Identification of malicious content in operating system clipboard

Patent metadata

Field	Value
Publication number	US-12531883-B2
Application number	US-202217895996-A
Country	US
Kind code	B2
Filing date	Aug 25, 2022
Priority date	Aug 25, 2022
Publication date	Jan 20, 2026
Grant date	Jan 20, 2026

Abstract

A method includes determining first data stored in a clipboard of an operating system, determining second data is stored in the clipboard, performing a comparison of the second data against malicious data, at least in part based on a determination that the first data has changed to the second data, and performing a first security operation, at least in part based on the comparison.

First claim

We claim:

1 . A method, comprising:
performing a comparison of copied data against a cryptocurrency wallet address, upon determining that content of a clipboard of an operating system is to be replaced with the copied data; determining whether the copied data triggers pattern matching, in response to a determination that the copied data does not match the cryptocurrency wallet address; transmitting a request identifying the copied data over a network, if the copied data triggers the pattern matching; receiving a response to the request over the network, the response including a result identifying whether the copied data matches benign data or malicious data; and performing a security operation including replacing the copied data in the clipboard, if the copied data matches the cryptocurrency wallet address, and informing a user that the copied data is malicious, if the response identifies that the copied data matches the malicious data.

2 . The method of claim 1 , wherein the security operation replaces the copied data in the clipboard with a benign message.

3 . The method of claim 1 , wherein the comparison is performed, if the copied data does not match benign data.

4 . The method of claim 1 , wherein the security operation informs the user that the cryptocurrency wallet address was identified in the clipboard.

5 . The method of claim 1 , wherein the determination is based on intercepting a key combination or a graphical menu selection.

6 . The method of claim 1 , wherein the pattern matching is based on a regular expression for a cryptocurrency.

7 . A non-transitory, computer-readable medium encoded with executable instructions that, when executed by a processing unit, perform operations comprising:
performing a comparison of copied data against a cryptocurrency wallet address, upon determining that content of a clipboard of an operating system is to be replaced with the copied data; determining whether the copied data triggers pattern matching, in response to a determination that the copied data does not match the cryptocurrency wallet address; transmitting a request identifying the copied data over a network, if the copied data triggers the pattern matching; receiving a response to the request over the network, the response including a result identifying whether the copied data matches benign data or malicious data; and performing a security operation including replacing the copied data in the clipboard, if the copied data matches the cryptocurrency wallet address, and informing a user that the copied data is malicious, if the response identifies that the copied data matches the malicious data.

8 . The medium of claim 7 , wherein the security operation replaces the copied data in the clipboard with a benign message.

9 . The medium of claim 7 , wherein the security operation informs the user that the cryptocurrency wallet address was identified in the clipboard.

10 . The medium of claim 7 , wherein the determination is based on intercepting a key combination or a graphical menu selection.

11 . The medium of claim 7 , wherein the pattern matching is based on a regular expression for a cryptocurrency.

12 . An apparatus, comprising:
a memory including instructions; a processor configured to execute the instructions to perform a comparison of copied data against a cryptocurrency wallet address, upon determining that content of a clipboard of an operating system is to be changed to replaced with the copied data, and to determine whether the copied data triggers pattern matching, in response to a determination that the copied data does not match the cryptocurrency wallet address; and a network interface that transmits a request identifying the copied data over a network, if the copied data triggers the pattern matching, and receives a response to the request over the network, the response including a result identifying whether the copied data matches benign data or malicious data, wherein the processor further is configured to execute the instructions to perform a security operation, including replacing the copied data in the clipboard, if the copied data matches the cryptocurrency wallet address, and informing a user that the copied data is malicious, if the response identifies that the copied data matches the malicious data.

13 . The apparatus of claim 12 , wherein the security operation replaces the copied data in the clipboard with a benign message.

14 . The apparatus of claim 12 , wherein the comparison is performed, if the copied data does not match benign data.

15 . The apparatus of claim 12 , wherein the security operation informs the user that the cryptocurrency wallet address was identified in the clipboard.

16 . The apparatus of claim 12 , wherein the determination is based on intercepting a key combination or a graphical menu selection.

17 . The apparatus of claim 12 , wherein the pattern matching is based on a regular expression for a cryptocurrency.

Assignees

• Mcafee Llc

Inventors

• Devane Oliver G
• Chole Vallabh
• Goel Ankit
• Karnik Abhishek

Classifications

• H04L9/00

  {Cryptographic mechanisms or cryptographic} arrangements for secret or secure communications; Network security protocols · CPC title

• H04L9/40

  Network security protocols · CPC title

• H04L63/00

  Network architectures or network communication protocols for network security (cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title