# US 10,484,412 B2 · Identification of infected devices in broadband environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,412 B2 - Document ID: US10484412B2 - Status: Granted - Kind: B2 - Application number: 15/729,140 - Filed: 2017-10-10 - Published: 2018-02-01 - Granted: 2019-11-19 - Earliest claimed: 2012-06-29 - Assignees: CenturyLink Intellectual Property LLC - Applicants: CenturyLink Intellectual Property LLC - Inventors: Michael Glenn; Donald J. Smith; John Butala - Web page: https://patentgrep.com/patent/US10484412B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/562: {Static detection} - G06F 21/564: {by virus signature recognition} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/0272: {Virtual private networks} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/561: {Virus type analysis} - G06F 21/568: {eliminating virus, restoring damaged files} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0281: {Proxies} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Novel solutions for detecting and/or treating malware on a subscriber's premise network. Such solutions can include, but are not limited to, tools and techniques that can detect, and/or enable the detection of, malware infections on individual subscriber devices within the subscriber's network. In a particular embodiment, for example, a premise gateway, or other device on the subscriber's premise network, is configured to analyze packets traveling through the premise gateway and, based on that analysis, identify one or more subscriber devices that are infected with malware. ## Claims ### Claim 1 A method of identifying a malware infection, the method comprising: providing, with a premise gateway, communication between a premise network at a customer premises and an external network outside the customer premises, the premise network comprising a plurality of customer devices; receiving, with a malware detection device at the customer premises and from a specified location in a service provider network, an indication that the specified location in the service provider network detected infected network traffic associated with the customer premises; activating, at the malware detection device, an analysis function of the malware detection device based on the indication received from the specified location in the service provider network that infected network traffic is associated the customer premises; analyzing, with the malware detection device at the customer premises, network traffic between the premise network and the external network; identifying, with the malware detection device, one or more infected customer devices that are infected with malware, based on analysis of the network traffic; and taking, with at least one of the malware detection device or the premise gateway, one or more actions to notify the customer of an identification of the one or more infected customer devices, wherein taking one or more actions to notify the customer comprises blocking, with at least one of the malware detection device located at the customer premises or the premise gateway located at the customer premises, an outbound request for a first webpage from a customer device other than the one or more infected customer devices, in response to blocking the outbound request, returning with at least one of the malware detection device or the premise gateway, a second web page indicating an infected status of the one or more infected customer devices to the customer device other than the one or more infected customer devices, and causing the customer device other than the one or more infected customer devices to display the second web page indicating the infected status of the one or more infected customer devices. ### Claim 2 (depends on 1) The method of claim 1, wherein the customer premises is a single-family home and the premise gateway is a residential gateway. ### Claim 3 (depends on 1) The method of claim 1, wherein the customer premises is a multi-tenant dwelling. ### Claim 4 (depends on 1) The method of claim 1, wherein the customer premises is a business location. ### Claim 5 (depends on 1) The method of claim 1, wherein: the information for identifying malware comprises a set of one or more malware signatures via the external network; and wherein analyzing the network traffic comprises comparing the network traffic against one or more of the one or more malware signatures. ### Claim 6 (depends on 1) The method of claim 1, further comprising: detecting, at an Internet service provider (ISP), network traffic from the premise gateway indicating a malware infection of one or more of the customer devices; and transmitting, from the ISP, the information for identifying the malware, in response to detecting network traffic from the premise gateway indicating a malware infection of one or more of the customer devices. ### Claim 7 (depends on 6) The method of claim 6, further comprising: identifying, at the ISP, one or more potential malware infections, based on the network traffic from the premise gateway; and selecting one or more malware signatures based on identification of the one or more potential malware infections. ### Claim 8 (depends on 1) The method of claim 1, wherein analyzing network traffic comprises applying one or more heuristics to the network traffic. ### Claim 9 (depends on 8) The method of claim 8, wherein: the information for identifying malware comprises the one or more heuristics. ### Claim 10 (depends on 1) The method of claim 1, wherein taking one or more actions to notify the customer comprises blocking network traffic originating from the one or more infected customer devices. ### Claim 11 (depends on 1) The method of claim 1, wherein the second web page indicating the infected status of the one or more infected customer devices is displayed in response to a request to transmit network traffic from the one or more infected customer devices. ### Claim 12 (depends on 1) The method of claim 1, wherein taking one or more actions to notify the customer comprises causing the one or more infected customer devices to display the second web page indicating an infected status of the one or more infected customer devices. ### Claim 13 (depends on 1) The method of claim 1, wherein taking one or more actions to notify the customer comprises sending an email message to the customer. ### Claim 14 (depends on 1) The method of claim 1, wherein taking one or more actions to notify the customer comprises sending a text message to the customer, the text message being selected from the group consisting of an instant message and a simple message