US 11,082,443 B2 · Systems and methods for remote identification of enterprise threats

Abstract

Embodiments of the present invention provide techniques, systems, and methods for remote, agent-less enterprise computer threat data collection, malicious threat analysis, and identification and reporting of potential and real threats present on an enterprise computer system. Specifically, embodiments are directed to a system that securely collects system information from computers across the enterprise, internally encrypts and analyzes the collected information for indicators of compromise, threatening behavior, and known vulnerabilities, and generates alerts regarding known and potential threats for further analysis and remediation. If potential threats are identified, the system may deploy a memory analysis module that takes a deeper analysis of the potentially compromised computer to obtain more information about the potential threat. The remote, agent-less collection, analysis, and identification process can be repeated periodically to obtain additional information over time in order to identify the nature of the threat, and may delete itself after completion to avoid detection.

Claims20

Dependent claims

A computer-implemented method for remote identification of enterprise threats, comprising:

receiving, at a threat analysis system, threat parameters associated with an enterprise management system;
compiling an executable threat analysis tool that is configured collect data, from a computing system, associated with the threat parameters;
distributing the executable threat analysis tool to a plurality of computing systems in an enterprise managed by the enterprise management system, the executable threat analysis tool executed each of the plurality of computing systems to generate system data sets, wherein at each computing system the executable threat analysis tool:
collects a system data set associated with said each computing system based on the threat parameters;
sends the system data set to a data store;
and
deletes the executable threat analysis tool and the system data set;
obtaining a plurality of system data sets associated with the plurality of computing systems from the data store, each system data set associated with one of the plurality of computing systems;
analyzing the plurality of system data sets to identify potential threats;
generating a threat report including one or more identified potential threats from one or more computing systems of the plurality of computing systems;
and
causing an alert, including the threat report, to be provided to the enterprise management system.

9 more elements

A non-transitory computer readable storage medium having instructions stored thereon, which when executed by a processing system, cause the processing system to perform operations for remote identification of enterprise threats, the operations comprising:

receiving, at a threat analysis system, threat parameters associated with an enterprise management system;
compiling an executable threat analysis tool that is configured collect data, from a computing system, associated with the threat parameters;
distributing the executable threat analysis tool to a plurality of computing systems in an enterprise managed by the enterprise management system, the executable threat analysis tool executed each of the plurality of computing systems to generate system data sets, wherein at each computing system the executable threat analysis tool:
collects a system data set associated with said each computing system based on the threat parameters;
sends the system data set to a data store;
and
deletes the executable threat analysis tool and the system data set;
obtaining a plurality of system data sets associated with the plurality of computing systems from the data store, each system data set associated with one of the plurality of computing systems;
analyzing the plurality of system data sets to identify potential threats;
generating a threat report including one or more identified potential threats from one or more computing systems of the plurality of computing systems;
and
causing an alert, including the threat report, to be provided to the enterprise management system.

9 more elements

Dependencies are inferred from the claim text.

Systems and methods for remote identification of enterprise threats

Life of this patent

Systems and methods for remote identification of enterprise threats

Life of this patent

Abstract

Claims20