# US 10,769,276 B2 · Advanced threat protection cross-product security controller

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,769,276 B2
- Document ID: US10769276B2
- Status: Granted
- Kind: B2
- Application number: 16/133,485
- Filed: 2018-09-17
- Published: 2019-01-17
- Granted: 2020-09-08
- Earliest claimed: 2015-10-22
- Assignees: McAfee, Inc.
- Applicants: McAfee, LLC
- Inventors: Derek Pearcy; Jessica Heinrich; Michael Bishop; Cristian Fiorentino; Jessica Gaskins; Martina Borkowsky
- Web page: https://patentgrep.com/patent/US10769276B2

## CPC

- G06F 21/562: {Static detection}
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system for securing electronic devices includes a processor, non-transitory machine readable storage medium communicatively coupled to the processor, security applications, and a security controller. The security controller includes computer-executable instructions on the medium that are readable by the processor. The security application is configured to determine a suspicious file from a client using the security applications, identify whether the suspicious file has been encountered by other clients using the security applications, calculate a time range for which the suspicious file has been present on the clients, determine resources accessed by the suspicious file during the time range, and create a visualization of the suspicious file, a relationship between the suspicious file and the clients, the time range, and the resources accessed by the suspicious file during the time range.

## Claims

### Claim 1

At least one non-transitory machine-readable storage medium, comprising computer-executable instructions carried on the machine readable medium, the instructions readable by a hardware processor, the instructions, when read and executed, for causing the hardware processor to:
identify a file;
determine at least one uniform resource locator (URL) contacted by the file;
search for at least one other file that contacted the at least one URL;
determine that the file is suspicious based on both the file and the at least one other file having contacted the at least one URL;
display information regarding the at least one URL contacted by the file;
receive an indication that a user wants to block the file from contacting the at least on URL; and
block the file from contacting the at least one URL.

### Claim 2 (depends on 1)

The non-transitory machine-readable storage medium of claim 1, wherein the information is a reputation of the at least one URL.

### Claim 3 (depends on 1)

The non-transitory machine-readable storage medium of claim 1, wherein the instructions, when read and executed, also cause the hardware processor to display a source of the file.

### Claim 4 (depends on 1)

The non-transitory machine-readable storage medium of claim 1, wherein the instructions, when read and executed, also cause the hardware processor to display a frequency at which the at least one URL was accessed over a plurality of time periods.

### Claim 5

A system comprising:
a memory;
a hardware processor coupled to the memory and configured to:
identify a file;
determine at least one uniform resource locator (URL) contacted by the file;
search for at least one other file that contacted the at least one URL;
determine that the file is suspicious based on both the file and the at least one other file having contacted the at least one URL;
display information regarding the at least one URL contacted by the file;
receive an indication that a user wants to block the file from contacting the at least on URL; and
block the file from contacting the at least one URL.

### Claim 6 (depends on 5)

The system of claim 5, wherein the information is a reputation of the at least one URL.

### Claim 7 (depends on 5)

The system of claim 5, wherein the hardware processor is also configured to display a source of the file.

### Claim 8 (depends on 7)

The system of claim 7, wherein the hardware processor is also configured to determine that the source of the file is suspicious.

### Claim 9 (depends on 5)

The system of claim 5, wherein the hardware processor is also configured to display a frequency at which the at least one URL was accessed over a plurality of time periods.

### Claim 10

A method comprising:
identifying a file;
determining at least one uniform resource locator (URL) contacted by the file using a hardware processor;
search for at least one other file that contacted the at least one URL;
determine that the file is suspicious based on both the file and the at least one other file having contacted the at least one URL;
displaying information regarding the at least one URL contacted by the file;
receiving an indication that a user wants to block the file from contacting the at least on URL; and
blocking the file from contacting the at least one URL.

### Claim 11 (depends on 10)

The method of claim 10, wherein the information is a reputation of the at least one URL.

### Claim 12 (depends on 10)

The method of claim 10, further comprising displaying a source of the file.

### Claim 13 (depends on 12)

The method of claim 12, further comprising determining that the source of the file is suspicious.

### Claim 14 (depends on 10)

The method of claim 10, further comprising displaying a frequency at which the at least one URL was accessed over a plurality of time periods.