Detonate targeted malware using environment context information
AssigneeCA, Inc.
InventorPrashant Gupta
Life of this patent
Estimating the term…
Abstract
In one embodiment, a computer-implemented method for using customer context to detonate malware may be performed by one or more computing devices, each comprising one or more processors. The method may include receiving an artefact associated with a first device being targeted by malware, simulating in a controlled environment attributes of the first device based at least in part on the artefact, executing the malware in the controlled environment while the attributes of the first device are being simulated, and performing a security action with respect to the malware based at least in part on the execution of the malware in the controlled environment.
Claims20
A computer-implemented method for using environment context information to detonate malware, the method being performed by one or more computing devices, each comprising one or more processors, the method comprising:
- receiving, by the one or more computing devices, an artefact associated with a first device being targeted by malware, the malware comprising a first portion and a second portion;
- simulating in a controlled environment, by the one or more computing devices, attributes of the first device based at least in part on the artefact;
- receiving a first portion of the malware at a first point in time;
- executing the first portion of the malware in the controlled environment while the attributes of the first device are being simulated;
- at a second point in time subsequent to the first point in time, receiving a second portion of the malware;
- executing the second portion of the malware in the controlled environment while the attributes of the first device are being simulated;
- and
- performing a security action with respect to the malware based at least in part on the execution of the first portion or the second portion of the malware in the controlled environment.
A computing device configured for using customer context to detonate malware, comprising:
- a processor;
- memory in electronic communication with the processor, wherein the memory stores computer executable instructions that when executed by the processor cause the processor to perform the steps of:
- receiving, by the one or more computing devices, an artefact associated with a first device being targeted by malware, the malware comprising a first portion and a second portion;
- simulating in a controlled environment, by the one or more computing devices, attributes of the first device based at least in part on the artefact;
- receiving a first portion of the malware at a first point in time;
- executing the first portion of the malware in the controlled environment while the attributes of the first device are being simulated;
- at a second point in time subsequent to the first point in time, receiving a second portion of the malware;
- executing the second portion of the malware in the controlled environment while the attributes of the first device are being simulated;
- and
- performing a security action with respect to the malware based at least in part on the execution of the first portion or the second portion of the malware in the controlled environment.
A computer-program product for using customer context to detonate malware, the computer-program product comprising a non-transitory computer-readable medium storing instructions thereon, the instructions being executable by a processor to:
- receiving, by the one or more computing devices, an artefact associated with a first device being targeted by malware, the malware comprising a first portion and a second portion;
- simulating in a controlled environment, by the one or more computing devices, attributes of the first device based at least in part on the artefact;
- receiving a first portion of the malware at a first point in time;
- executing the first portion of the malware in the controlled environment while the attributes of the first device are being simulated;
- at a second point in time subsequent to the first point in time, receiving a second portion of the malware;
- executing the second portion of the malware in the controlled environment while the attributes of the first device are being simulated;
- and
- performing a security action with respect to the malware based at least in part on the execution of the first portion or the second portion of the malware in the controlled environment.
Dependencies are inferred from the claim text.