Google Explains How It Scans and Detects Phishing Sites and Malicious Files in Chrome

In order to improve security, Google has added a couple of new features to Safe Browsing in Google Chrome 17 which extend the use of the feature. Chrome 17 can detect malicious files that you may be trying to download and also warns about sites that may be dangerous.

Users had a lot of questions about the new features, especially the download scan. Google has now provided more info on the new additions.

Safe Browsing works by checking the URLs you are visiting against a list of websites known to be malicious or infected. This list is stored by Chrome and is continuously updated with newer data. However, this means that Google first has to know about a threat to add it to the list.

But Safe Browsing in Chrome 17 adds a couple of prevention features as well. It will now try to determine whether a site may be a phishing site even if it hasn't been reported by anyone yet.

"Chrome now analyzes properties of each page you visit to determine the likelihood of it being a phishing page. This is done locally on your computer, and doesn’t share the websites you visit with Google," Google explained.

"Only if the page looks sufficiently suspicious will Chrome send the URL of that page back to Google for further analysis, and show a warning as appropriate," it added.

Even more interesting is the way Chrome now tries to determine whether a file may be infected. It doesn't come with a built-in anti-virus, of course, but it applies some methods that anti-virus software rely on as well.

"If a file isn’t from a known source, Chrome sends the URL and IP of the host and other meta data, such as the file’s hash and binary size, to Google. The file is automatically classified using machine learning analysis and the reputation and trustworthiness of files previously seen from the same publisher and website. Google then sends the results back to Chrome, which warns you if you’re at risk," Google wrote.