US 11,388,176 B2Granted

Visualization tool for real-time network risk assessment

AssigneeSonicWALL, Inc.

InventorsF. William Conner, MinhDung Joe NguyenLe, Atul Dhablania, Richard Chio, Justin Jose, Lalith Kumar Dampanaboina

Life of this patent

Estimating the term…

Loading patent…

Abstract

The present disclosure relates to methods and apparatus that collect data regarding malware threats, that organizes this collected malware threat data, and that provides this data to computers or people such that damage associated with these software threats can be quantified and reduced. The present disclosure is also directed to preventing the spread of malware before that malware can damage computers or steal computer data. Methods consistent with the present disclosure may optimize tests performed at different levels of a multi-level threat detection and prevention system. As such, methods consistent with the present disclosure may collect data from various sources that may include endpoint computing devices, firewalls/gateways, or isolated (e.g. “sandbox”) computers. Once this information is collected, it may then be organized, displayed, and analyzed in ways that were not previously possible.

Claims20

Dependent claims

A system for tracking and preventing malware from spreading, the system comprising:

a malware test data evaluation computer that receives malware test data from computing devices associated with a plurality of test layers, wherein the test data received by the malware test data evaluation computer includes a first and a second set of malware test data;
a first set of computing devices of a first test layer of the plurality of test layers that perform a first set of malware tests and that send the first set of malware test data to the evaluation computer, the first set of malware test data identifying a first set of malware types detected by the first set of computing devices;
and
a second set of computing devices of a second layer of the plurality of test layers that perform a second set of malware tests and that send the second set of malware test data to the evaluation computer, the second set of malware test data identifying a second set of malware types detected by the second set of computing devices, wherein the evaluation computer:
evaluates the received test data to identify the first set of malware types detected by the first set of computing devices and the second set of malware types detected by the second set of computing devices,
generates a visualization that illustrates:
a first set of malware test vectors that identify the first set of malware types,
the first set of malware test vectors stopping at the first test layer based on the first set of computing devices detecting and stopping the first set of malware types,
a second set of malware test vectors that identify the second set of malware types, and
the second set of malware test vectors stopping at the second test layer based on the second set of computing devices detecting and stopping the second set of malware types,
displays the visualization on a display, and
updates information displayed on the display over time.

9 more elements

A method for tracking and preventing malware from spreading, the method comprising:

receiving a first set of malware test data from a first set of computing devices associated with a first test layer of a plurality of test layers;
receiving a second set of malware test data from a second set of computing devices associated with a second test layer of the plurality of test layers;
generating a visualization that illustrates:
a first set of malware test vectors that identify a first set of malware types that were detected by execution of program code at the first set of computing devices,
the first set of malware test vectors stopping at the first test layer based on the program code executed at the first set of computing devices detecting and stopping the first set of malware types,
a second set of malware test vectors that identify a second set of malware types that were detected by execution of program code at the second set of computing devices, and
the second set of malware test vectors stopping at the second test layer based on the program code executed at the second set of computing devices detecting and stopping the second set of malware types;
displaying the visualization on a display;
and
updating information displayed on the display over time.

7 more elements

A non-transitory computer-readable storage medium having embodied thereon a program executable by a computer processor to implement a method for tracking and preventing malware from spreading, the method comprising:

receiving a first set of malware test data from a first set of computing devices associated with a first test layer of a plurality of test layers;
receiving a second set of malware test data from a second set of computing devices associated with a second test layer of the plurality of test layers;
generating a visualization that illustrates:
a first set of malware test vectors that identify a first set of malware types that were detected by execution of program code at the first set of computing devices,
the first set of malware test vectors stopping at the first test layer based on the program code executed at the first set of computing devices detecting and stopping the first set of malware types,
a second set of malware test vectors that identify a second set of malware types that were detected by execution of program code at the second set of computing devices, and
the second set of malware test vectors stopping at the second test layer based on the program code executed at the second set of computing devices detecting and stopping the second set of malware types;
displaying the visualization on a display;
and
updating information displayed on the display over time.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/863,933Filed 30 Apr 2020 · us provisional application
Priority: 3 Dec 2019
Published: US 2021/0168157 A13 Jun 2021
Granted: 12 Jul 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic
G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements
H04L 43/028
Capturing of monitoring data: by filtering
H04L 43/045
Processing captured monitoring data, e.g. for logfile generation: for graphical visualisation of monitoring data