Back to results
US 11,108,791 B2Granted
System and methods for efficient combining of malware detection rules
AssigneeKnowBe4, Inc.
InventorsMarcio Castilho, Alin Irimie, Michael Hanley, Daniel Cormier, Raymond Skinner
Life of this patent
Estimating the term…
Abstract
System and methods are described which are useful for efficiently combining characteristic detection rules, such as may be done to efficiently and quickly assist in the dispositioning of user reported security threats.
Claims18
A method comprising;
- establishing, by a device, a combination rule, the combination rule configured with a plurality of characteristic detection rules combined via one or more logical operators to detect one or more characteristics in a predetermined portion of an electronic communication, each of the plurality of characteristic detection rules having an identifier identifying the combination rule, an index of a position of each characteristic detection rule within the combination rule and a description of a specific characteristic based on one of a textual or binary pattern;
- receiving, by the device, the index from each of the identifiers for each characteristic detection rule of the plurality of characteristic detection rules that matched against the electronic communication;
- and
- applying, by the device, the one or more logical operators of the combination rule based on a result of each characteristic detection rule and the index of each characteristic detection rule that matched against the electronic communication, to determine whether the combination rule matches the electronic communication.
1 more element
A system comprising;
- one or more processors, coupled to memory and configured to:
- establish a combination rule configured with a plurality of characteristic detection rules combined via one or more logical operators to detect one or more characteristics in a predetermined portion of an electronic communication;
- and
- wherein each of the plurality of characteristic detection rules has an identifier identifying the combination rule, an index of a position of each characteristic detection rule within the combination rule and a description of a specific characteristic based on one of a textual or binary pattern;
- and
- wherein the one or more processors are configured to:
- receive the index from each of the identifiers for each characteristic detection rule of the plurality of characteristic detection rules that matched against the electronic communication;
- and
- apply the one or more logical operators of the combination rule based on a result of each characteristic detection rule and the index of each characteristic detection rule that matched against the electronic communication, to determine whether the combination rule matches the electronic communication.
6 more elements
Dependencies are inferred from the claim text.