US 11,451,580 B2Granted

Method and system of decentralized malware identification

AssigneeTrust Ltd.

InventorsIlya Konstantinovich Sachkov, Aleksandr Vyacheslavovich Lazarenko

Life of this patent

Estimating the term…

Loading patent…

Abstract

Non-limiting embodiments of the present technology are directed to a system and a method for ensuring cybersecurity, namely, to a method for distributed malware inspection and a system implementing the method. The method comprises receiving input data identifying a potential malware; checking the potential malware based on the input data; adding check parameters and at least one result of the potential malware check into the transaction pool; receiving results of the distributed check of the potential malware from the plurality of networked computer devices; determining a harmfulness parameter based on results of the distributed malware check of the potential malware; in response to the harmfulness parameter of the potential malware exceeds a predetermined threshold value, identifying the potential malware as malware; storing the identified malware and associated data related to the identified malware in the distributed malware register.

Claims18

Dependent claims

A method of executing a distributed malware check, the method executable by a given computer device of a plurality of computer devices forming a distributed network, the plurality of computer devices being communicatively coupled amongst each other via a peer-to-peer connection, the given computer device of the plurality of computer devices including:

(i) a respective individual copy of a distributed malware register database, the distributed malware register database being for storing data of malware identified by each one of the plurality of computer devices of the distributed network;
and (ii) a respective individual copy of a transaction pool database, the transaction pool database being for storing parameters of the plurality of computer device, the method comprising:
receiving, by the given computer device, input data identifying a potential malware;
analyzing, by the given computer device, using a given set of check parameters, the input data to determine if the potential malware is malware;
adding, by the given computer device, the input data, the given set of check parameters, and at least one result of the analyzing into the respective individual copy of the transaction pool database, thereby causing replication of the given set of check parameters and the at least one result of the analyzing in respective individual copies of the transaction pool database of other ones of the plurality of computer devices of the distributed network enabling the other ones of the plurality of computer device to analyze the input data of the potential malware using the given set of check parameters;
receiving, by the given computer device, respective results of analyzing, by at least some of the other ones of the plurality of computer devices, the input data to determine if the potential malware is the malware;
aggregating the at least one result of the analyzing the potential malware by the given computer device and the respective results from the at least some of the other ones of the plurality of computer devices of the distributed network to determine a harmfulness parameter associated with the potential malware;
in response to the harmfulness parameter of the potential malware exceeds a predetermined threshold value, identifying, by the given computer device, the potential malware as being the malware;
storing, by the given computer device, data of the identified malware in the respective individual copy of the distributed malware register of the given computer device, thereby causing replication of the data of the identified malware in respective individual copies of the distributed malware register of the other ones of the plurality of computer devices for further use in identifying the malware.

6 more elements

A computer device for distributed malware check, the computer device being one of a plurality of computer devices forming a distributed network, the plurality of computer devices being communicatively coupled amongst each other via a peer-to-peer connection, the computer device of the plurality computer devices including:

(i) a respective individual copy of a distributed malware register database, the distributed malware register database being for storing data of malware identified by each one of the plurality of computer devices of the distributed network;
and (ii) a respective individual copy of a transaction pool database, the transaction pool database being for storing parameters of the plurality of computer device, the computer device comprising a communication interface and a processor functionally coupled to the communication interface, the processor being configured to:
receive input data identifying a potential malware;
analyze, using a given set of check parameters, the input data to determine if the potential malware is malware;
add the input data, the given set of check parameters, and at least one result of the analyzing into the respective individual copy of the transaction pool database, thereby causing replication of the given set of check parameters and the at least one result of the analyzing in respective individual copies of the transaction pool database of other ones of the plurality of computer devices of the distributed network enabling the other ones of the plurality of computer device to analyze the input data of the potential malware using the given set of check parameters;
receive respective results of analyzing, by at least some of the other ones of the plurality of computer devices, the input data to determine if the potential malware is the malware;
aggregate the at least one result of the analyzing and the respective results from the at least some of the other ones of the plurality of computer devices of the distributed network to determine a harmfulness parameter associated with the potential malware;
in response to the harmfulness parameter of the potential malware exceeds a predetermined threshold value, identify the potential malware as being the malware;
store data of the identified malware in the respective individual copy of the distributed malware register of the computer device, thereby causing replication of the data of the identified malware in respective individual copies of the distributed malware register of the other ones of the plurality of computer devices for further use in identifying the malware.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/243,530Filed 9 Jan 2019
Published: US 2019/0222586 A118 Jul 2019
Granted: 20 Sep 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
G06N 20/00
Machine learning
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L
Digital communication

Family

US 2019/0222586 A1Pre-grant publication · published 18 Jul 2019
US 11,451,580 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key