service (SMS) message. ### Claim 15 (depends on 1) The method of claim 1, wherein taking one or more actions to notify the customer comprises transmitting a notification to an Internet service provider (ISP) of the customer via the external network. ### Claim 16 (depends on 15) The method of claim 15, further comprising: the ISP contacting the customer to notify the customer of the one or more infected devices and assist in removing the malware from the one or more infected devices. ### Claim 17 (depends on 1) The method of claim 1, wherein taking one or more actions to notify the customer comprises providing the customer with instructions on removing the malware from the one or more infected customer devices. ### Claim 18 (depends on 1) The method of claim 1, wherein taking one or more actions to notify the customer comprises providing the customer with malware removal software specific to the one or more infected customer devices. ### Claim 19 (depends on 1) The method of claim 1, wherein taking one or more actions to notify the customer comprises transmitting a notification to a set top box at the customer premises, for display to the customer on a television screen. ### Claim 20 (depends on 1) The method of claim 1, wherein identifying the one or more infected customer devices comprises determining a network identifier of each of the one or more infected customer devices. ### Claim 21 (depends on 1) The method of claim 1, wherein the premise gateway comprises the malware detection device. ### Claim 22 (depends on 1) The method of claim 1, wherein the premise gateway comprises a broadband modem. ### Claim 23 (depends on 1) The method of claim 1, wherein the premise gateway comprises a router. ### Claim 24 (depends on 1) The method of claim 1, wherein the premise gateway comprises a wireless access point. ### Claim 25 (depends on 1) The method of claim 1, wherein the malware detection device comprises a bridge in the premise network. ### Claim 26 (depends on 1) The method of claim 1, wherein the malware detection device comprises a personal computer in the premise network. ### Claim 27 An apparatus, comprising: a non-transitory computer readable medium having encoded thereon a set of instructions executable by a malware detection device for programming the malware detection device to: provide communication between a premise network at a customer premises and an external network outside the customer premises, the premise network comprising a plurality of customer devices; receive, from a specified location in a service provider network, an indication that the specified location in the service provider network detected infected network traffic associated with the customer premises; activate an analysis function of the malware detection device based on the indication received from the specified location in the Internet Service provider network that infected network traffic is associated the customer premises; analyze network traffic between the premise network and the external network; identify one or more infected customer devices that are infected with malware, based on analysis of the network traffic; and take one or more actions to notify the customer of an identification of the one or more infected customer devices, wherein taking one or more actions to notify the customer comprises blocking an outbound request for a first webpage from a customer device other than the one or more infected customer devices, in response to blocking the outbound request, returning a second web page indicating an infected status of the one or more infected customer devices to the customer device other than the one or more infected customer devices, and causing the customer device other than the one or more infected customer devices to display the second web page indicating the infected status of the one or more infected customer devices. ### Claim 28 A malware detection device, comprising: a first communication interface in communication with a premise network at a customer premises, the premise network comprising a plurality of customer devices; a second communication interface to provide communication with an external network outside the customer premises; one or more processors in communication with the first and second communication interfaces; and a non-transitory computer readable medium in communication with the one or more processors, the computer readable medium having encoded thereon a set of instructions executable by the processor for programming the malware detection device to: provide communication between the premise network and the external network; receive, from a specified location in a service provider network, an indication that the specified location in the service provider network detected infected network traffic associated with the customer premises; activate an analysis function of the malware detection device based on the indication received from the specified location in the Internet Service provider network that infected network traffic is associated the customer premises; analyze network traffic between the premise network and the external network; identify one or more infected customer devices that are infected with malware, based on analysis of the network traffic; and take one or more actions to notify the customer of an identification of the one or more infected customer devices, wherein taking one or more actions to notify the customer comprises blocking an outbound request for a first webpage from a customer device other than the one or more infected customer devices, in response to blocking the outbound request, returning a second web page indicating an infected status of the one or more infected customer devices to the customer device other than the one or more infected customer devices, and causing the one or more infected customer devices to display the second web page indicating the infected status of the one or more infected customer devices. ### Claim 29 (depends on 28) The malware detection device of claim 28, wherein at least one of the communication interfaces is a wireless communication interface. ### Claim 30 (depends on 28) The malware detection device of claim 28, wherein the malware detection device comprises a premise gateway. ### Claim 31 (depends on 28) The malware detection device of claim 28, wherein the second communication interface is in communication with a premise gateway that provides communication with the external network. ### Claim 32 (depends on 28) The malware detection device of claim 28, wherein the first and second communication interfaces are the same communication interface.