US 10,567,425 B2Granted

Anti-malware detection and removal systems and methods

AssigneeCheckpoint Mobile Security Ltd

InventorsMichael Shaulov, Ohad Bobrov

Life of this patent

Estimating the term…

Loading patent…

Abstract

An anti-malware system including at least one database, remote from a plurality of computers to be protected, which stores identification of computer applications resident on the computers to be protected and an application-specific communications footprint for the computer applications, and at least one server, remote from the plurality of computers to be protected, and being operative to calculate a reference computer-specific communications composite pattern based on multiple application-specific communications footprints for applications installed on the computers to be protected, calculate a current computer-specific communications composite pattern based on actual communications of at least one the plurality of computers to be protected, and provide an alert when the current computer-specific communications composite pattern of the at least one of the plurality of computers to be protected differs from the reference computer-specific communications composite pattern of the at least one of the plurality of computers to be protected.

Claims3

Dependent claims

A method for detecting malware comprising:

identifying at least one of a plurality of computers to be protected:
storing, on a malware-characteristic data switched communication patterns database, malware-characteristic data switched communication patterns which are characteristic of at least one of imminent installation, presence and operation of malware on said plurality of computers to be protected;
monitoring a data switch for sensing current data switched communication patterns being communicated via said data switch;
comparing said current data switched communication patterns sensed by said monitoring said data switch with said malware-characteristic data switched communication patterns stored on said data switched communication patterns database;
providing an alert when at least one of said current data switched communication patterns is similar to at least one of said malware-characteristic data switched communication patterns as indicated by at least one metric;
and,
proactively sending at least one malware triggering message to at least one of said plurality of computers to be protected in order to attempt to elicit communication of at least one of said malware-characteristic data switched communication patterns by said at least one of said plurality of computers to be protected, and to thereby confirm the existence of at least one of imminent installation, presence and operation of malware on said at least one of said plurality of computers to be protected.

4 more elements

A method for detecting malware comprising:

identifying at least one of a plurality of computers to be protected:
storing, on a malware-characteristic combined patterns database, malware-characteristic combined circuit-switched communication patterns and data-switched communication patterns which are characteristic of at least one of imminent installation, presence and operation of malware on said plurality of computers to be protected;
monitoring 1) a circuit switch for sensing current circuit switched communication patterns being communicated via said circuit switch, and, 2) a data switch for sensing current data switched communication patterns being communicated via said data switch;
comparing combinations of current circuit-switched communication patterns and current data-switched communication patterns sensed by said monitoring said circuit switch and said monitoring said data switch, with said malware-characteristic combined circuit-switched communication patterns and data-switched communication patterns stored on malware-characteristic combined patterns database;
providing an alert when at least one of said combinations of current circuit-switched communication patterns and current data-switched communication patterns is similar to at least one of said malware-characteristic combined circuit-switched communication patterns and data-switched communication patterns as indicated by at least one metric;
and,
proactively sending at least one malware triggering message to at least one of said plurality of computers to be protected in order to attempt to elicit communication of at least one of said malware-characteristic combined circuit-switched communication patterns and data-switched communication patterns by said at least one of said plurality of computers to be protected, and to thereby confirm the existence of at least one of imminent installation, presence and operation of malware on said at least one of said plurality of computers to be protected.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/292,352Filed 5 Mar 2019 · continuation
Priority: 13 May 2012
Published: US 2019/0199737 A127 Jun 2019
Granted: 18 Feb 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
G06F 21/565
Static detection: by checking file integrity
G06F 21/568
Computer malware detection or handling, e.g. anti-virus arrangements: eliminating virus, restoring damaged files
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection

Family

Application61/646,298Us provisional application · filed 13 May 2012
Application61/737,852Us provisional application · filed 17 Dec 2012
PCT/IL2013/050415Parent of this continuation · filed 12 May 2013
Application15/001,272Parent of this continuation · filed 20 Jan 2016
US 9,319,427 B2Parent of this continuation · filed 19 Apr 2016
US 2019/0199737 A1Pre-grant publication · published 27 Jun 2019
US 10,230,758 B2Parent of this continuation
Application14/400,502Parent of this continuation
US 2015/0128269 A1Published application
US 2016/0142425 A1Published application
US 10,567,425 B2This patent

From the US filing history. Foreign family members aren’t listed.