# US 11,307,950 B2 · Computing device health monitoring system and methods

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,307,950 B2
- Document ID: US11307950B2
- Status: Granted
- Kind: B2
- Application number: 17/214,882
- Filed: 2021-03-28
- Published: 2021-07-15
- Granted: 2022-04-19
- Earliest claimed: 2019-02-08
- Assignees: NeuShield, Inc.
- Applicants: NeuShield, Inc.
- Inventors: Elisha Riedlinger; Fei Qi; Yuen Pin Yeap
- Web page: https://patentgrep.com/patent/US11307950B2

## CPC

- G06F 11/3034: {where the computing system component is a storage system, e.g. DASD based or network based (digital input from or digital output to record carriers G06F3/06; digital recording or reproducing G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097)}
- G06F 11/0772: {Means for error signaling, e.g. using interrupts, exception flags, dedicated error registers}
- G06F 11/3055: {Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available (error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction of the data by redundancy in operations G06F11/14; error detection or correction by redundancy in hardware G06F11/16)}
- G06F 11/3058: {Monitoring arrangements for monitoring environmental properties or parameters of the computing system or of the computing system component, e.g. monitoring of power, currents, temperature, humidity, position, vibrations (thermal management in cooling arrangements of a computing system G06F1/206)}
- G06F 11/328: {Computer systems status display (G06F11/327 takes precedence)}
- G06F 21/554: {involving event detection and direct action}
- G06F 11/3452: {Performance evaluation by statistical analysis}
- G06F 2201/81: Threshold
- G06F 2201/88: Monitoring involving counting
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A data health monitoring system and method are provided which may be configured to monitor different indicators or parameters of a computing device which may affect the health of the computing device, such as which may be used in looking for early warning signs that could indicate future data loss or corruption. The system may periodically query certain data health indicators, such as S.M.A.R.T. status, disk temperature, read and write errors, etc. The system may also monitor data as it is being accessed keeping track of other indicators such as: files that are modified, when the last backed up was, protection status of the file, type of changes made to the file, which application is making changes, etc. Preferably, the combined status of each data health indicator may be rolled up into a simple message and shown to the user via notifications, reports, logs or a user interface.

## Claims

### Claim 1

A computer implemented data health monitoring system, the system comprising:
a computing device having a processor, a memory in communication with the processor, and a data store having a plurality of files;
an indexing logic executed by the processor and configured to read and measure both a behavior parameter and a physical parameter of the computing device, where both the behavior parameter and the physical parameter are used as inputs by the indexing logic to calculate a health index value; and
wherein the indexing logic calculates the health index value using both:
i) the behavior parameter selected from at least one of; a percentage of the plurality of files that have been manipulated by a target program, and determining if there was a change of magic number of a file in the data store; and
ii) the physical parameter selected from at least one of, a number of read and write errors on the data store, and a disk temperature of the data store.

### Claim 2 (depends on 1)

The system of claim 1, wherein an increase in the read and write errors on the data store changes the health index value.

### Claim 3 (depends on 1)

The system of claim 1, wherein a change in the disk temperature of the data store changes the health index value.

### Claim 4 (depends on 1)

The system of claim 1, wherein the indexing logic changes the health index value using the behavior parameter that comprises determining if there was a change of a magic number of a file in the data store.

### Claim 5 (depends on 1)

The system of claim 1, wherein the indexing logic is configured to read a process parameter that comprises reading if a target program was obtained from an email, and wherein the indexing logic calculates the health index value using the process parameter that comprises reading if a target program was obtained from an email.

### Claim 6 (depends on 1)

The system of claim 1, wherein the indexing logic is configured to read a parameter that comprises determining a time of a last backup of the plurality of files, and wherein the determined time changes the health index value.

### Claim 7 (depends on 1)

The system of claim 1, wherein the indexing logic is configured to read a process parameter that comprises determining if a target process is unknown, and wherein the indexing logic calculates the health index value using the process parameter that comprises determining if the target process is unknown.

### Claim 8 (depends on 1)

The system of claim 1, wherein the indexing logic is configured to read a process parameter that comprises reading if an executable of a target program is signed by a legitimate authority, and wherein the indexing logic calculates the health index value using the process parameter that comprises reading if an executable of a target program is signed by a legitimate authority.

### Claim 9 (depends on 1)

The system of claim 1, wherein a location of a target program on the computing device impacts the health index value.

### Claim 10 (depends on 1)

The system of claim 1, wherein the indexing logic is configured to read a process parameter that comprises reading if a target program was installed by an authorized user, and wherein the indexing logic calculates the health index value using the process parameter that comprises reading if a target program was installed by an authorized user.

### Claim 11 (depends on 1)

The system of claim 1 wherein the indexing logic is configured to read the behavior parameter that comprises determining if a threshold percentage of the plurality of files on the data store are read, and wherein the indexing logic calculates the health index value using the behavior parameter that comprises determining if the threshold percentage is reached.

### Claim 12 (depends on 1)

The system of claim 1, wherein the indexing logic is configured to read the behavior parameter that comprises determining if a number of files on the data store read by a target program reaches a reading threshold, and wherein the indexing logic calculates the health index value using the behavior parameter that comprises determining if the reading threshold is reached.

### Claim 13 (depends on 1)

The system of claim 1, wherein the indexing logic is configured to read a parameter that comprises determining if a number of system crashes of the computing device in a time period reaches a crash threshold, and wherein the health index value is changed if the crash threshold is reached.

### Claim 14 (depends on 1)

The system of claim 1, wherein the indexing logic is configured to read a parameter that comprises determining if an amount of free space of the data store reaches a storage threshold, and wherein the health index value is changed if the storage threshold is reached.

### Claim 15 (depends on 1)

The system of claim 1, wherein the indexing logic is configured to read a behavior parameter that comprises determining if there was an increase in entropy of a file of the plurality of files, and wherein the indexing logic calculates the health index value using the behavior parameter that comprises determining if there was an increase in entropy of the plurality of files.

### Claim 16 (depends on 1)

The system of claim 1, further comprising a process parameter and a behavior parameter, wherein the process parameter comprises a process parameter constant value, wherein the behavior parameter comprises a behavior parameter constant value, and wherein the health index value comprises both the process parameter constant value and the behavior parameter constant value.

### Claim 17 (depends on 1)

The system of claim 1, wherein the indexing logic provides a notification to a user of the computing device if the health index value reaches an index threshold value.