Systems and methods for providing user interfaces based on actions associated with untrusted emails

Patent metadata

Field	Value
Publication number	US-11240261-B2
Application number	US-202016850695-A
Country	US
Kind code	B2
Filing date	Apr 16, 2020
Priority date	May 8, 2017
Publication date	Feb 1, 2022
Grant date	Feb 1, 2022

Abstract

The present disclosure describes a system that notifies users regarding specific user decisions with respect to solution phishing emails. The system notifies users when users perform specific actions with respect to the untrusted phishing emails. The system pauses execution of these actions and prompts the user to confirm whether to take the actions or to revert back to review the actions. In contrast from anti-ransomware technologies which are entirely in control, the system gives the user autonomy in deciding actions relating to untrusted phishing emails. The system interrupts execution of actions related to untrusted phishing emails in order to give users a choice on whether to proceed with actions.

First claim

What is claimed is:

1. A method comprising:
intercepting, by the device, a first request of a user to take an action for an application, executing on the device, with respect to one of a domain or a communication not determined to be trusted;
pausing, by the device, execution of the application at a point in the application at which the user made the first request;
receiving, by the device, a second request from the user to revert back to the point in the application at which the user made the first request; and
reverting the application back to the point in the application in which the user made the first request and unpausing the application to cause the application to continue to execute from the point in the application.

2. The method of claim 1 , further comprising detecting, by the device, the first request of the user prior to taking the action.

3. The method of claim 1 , further comprising providing, by the device, a user interface configured to receive the second request from the user to confirm whether to continue to take the action or to revert back to the point in the application at which the user made the first request.

4. The method of claim 1 , wherein a driver of the device is configured to one of detect or intercept the first request of the user.

5. The method of claim 1 , wherein a client service of the device is configured to receive the second request from the user to revert back to the point in the application at which the user made the first request.

6. The method of claim 1 , wherein the action comprises interacting with one of a link or uniform resource locator associated with the domain.

7. The method of claim 1 , wherein the action comprises interacting with one of an attachment or a file associated with the communication.

8. The method of claim 1 , wherein the application comprises a messaging application.

9. The method of claim 1 , wherein the application comprises an email client.

10. The method of claim 1 , wherein one of the domain or the communication is one of untrusted or not yet determined to be trusted.

11. A system comprising:
one or more processors, coupled to memory, and configured to:
intercept a first request of a user to take an action for an application, executing on the one or more processors, with respect to one of a domain or a communication not determined to be trusted;
pause execution of the application at a point in the application at which the user made the first request;
receive a second request from the user to revert back to the point in the application at which the user made the first request; and
revert the application back to the point in the application in which the user made the first request and unpause the application to cause the application to continue to execute from the point in the application.

12. The system of claim 11 , wherein the one or more processes are further configured to detect the first request of the user prior to taking the action.

13. The system of claim 11 , wherein the one or more processes are further configured to provide a user interface configured to receive the second request from the user to confirm whether to continue to take the action or to revert back to the point in the application at which the user made the first request.

14. The system of claim 11 , wherein a driver of the one or more processors is configured to one of detect or intercept the first request of the user.

15. The system of claim 11 , wherein a client service of the one or more processors is configured to receive the second request from the user to revert back to the point in the application at which the user made the first request.

16. The system of claim 11 , wherein the action comprises interacting with one of a link or uniform resource locator associated with the domain.

17. The system of claim 11 , wherein the action comprises interacting with one of an attachment or a file associated with the communication.

18. The system of claim 11 , wherein the application comprises a messaging application.

19. The system of claim 11 , wherein the application comprises an email client.

20. The system of claim 11 , wherein one of the domain or the communication is one of untrusted or not yet determined to be trusted.

Assignees

• Knowbe4 Inc

Inventors

• Lowry Bret
• Repuspolo Gauvin
• Kras Greg

Classifications

• H04L51/212 Primary

  using filtering or selective blocking · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• G06F2221/2119

  Authenticating web pages, e.g. with suspicious links · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title