US 12,259,979 B2
Method and computer system for determining a threat score
Peter Arnoth, Vienna (AT); and Markus Cserna, Hagenbrunn (AT)
Assigned to CYAN SECURITY GROUP GMBH, Vienna (AT)
Appl. No. 16/315,086
Filed by CYAN SECURITY GROUP GMBH, Vienna (AT)
PCT Filed Jul. 4, 2017, PCT No. PCT/EP2017/066565
§ 371(c)(1), (2) Date Jan. 3, 2019,
PCT Pub. No. WO2018/007350, PCT Pub. Date Jan. 11, 2018.
Claims priority of application No. 16177783 (EP), filed on Jul. 4, 2016.
Prior Publication US 2019/0311132 A1, Oct. 10, 2019
Int. Cl. G06F 21/57 (2013.01); G06F 21/53 (2013.01); G06F 21/56 (2013.01); H04L 9/40 (2022.01)
CPC G06F 21/577 (2013.01) [G06F 21/53 (2013.01); G06F 21/566 (2013.01); H04L 63/1416 (2013.01); H04L 63/1433 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for determining a threat score of an electronic document, the method comprising the steps of:
loading and rendering the electronic document in a document sandbox, the document sandbox adapted to simulate user interaction with the electronic document before a user is given access to the electronic document, and the document sandbox implemented without displaying the electronic document in a graphical user interface so as to speed up execution of loading web pages;
querying a list of all available navigation elements in the electronic document from the document sandbox;
controlling the document sandbox to simulate user interaction with the electronic document based on the queried list while recording observed events during the simulation of user interaction;
during the loading and rendering step and during the controlling step, monitoring the document sandbox for events triggered by the electronic document and belonging to one of at least two predefined event classes;
recording each observed event during the monitoring of the document sandbox together with a respective event class to which each observed event belongs; and
determining, before the user is given access to the electronic document, the threat score of the electronic document based on predefined numerical weights associated with each of the predefined event classes to which the recorded events belong, thereby determining the threat score using events recorded during simulation of user interaction with the electronic document.