`
`8,141,154 - Claim 1
`
`F-Secure Client Security Browsing Protection and DeepGuard
`
`A system for protecting a
`computer from dynamically
`generated malicious
`content, comprising:
`
`F-Secure markets Client Security software. Within this software is a function called Browsing
`Protection. Browsing Protection is an on the cloud service which runs a plurality of websites through
`“DeepGuard” which is a cloud-based scanning program. Browsing Protection applies safety warnings
`to various links across the web which reflects the results of the DeepGuard scan.
`
`One of the functions of DeepGuard is to monitor frequently exploited programs while these programs
`run. Monitoring programs while they run allows DeepGuard to observe and intercept (protecting a
`computer) malicious code which is not generated until the program is in operation (dynamically
`generated malicious content).
`
`
`
`
`
`
`https://www.f-secure.com/documents/996508/1030745/deepguard_whitepaper.pdf
`
`- 2 -
`
`
`
`a content processor (i) for
`processing content received
`over a network, the content
`including a call to a first
`function, and the call
`including an input, and
`
`F-Secure’s cloud-based detection operates virtual environments or sandboxes which run executable
`code. The sandbox runs files such as JavaScript associated with webpages.
`
`At runtime, JavaScript in HTML and PDFs will have a JavaScript function and write malicious code of
`payload, which will only exist at the time the JavaScript function is called. F-Secure’s DeepGuard is
`configured to detect this behavior, such as injecting code into another processes space.
`
`
`
`- 3 -
`
`
`
`
`https://www.f-secure.com/documents/996508/1030745/deepguard_whitepaper.pdf
`
`- 4 -
`
`
`
`(ii) for invoking a second
`function with the input,
`only if a security computer
`indicates that such
`invocation is safe;
`
`JavaScript which dynamically generate code is not always malicious. Sometimes, this code is
`harmless, and harmless, legitimate code (input) can resume running with newly generated code.
`However, if the sandbox in the F-Secure Security Cloud (security computer) deems the content
`harmless, it will allow a client computer to run the content (only if a security computer indicates that
`such invocation is safe).
`
`https://www.f-secure.com/documents/10192/1052471/F-
`Secure_Internet_Security_2014_manual_v.2_en.pdf
`
`
`
`a transmitter for
`transmitting the input to the
`security computer for
`inspection, when the first
`function is invoked; and
`
`DeepGuard is used when a client attempts to access malicious content over the Internet. The client
`computer sends over the network the JavaScript data accessed to an F-Secure cloud server to be
`scanned. If the scan reveals dynamically generated malicious code in the JavaScript, then DeepGaurd
`provides and alert:
`
`- 5 -
`
`
`
`https://www.youtube.com/watch?v=YEX3yZ5PS4U
`
`DeepGuard can be used when the client computer attempts to access a HTML (webpage) with
`JavaScript that tries to take control of a web browser:
`
`
`
`- 6 -
`
`
`
`https://www.f-secure.com/documents/10192/1052471/F-
`Secure_Internet_Security_2014_manual_v.2_en.pdf
`
`The local client software is provided with an alert from the F-Secure cloud server that is received by
`the client computer and indicates whether it is safe to fulling load the unknown website.
`
`
`
`a receiver for receiving an
`indicator from the security
`computer whether it is safe
`to invoke the second
`function with the input.
`
`
`
`- 7 -
`
`
`
`https://www.f-secure.com/documents/10192/1052471/F-
`Secure_Internet_Security_2014_manual_v.2_en.pdf
`
`
`
`- 8 -