US 11,379,582 B2Granted

Methods and apparatus for malware threat research

AssigneeWebroot Inc.

InventorsMelvyn Morris, Paul Stubbs, Markus Hartwig, Darren Harter

Life of this patent

Estimating the term…

Loading patent…

Abstract

In one aspect, a method of classifying a computer object as malware includes receiving at a base computer data about a computer object from each of plural remote computers on which the object or similar objects are stored. The data about the computer object received from the plural computers is compared in the base computer. The computer object is classified as malware on the basis of said comparison. In one embodiment, the data about the computer object includes one or more of: executable instructions contained within or constituted by the object; the size of the object; the name of the object; the logical storage location or path of the object on the respective remote computers; the vendor of the object; the software product and version associated with the object; and, events initiated by or involving the object when the object is created, configured or runs on the respective remote computers.

Claims17

Dependent claims

A method for monitoring execution of a process for unsafe behavior, comprising:

upon execution of a process, at a monitor agent, searching a database for a pre-authorization of the process;
when the pre-authorization for the process is found in the database,
executing the process and, at the monitor agent, monitoring the execution of the process to determine whether the process is executing within an expected behavior of a mask for the process;
if the process is determined not to be executing with the expected behavior of the mask for the process, issuing an alert;
and
if the process is determined to be executing within the expected behavior of the mask for the process, continuing execution of the process and continuing to monitor the process for the expected behavior of the mask for the process;
and
when the pre-authorization for the process is not found in the database,
executing the process and, at the monitor agent, monitoring the execution of the process;
based on said monitoring of the execution of the process, generating a mask for the process;
wherein the database is one of a local database stored on a machine or a shared database stored on a central server for saving information for a plurality of processes and accessed by a plurality of monitor agents executing on client machines, and when the pre-authorization for the process is not found in the database and as result of said monitoring of the execution of the process, generating the mask comprises:
determining that the process is not executing within the expected behavior of the mask for the process when a behavior of the process comprises unsafe behavior comprising ill effects or results in a computing environment, attempting to connect to a known unsafe website or database, or taking an action that is known to be unsafe;
modifying the mask to include information associated with the unsafe behavior;
and
storing the modified mask in the community database for the process, thereby enabling monitor agents to access the mask when executing the process.

12 more elements

A system for monitoring execution of a process for unsafe behavior, comprising:

a processor;
memory coupled to the processor, the memory comprising computer executable instructions that, when executed by the processor, perform a method for monitoring execution of a process for unsafe behavior;
comprising:
upon execution of a process, at a monitor agent, searching a database for a pre-authorization of the process;
when the pre-authorization for the process is found in the database,
executing the process and, at the monitor agent, monitoring the execution of the process to determine whether the process is executing within an expected behavior of a mask for the process;
if the process is determined not to be executing with the expected behavior of the mask for the process, issuing an alert;
and
if the process is determined to be executing within the expected behavior of the mask for the process, continuing execution of the process and continuing to monitor the process for the expected behavior of the mask for the process;
and
when the pre-authorization for the process is not found in the database,
executing the process and, at the monitor agent, monitoring the execution of the process;
and
based on said monitoring of the execution of the process, generating a mask for the process;
wherein the database is one of a local database stored on a machine or a shared database stored on a central server for saving information for a plurality of processes and accessed by a plurality of monitor agents executing on client machines, and when the pre-authorization for the process is not found in the database and as result of said monitoring of the execution of the process, generating the mask comprises:
determining that the process is not executing within the expected behavior of the mask for the process when a behavior of the process comprises unsafe behavior comprising ill effects or results in a computing environment, attempting to connect to a known unsafe website or database, or taking an action that is known to be unsafe;
modifying the mask to include information associated with the unsafe behavior;
and
storing the modified mask in the community database for the process, thereby enabling monitor agents to access the mask when executing the process.

16 more elements

A computer program product comprising a non-transitory computer readable medium storing instructions executable by a processor to perform a set of operations for monitoring execution of a process for unsafe behavior, the set of operations comprising:

upon execution of a process, at a monitor agent, searching a database for a pre-authorization of the process;
when the pre-authorization for the process is found in the database,
executing the process and, at the monitor agent, monitoring the execution of the process to determine whether the process is executing within an expected behavior of a mask for the process;
if the process is determined not to be executing with the expected behavior of the mask for the process, issuing an alert;
and
if the process is determined to be executing within the expected behavior of the mask for the process, continuing execution of the process and continuing to monitor the process for the expected behavior of the mask for the process;
and
when the pre-authorization for the process is not found in the database,
executing the process and, at the monitor agent, monitoring the execution of the process;
and
based on said monitoring of the execution of the process, generating a mask for the process;
wherein the database is one of a local database stored on a machine or a shared database stored on a central server for saving information for a plurality of processes and accessed by a plurality of monitor agents executing on client machines, and when the pre-authorization for the process is not found in the database and as result of said monitoring of the execution of the process, generating the mask comprises:
determining that the process is not executing within the expected behavior of the mask for the process when a behavior of the process comprises unsafe behavior comprising ill effects or results in a computing environment, attempting to connect to a known unsafe website or database, or taking an action that is known to be unsafe;
modifying the mask to include information associated with the unsafe behavior;
and
storing the modified mask in the community database for the process, thereby enabling monitor agents to access the mask when executing the process.

13 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/011,398Filed 3 Sep 2020 · continuation
Priority: GB 051337530 Jun 2005
Published: US 2020/0401694 A124 Dec 2020
Granted: 5 Jul 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification3 codes

G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements
G06F 21/577
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…
G06F
Computing and data processing

Family

Application11/477,807Parent of this division · filed 30 Jun 2006
Application13/543,865Parent of this continuation · filed 8 Jul 2012
US 8,418,250 B2Parent of this division · filed 9 Apr 2013
Application14/313,755Parent of this continuation · filed 24 Jun 2014
US 8,763,123 B2Parent of this continuation · filed 24 Jun 2014
US 2020/0401694 A1Pre-grant publication · published 24 Dec 2020
US 10,803,170 B2Parent of this continuation
Application13/543,865Parent of this division
US 2007/0016953 A1Published application
US 2012/0278891 A1Published application
US 2015/0007327 A1Published application
US 11,379,582 B2This patent

From the US filing history. Foreign family members aren’t listed.