# US 10,873,588 B2 · System, method, and apparatus for computer security

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,873,588 B2
- Document ID: US10873588B2
- Status: Granted
- Kind: B2
- Application number: 15/666,212
- Filed: 2017-08-01
- Published: 2019-02-07
- Granted: 2020-12-22
- Earliest claimed: 2017-08-01
- Assignees: PC Matic, Inc.
- Applicants: PC Pitstop, Inc
- Inventors: Robert J. Woodworth, Jr.
- Web page: https://patentgrep.com/patent/US10873588B2

## CPC

- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- G06F 21/44: Program or device authentication
- G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
- H04L 51/212: using filtering or selective blocking
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A super-shield system for protecting a computer from malicious software uses a whitelist to determine is a program is safe to run. As new malicious software are created, inadvertent attempts at execution of executables including such malicious software is prevented being that the new malicious software are not listed in the whitelist. When attempts are made to run unknown software, the executable is forwarded to a server where further analysis is performed to determine if the executable contains suspect code (e.g., malicious software).

## Claims

### Claim 1

A system for computer security, the system comprising:
two whitelists, a first whitelist of the two whitelists for signed executables and a second of the two whitelists for unsigned executables;
a server, the server having storage containing the two whitelists;
a computer protected by the system for computer security;
software running on the computer detecting an attempt to run an executable, the software determining if the executable is signed, if the executable is signed, the software searches the first whitelist to see if the executable is present on the first whitelist and if the executable is present on the first whitelist, the software allows the running of the executable, if the executable is unsigned, the software searches the second whitelist to see if the executable is present on the second whitelist and if the executable is present on the second whitelist, the software allows the running of the executable;
if the executable is not found in the a respective whitelist of the two whitelists, at least a portion of the executable is forwarded to the server and software running on the server further analyzes the executable using heuristics, if the server determines that malicious software exists in the executable, the server notifies regarding the malicious software and the executable is blocked, if the server determines that no malicious software exists in the executable, the server updates the respective whitelist of the two whitelists and communicates with the computer to allow running of the executable, if the server determines that there may be malicious software in the executable, the server queues the executable for further research and execution of the executable is blocked;
wherein the further research includes a static analysis and the static analysis includes software running on the server installing the executable on a clean computer that is isolated from a wide area network and scanning the executable with commercially available malicious software scan systems to determine if the executable includes the malicious software; and
whereas the server notifies regarding the malicious software by sending an email to a user of the computer and the email includes a description of the malicious software, instructions for removing the malicious software, and links to training on how to prevent future intrusions of malicious software into the computer.

### Claim 2 (depends on 1)

The system of claim 1, wherein the two whitelists are stored and accessed from storage associated with the server.

### Claim 3 (depends on 2)

The system of claim 2, wherein the storage associated with the server is cloud storage.

### Claim 4 (depends on 1)

The system of claim 1, wherein the further research includes human analysis of the executable.

### Claim 5 (depends on 1)

The system of claim 1, wherein the at least a portion of the executable comprises metadata of the executable.

