# US 10,872,147 B2 · Software attack detection device, non-transitory computer-readable storage medium, and software attack detection method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,872,147 B2 - Document ID: US10872147B2 - Status: Granted - Kind: B2 - Application number: 15/820,913 - Filed: 2017-11-22 - Published: 2018-05-31 - Granted: 2020-12-22 - Earliest claimed: 2016-11-28 - Assignees: Fujitsu Limited - Applicants: Fujitsu Limited - Inventors: Kazuyoshi Furukawa; Masahiko Takenaka; Hirotaka Kokubo - Web page: https://patentgrep.com/patent/US10872147B2 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A software detection device, the device including a memory and a processor coupled to the memory and the processor configured to execute a process, the process including generating at least one notification in response to at least one countermeasure process applied to a program to address a vulnerability to a software attack, each of the at least one notification including a countermeasure identifier to identify a countermeasure process performed, monitoring the at least one generated notification, and determining presence of the software attack based on the monitoring. ## Claims ### Claim 1 A software attack detection device, the device comprising: a memory; and a processor coupled to the memory and the processor configured to execute a process, the process including: generating, when a first countermeasure process is applied to a program to address a vulnerability to a software attack, at least one notification including a first countermeasure identifier to identify the first countermeasure process; monitoring the at least one generated notification; identifying, when detecting the at least one generated notification, a past countermeasure identifier for a past countermeasure process by tracing back monitoring information from the first countermeasure identifier; and performing a second countermeasure process when detecting that the first countermeasure identifier and the past countermeasure identifier correspond to the second countermeasure process, wherein the memory stores the monitoring information relating to the at least one notification, the monitoring information includes the first countermeasure identifier of the first countermeasure process performed, a date and time the first countermeasure process was performed, a process of the program having the vulnerability the first countermeasure process was performed to address, an alert level of the first countermeasure process performed, a corrective action associated with the first countermeasure process, and an alert level of the corrective action. ### Claim 2 (depends on 1) The software attack detection device according to claim 1, wherein the at least one notification further includes at least one of an identifier of the program having the vulnerability and an identifier of a process of the program relating to the vulnerability. ### Claim 3 (depends on 1) The software attack detection device according to claim 1, wherein the process further includes: deciding whether an alert condition is satisfied based on the monitored at least one notification and the monitoring information stored in the memory, and triggering an alert as the second countermeasure process the when the alert condition is satisfied indicating a device including the software detection device experienced the software attack. ### Claim 4 (depends on 3) The software attack detection device according to claim 3, wherein the triggered alert causes an output to a user of the device, the output including at least one of a display of a message on a display of the device and an audible output of the device to indicate the software attack. ### Claim 5 (depends on 3) The software attack detection device according to claim 3, wherein the triggered alert causes the corrective action to be performed, the correction action including at least one of the device to power off, deletion of the process of the program having the vulnerability the first countermeasure process was performed to address, uninstallation of the program having the vulnerability, and display of a message on a display of the device. ### Claim 6 (depends on 1) The software attack detection device according to claim 1, wherein a plurality of countermeasure processes are applied to the program as the first countermeasure process; and wherein the determining determines the presence of the software attack based on a combination of countermeasure processes, included in the plurality of countermeasure processes, the combination of countermeasure processes being identified by countermeasure identifiers within the at least one notification. ### Claim 7 (depends on 6) The software attack detection device according to claim 6, wherein the determining determines the presence of the software attack based on an order of occurrence of the countermeasure processes, included in the plurality of countermeasure processes. ### Claim 8 (depends on 1) The software attack detection device according to claim 1, wherein the determining determines the presence of the software attack based on a number of countermeasure processes, as the first countermeasure process, identified within the at least one notification. ### Claim 9 (depends on 1) The software attack detection device according to claim 1, wherein the determining determines the presence of the software attack based on an alert level corresponding to the first countermeasure process. ### Claim 10 (depends on 1) The software attack detection device according to claim 1, wherein the process further includes: obtaining a number of countermeasure processes performed that are associated with a same process based on the monitoring information. ### Claim 11 A non-transitory computer-readable storage medium storing a program that causes a computer to execute a process, the process comprising: generating, when a first countermeasure process is applied to the program to address a vulnerability to a software attack, at least one notification including a first countermeasure identifier to identify the first countermeasure process performed; monitoring the at least one generated notification; identifying, when detecting the at least one generated notification, a past countermeasure identifier for a past countermeasure process by tracing back monitoring information from the first countermeasure identifier; and performing a second countermeasure process when detecting that the first countermeasure identifier and the past countermeasure identifier correspond to the second countermeasure process, wherein the process further includes storing the monitoring information relating to the at least one notification, the monitoring information includes the first countermeasure identifier of the first countermeasure process performed, a date and time the first countermeasure process was performed, a process of the program having the vulnerability the first countermeasure process was performed to address, an alert level of the first countermeasure process performed, a corrective action associated with the first countermeasure process, and an alert level of the corrective action. ### Claim 12 (depends on 11) The non-transitory computer-readable storage medium according to claim 11, wherein the process further includes: deciding whether an alert condition is satisfied based on the monitored at least one notification and the monitoring information; and triggering an alert as the second countermeasure process when the alert condition is satisfied indicating a device including the program experienced the software attack. ### Claim 13 A software attack detection method executed by a computer, the software attack detection method comprising: generating, when a first countermeasure process is applied to a program to address a vulnerability to a software attack, at least one notification including a first countermeasure identifier to identify the first countermeasure process performed; monitoring the at least one generated notification; identifying, when detecting the at least one generated notification, a past countermeasure identifier for a past countermeasure process by tracing back monitoring information from the first countermeasure identifier; and performing a second countermeasure process when detecting that the first countermeasure identifier and the past countermeasure identifier correspond to the second countermeasure process, wherein the process further includes storing the monitoring information relating to the at least one notification, the monitoring information includes the first countermeasure identifier of the first countermeasure process performed, a date and time the first countermeasure process was performed, a process of the program having the vulnerability the first countermeasure process was performed to address, an alert level of the first countermeasure process performed, a corrective action associated with the first countermeasure process, and an alert level of the corrective action. ### Claim 14 (depends on 13) The software attack detection method according to claim 13, further comprising: deciding whether an alert condition is satisfied based on the monitored at least one notification and the monitoring information; and triggering an alert as the second countermeasure process when the alert condition is satisfied indicating a device including the program experienced the software attack.