Multi-lateral process trees for malware remediation
AssigneeMcAfee, Inc.
InventorsJonathan L. Edwards, Saurabh Gautam, Dhananjay Kumar, Joel R. Spurlock
Life of this patent
Estimating the term…
Abstract
There is disclosed in one example a computing apparatus, including: a processor and a memory; and instructions encoded within the memory to instruct the processor to provide a security agent to: identify a malicious process; construct a genealogical process tree of the malicious process, the genealogical process tree including both vertical direct inheritance and horizontal indirect inheritance relationships; and terminate the malicious process and at least some related processes in the genealogical process tree.
Claims20
A computing apparatus, comprising:
- a processor and a memory;
- and
- instructions encoded within the memory to instruct the processor to provide a security agent to:
- identify a malicious process;
- construct a genealogical process tree of the malicious process, the genealogical process tree including both vertical direct inheritance and horizontal indirect inheritance relationships, wherein horizontal indirect inheritance relationships include a first object or process that was scheduled to run by a different object or process not a direct parent of the first object or process;
- and
- terminate the malicious process and at least some related processes in the genealogical process tree.
One or more tangible, non-transitory computer-readable storage media having stored thereon executable instructions to provide a security agent configured to:
- determine that a running process is malicious;
- construct a process graph of the malicious process, the process graph comprising direct parent-child relationships of directly-spawned processes, indirect parent-child relationships, and non-linear relationships wherein a first process scheduled a second process to be spawned indirectly, creating an indirect parent-child relationship wherein the first process is not a direct parent of the second process;
- and
- terminate the malicious process, direct children of the malicious process, and indirect children of the malicious process.
A computer-implemented method of remedying activity by a malicious process, comprising:
- determining observationally and/or heuristically that the malicious process is malware;
- constructing a process tree for the malicious process, the process tree comprising both direct vertical parent-child relationships and indirect horizontal parent-child relationships, the horizontal relationships representing a relationship wherein a first process scheduled a second process to be spawned without spawning the second process as a direct parent;
- and
- terminating the malicious process, vertical children of the malicious process, and horizontal children of the malicious process.
Dependencies are inferred from the claim text.