### Claim 6

A method of protecting a computer, the method comprising:
providing a first whitelists at the computer, the first whitelist having identifications for executable software;
upon an attempt to initiate an executable on the computer, determining if the executable corresponds to one of the identifications in the first whitelist and if the executable corresponds to any one of the identifications in the first whitelist, allowing the executable to run;
if the executable does not correspond to one of the identifications in the first whitelist, forwarding the executable to a server;
upon reception of the executable, the server analyzing the executable at the server using heuristics to determine if a malware exists in the executable, if the malware exists in the executable, notifying regarding the malware, if the malware doesn't exists in the executable, updating the first whitelist and communicating with the computer, the computer allowing the executable to run;
if it is not determined, the server queuing the executable for further research by a human researcher
wherein the further research including a static analysis that comprises installing the executable on a clean computer that is isolated from a wide area network and scanning the executable with commercially available malicious software scan systems to determine if the executable includes the malicious software; and
notifying regarding the malicious software by sending an email to a user of the computer, the email including a description of the malicious software, instructions for removing the malicious software, and links to training on how to prevent future intrusions of malicious software into the computer.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
providing a second whitelists, the second whitelist having second identifications for executable software that is signed whereas the first whitelist having identification for executable software that is unsigned;
upon the attempt to initiate the executable that is signed on the computer, determining if the executable corresponds to one of the second identifications in the second whitelist and if the executable that is signed corresponds to any one of the second identifications in the second whitelist, allowing the executable that is signed to run;
if the executable that is signed does not correspond to one of the second identifications in the second whitelist, forwarding the executable that is signed to the server;
upon reception of the executable that is signed, the server analyzing the executable that is signed at the server using heuristics to determine if the malware exists in the executable that is signed, if the malware exists in the executable that is signed, notifying regarding the malware, if the malware doesn't exists in the executable, updating the second whitelist and communicating with the computer, the computer allowing the executable that is signed to run; and
if it is not determined, the server queues the executable that is signed for further research by the human researcher.

### Claim 8 (depends on 7)

The method of claim 7, wherein the executable that is signed comprises metadata of the executable that is signed.

### Claim 9 (depends on 6)

The method of claim 6, wherein the executable comprises metadata of the executable.

### Claim 10

A computer program product for providing security to a computer comprising:
a non-transitory storage medium having computer readable instructions stored therewith, the computer readable instructions being executable by a processor and comprising:
the computer readable instructions running on the computer determining when an executable attempts to initiate on the processor;
upon determining that the executable attempts to initiate, the computer readable instructions running on the processor determining if the executable is signed;
if the executable is signed, the computer readable instructions running on the processor searching the first whitelist to see if the executable is present and if the executable is present on the first whitelist, the computer readable instructions running on the processor allowing the executable to run;
if the executable is unsigned, the computer readable instructions running on the processor searching the second whitelist to see if the executable is present on the second whitelist and if the executable is present on the second whitelist, the computer readable instructions running on the processor allowing the executable to run;
if the executable is not found in either the first whitelist or the second whitelist, the computer readable instructions running on the processor forward the executable to a server and computer readable instructions running on the server analyzing the executable using heuristics to determine if a malware exists in the executable;
if the malware exists in the executable, the computer readable instructions running on the server notifying regarding the malware by sending an email to a user of the computer, the email including a description of the malware, instructions for removing the malware, and links to training on how to prevent future intrusions of malicious software into the computer;
if the malware doesn't exist in the executable, the computer readable instructions running on the server updating the respective whitelist of the two whitelists and communicating with the computer readable instructions running on the computer, the computer readable instructions running on the computer then allowing the executable to run;
if the computer readable instructions running on the server determine that there may be malware in the executable, the computer readable instructions running on the server queuing the executable for further research, the further research including a static analysis that comprises installing the executable on a clean computer that is isolated from a wide area network and scanning the executable with commercially available malicious software scan systems to determine if the executable includes the malicious software and when the executables include the malicious software, the computer readable instructions running on the server notifying regarding the malware by sending an email to a user of the computer, the email including the description of the malware, instructions for removing the malware, and links to training on how to prevent future intrusions of the malicious software into the computer.

### Claim 11 (depends on 10)

The computer program product of claim 10, wherein the further research is performed by a human being.

### Claim 12 (depends on 10)

The computer program product of claim 10, wherein the whitelists are stored on the computer.

### Claim 13 (depends on 10)

The computer program product of claim 10, wherein computer readable instructions running on the server sending the whitelists to the computer and computer readable instructions running on the computer storing the whitelists in storage associated with the computer.

### Claim 14 (depends on 10)

The computer program product of claim 10, wherein the whitelists are stored in networked storage such as cloud storage.

### Claim 15 (depends on 10)

The computer program product of claim 10, wherein the whitelists are stored in hash tables.

### Claim 16 (depends on 10)

The computer program product of claim 10, wherein the executable includes metadata.