US 11,057,422 B2 · System and method for strategic anti-malware monitoring

Abstract

The system and method described herein may leverage active network scanning and passive network monitoring to provide strategic anti-malware monitoring in a network. In particular, the system and method described herein may remotely connect to managed hosts in a network to compute hashes or other signatures associated with processes running thereon and suspicious files hosted thereon, wherein the hashes may communicated to a cloud database that aggregates all known virus or malware signatures that various anti-virus vendors have catalogued to detect malware infections without requiring the hosts to have a local or resident anti-virus agent. Furthermore, running processes and file system activity may be monitored in the network to further detect malware infections. Additionally, the network scanning and network monitoring may be used to detect hosts that may potentially be participating in an active botnet or hosting botnet content and audit anti-virus strategies deployed in the network.

Claims21

Dependent claims

A method for detecting botnet participation in a network, comprising:

receiving, via a credentialed scan of a scanning target located in the network or from a local agent executing on the scanning target, information describing a plurality of current connections on the scanning target;
detecting that the scanning target is a participant in a botnet based on the information;
determining a topology associated with one or more compromised hosts including the scanning target that have been recruited into participation in a botnet;
and
performing one or more actions to facilitate isolation of the network from botnet traffic attributable to the one or more compromised hosts.

2 more elements

A non-transitory computer-readable storage medium having computer-executable instructions stored thereon for detecting botnet participation in a network, wherein executing the computer-executable instructions by one or more processors causes the one or more processors to:

receive, via a credentialed scan of a scanning target located in the network or from a local agent executing on the scanning target, information describing a plurality of current connections on the scanning target;
detect that the scanning target is a participant in a botnet based on the information;
determine a topology associated with one or more compromised hosts including the scanning target that have been recruited into participation in the botnet;
and
perform one or more actions to facilitate isolation of the network from botnet traffic attributable to the one or more compromised hosts.

2 more elements

Dependencies are inferred from the claim text.

System and method for strategic anti-malware monitoring

Life of this patent

System and method for strategic anti-malware monitoring

Life of this patent

Abstract

Claims21