;
(b) intercepting, by the driver, the request of the user prior to the action being taken, wherein the application is paused;
(c) providing, by a client service responsive to the driver, a user interface to receive input from the user to confirm whether to continue to take the action or to revert back to a point in the application at which the user made the request, wherein the user interface receives input to revert back to the point in the application at which the user made the request;
(d) unpausing the application responsive to the input; and
(e) reverting the application back to the point in the application in which the user made the request.

2. The method of claim 1 , wherein (a) further comprises monitoring execution of the application via one or more processes initiated from the application.

3. The method of claim 1 , wherein (a) further comprises detecting, by the driver, the request to take the action comprising opening a file via the untrusted email.

4. The method of claim 1 , wherein (a) further comprises detecting, by the driver, the request to take the action comprising clicking on a uniform resource locator of the untrusted domain.

5. The method of claim 1 , further comprising one of the driver or the client service pausing execution of the application.

6. The method of claim 1 , wherein (c) further comprises receiving input via the user interface confirming to continue to take the action.

7. The method of claim 6 , wherein (e) further comprises allowing the application to continue to take the action.

8. The method of claim 1 , wherein (d) further comprises one of the driver or the client service unpausing execution of the application.

9. A system comprising
a driver executable on one or more processors, coupled to memory and configured to:
detect that an application received a request of a user to take an action with respect to one of an untrusted domain or an untrusted email and intercept the request of the user prior to the action being taken; and
wherein the application is paused;
a client server executable on one or more processors, coupled to memory and configured to provide, responsive to the driver, a user interface to receive input from the user to confirm whether to continue to take the action or to revert back to a point in the application at which the user made the request;
wherein the application is unpaused responsive to the input; and
wherein responsive to the user interface receiving input to revert back to the point in the application, the application is reverted back to the point in the application in which the user made the request.

10. The system of claim 9 , wherein the driver is further configured to monitor execution of the application via one or more processes initiated from the application.

11. The system of claim 9 , wherein the driver is further configured to detect the request to take the action comprising opening a file via the untrusted email.

12. The system of claim 9 , wherein the driver is further configured to detected the request to take the action comprising clicking on a uniform resource locator of the untrusted domain.

13. The system of claim 9 , wherein one of the driver or the client service is further configured to pause execution of the application.

14. The system of claim 9 , wherein the user interface is further configured to receive input via the user interface confirming to continue to take the action.

15. The system of claim 14 , wherein the application is allowed to continue to take the action.

16. The system of claim 9 , wherein one of the driver or the client service is further configured to unpause execution of the application.

Assignees

• Knowbe4 Inc

Inventors

• Lowry Bret
• Repuspolo Gauvin
• Kras Greg

Classifications

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06F2221/2119

  Authenticating web pages, e.g. with suspicious links · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title