US 11,451,581 B2Granted

Systems and methods for malware detection and mitigation

AssigneeArchitecture Technology Corporation

InventorsJoseph Sirianni, Judson Powers, Robert Joyce

Life of this patent

Estimating the term…

Loading patent…

Abstract

Disclosed herein are embodiments of systems, methods, and products comprise an analytic server, which detects and defends against malware in-flight regardless of the specific nature and methodology of the underlying attack. The analytic server learns the system's normal behavior during testing and evaluation phase and trains a machine-learning model based on the normal behavior. The analytic server monitors the system behavior during runtime comprising the runtime behavior of each sub-system of the system. The analytic server executes the machine-learning model and compares the system runtime behavior with the normal behavior to identify anomalous behavior. The analytic server executes one or more mitigation instructions to mitigate malware. Based on multiple available options for mitigating malware, the analytic server makes an intelligent decision and takes the least impactful action that have the least impact on the system to maintain mission assurance.

Claims18

Dependent claims

A computer-implemented method, comprising:

generating, by a server, kernel level feature vectors of system call hierarchy during testing phase of a computing system;
training, by the server, a machine-learning model based upon the kernel level feature vectors for the machine-learning model to learn a normal behavior of the computing system;
retrieving, by the server, a first set of system calls of a first sub-system of the computing system during runtime of the computing system;
retrieving, by the server, a second set of system calls of a second sub-system of the computing system during runtime of the computing system;
executing, by the server, the machine-learning model on the first and the second sets of system calls to compare the runtime behavior of the computing system with the normal behavior;
and
in response to the server determining that the runtime behavior deviates from the normal behavior over a predetermined threshold, instructing, by the server, the computing system to execute one or more mitigation instructions,
wherein the one or more mitigation instructions comprises changing an anomalous system call parameter to a specific value, changing an anomalous return value to a specific value, halting the system calls, and executing a script on the computing system.

5 more elements

A computer system comprising:

a computing system comprising a first sub-system and a second sub-system;
a server in communication with the computing system and having a processor comprising instructions that when executed by the processor are configured to:
generate kernel level feature vectors of system call hierarchy during testing phase of the computing system;
train a machine-learning model based upon the kernel level feature vectors for the machine-learning model to learn a normal behavior of the computing system;
retrieve a first set of system calls of the first sub-system of the computing system during runtime of the computing system;
retrieve a second set of system calls of the second sub-system of the computing system during runtime of the computing system;
execute the machine-learning model on the first and the second sets of system calls to compare the runtime behavior of the computing system with the normal behavior;
and
in response to determining that the runtime behavior deviates from the normal behavior over a predetermined threshold, instruct the computing system to execute one or more mitigation instructions,
wherein the one or more mitigation instructions comprises changing an anomalous system call parameter to a specific value, changing an anomalous return value to a specific value, halting the system calls, and executing a script on the computing system.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/417,531Filed 20 May 2019
Published: US 2020/0374298 A126 Nov 2020
Granted: 20 Sep 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
G06N 3/04
Neural networks: architecture, e.g. interconnection topology
G06N 3/0464
Architecture, e.g. interconnection topology: convolutional networks [CNN, ConvNet]
G06N 3/084
Learning methods: backpropagation, e.g. using gradient descent

Family

US 2020/0374298 A1Pre-grant publication · published 26 Nov 2020
US 11,451,581 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key