# US 10,873,590 B2 · System and method of cloud detection, investigation and elimination of targeted attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,590 B2 - Document ID: US10873590B2 - Status: Granted - Kind: B2 - Application number: 15/923,581 - Filed: 2018-03-16 - Published: 2019-04-04 - Granted: 2020-12-22 - Earliest claimed: 2017-09-29 - Assignees: AO Kaspersky Lab - Applicants: AO Kaspersky Lab - Inventors: Sergey V. Gordeychik; Konstantin V. Sapronov; Yury G. Parshin; Teymur S. Kheirkhabarov; Sergey V. Soldatov - Web page: https://patentgrep.com/patent/US10873590B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 16/27: Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor - G06F 16/951: Indexing; Web crawling techniques - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - H04L 63/1433: {Vulnerability analysis} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 67/306: User profiles - H04L 2463/121: Timestamp - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed are systems and methods for cloud detection, investigation and elimination of targeted attacks. In one exemplary aspect, the system comprises a computer protection module configured to: gather information on an object in a computer in a network; and save a security notification with the object in an object database in the network; and a module for protection against targeted attacks configured to: search for the object in a threat database in the network; add one or more tags to the object when the object is found in the threat database and adding a correspondence between a record in the object database and the threat database; and determine that a computer attack has occurred when the one or more tags correspond to signatures in a database of computer attacks. ## Claims ### Claim 1 A method for detecting computer attacks comprising: gathering, using a hardware processor, information on an object in a computer in a network; saving a security notification with the object in an object database in the network; searching for the object in a threat database in the network; adding one or more tags to the object when the object is found in the threat database and adding a correspondence between a record in the object database and the threat database; determining that a computer attack has occurred when the one or more tags correspond to one or more signatures in a database of computer attacks, wherein a signature comprises: at least one record about the object, at least one record about the security notification, and at least one tag of the object; searching, in a suspicious activity database, for suspicious activity based on the one or more tags; and when a sign of the suspicious activity is found in the suspicious activity database, adding a second tag to the security notification, the second tag being obtained from the suspicious activity database and being indicative of a presence of at least one suspicious activity. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining a computer attack has occurred when the object, a first tag of the one or more tags added to the object, and the second tag are found in a database of computer attacks. ### Claim 3 (depends on 2) The method of claim 2, wherein the second tag is added only if a predetermined event has occurred on the computer or a predetermined action has been performed, wherein the predetermined event or the predetermined action is a sign of a suspicious activity. ### Claim 4 (depends on 2) The method of claim 2, further comprising: when the determination of the computer attack is uncertain, performing one of: a memory dump of the computer to confirm the determination of the computer attack and logging steps of the detection of the computer attack. ### Claim 5 (depends on 1) The method of claim 1, wherein the information on the object comprises one or more of: a behavior of the object, events in an operating system of the computer, information on an interaction of the object between networks, indicators of a comprise, and metadata of the object. ### Claim 6 (depends on 1) The method of claim 1, wherein the correspondence is defined by an agreement between a check sum of the object in the threat database and a check sum of the object in the object database. ### Claim 7 (depends on 1) The method of claim 1, wherein the tag is a characteristic related to the object or related to an event performed by or on the object. ### Claim 8 (depends on 1) The method of claim 1, wherein an object comprises one or more of: a file, a hash of the file, a process, a URL address, an IP address, a certificate, and a file execution log. ### Claim 9 (depends on 1) The method of claim 1, wherein the security notification includes information gathered about the object. ### Claim 10 (depends on 1) The method of claim 1, wherein the security notification includes a time stamp. ### Claim 11 A system for detecting computer attacks comprising: a computer protection module executed on a hardware processor and configured to: gather information on an object in a computer in a network; and save a security notification with the object in an object database in the network; a module for protection against targeted attacks executed on a hardware processor and configured to: search for the object in a threat database in the network; add one or more tags to the object when the object is found in the threat database and adding a correspondence between a record in the object database and the threat database; determine that a computer attack has occurred when the one or more tags correspond to one or more signatures in a database of computer attacks, wherein a signature comprises: at least one record about the object, at least one record about the security notification, and at least one tag of the object; search, in a suspicious activity database, for suspicious activity based on the one or more tags; and when a sign of the suspicious activity is found in the suspicious activity database, add a second tag to the security notification, the second tag being obtained from the suspicious activity database and being indicative of a presence of at least one suspicious activity. ### Claim 12 (depends on 11) The system of claim 11, wherein the detected module is further configured to: determine a computer attack has occurred when the object, a first tag of the one or more tags added to the object, and the second tag are found in a database of computer attacks. ### Claim 13 (depends on 12) The system of claim 12, wherein the second tag is added only if a predetermined event has occurred on the computer or a predetermined action has been performed, wherein the predetermined event or the predetermined action is a sign of a suspicious activity. ### Claim 14 (depends on 12) The system of claim 12, further comprising: an analysis center configured to perform one of: a memory dump of the computer to confirm the determination of the computer attack and logging steps of the detection of the computer attack when the determination of the computer attack is uncertain. ### Claim 15 (depends on 11) The system of claim 11 wherein the information on the object comprises one or more of: a behavior of the object, events in an operating system of the computer, information on an interaction of the object between networks, indicators of a comprise, and metadata of the object. ### Claim 16 (depends on 11) The system of claim 11, wherein the correspondence is defined by an agreement between a check sum of the object in the threat database and a check sum of the object in the object database. ### Claim 17 (depends on 11) The system of claim 11, wherein the tag is a characteristic related to the object or related to an event performed by or on the object. ### Claim 18 A non-transitory computer readable medium storing thereon computer executable instructions, that when executed by a hardware processor, performs a method for detecting computer attacks comprising: gathering, using a hardware processor, information on an object in a computer in a network; saving a security notification with the object in an object database in the network; searching for the object in a threat database in the network; adding one or more tags to the object when the object is found in the threat database and adding a correspondence between a record in the object database and the threat database; determining that a computer attack has occurred when the one or more tags correspond to one or more signatures in a database of computer attacks, wherein a signature comprises: at least one record about the object, at least one record about the security notification, and at least one tag of the object; searching, in a suspicious activity database, for suspicious activity based on the one or more tags; and when a sign of the suspicious activity is found in the suspicious activity database, adding a second tag to the security notification, the second tag being obtained from the suspicious activity database and being indicative of a presence of at least one suspicious activity. ### Claim 19 (depends on 18) The medium of claim 18, further comprising: determining a computer attack has occurred when the object, a first tag of the one or more tags added to the object, and the second tag are found in a database of computer attacks. ### Claim 20 (depends on 19) The medium of claim 19, wherein the second tag is added only if a predetermined event has occurred on the computer or a predetermined action has been performed, wherein the predetermined event or the predetermined action is a sign of a suspicious activity.