Deferred malware scanning
AssigneeSophos Limited
InventorsTimothy Bruce Kenyon, Patrick James Hammack
Life of this patent
Estimating the term…
Abstract
A code segment executing on a compute instance may be identified as suspicious based on runtime behavior or similar behavioral analysis or the like. In order to ensure the identification and use of the most up-to-date identification and remediation tools, the compute instance may defer various remediation steps for an interval, during which the compute instance may wait for data updates from a threat management system. After the interval has passed, the compute instance may use any updated data or tools in order to address the code segment that triggered the initial malware detection.
Claims20
A computer program product for malware detection and remediation, the computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
- providing an identification of a code segment on a compute instance as suspicious;
- terminating execution of the code segment;
- determining a deferral window that provides a predetermined time period to wait between the identification and a malware scan of the code segment;
- determining a security update deferral time period that is less than the predetermined time period of the deferral window, the security update deferral time period defining a minimum time to wait between the identification and receipt of a security update for use in the malware scan of the code segment;
- and
- after waiting an amount of time equal to the security update deferral time period, performing the malware scan upon the earlier of expiration of the predetermined time period and a time at which a security update is received from a threat management facility after the security update deferral time period.
A method comprising:
- providing an identification of a code segment on a compute instance as suspicious;
- determining a security update deferral time period defining a minimum time to wait after the identification of the code segment as suspicious;
- after expiration of the security update deferral time period, waiting until the earliest of receipt of a security update for use in a malware scan and a predetermined time period to wait for the security update;
- and
- after waiting for the earliest of the receipt of the security update and the predetermined time period, performing the malware scan.
A system comprising:
- an endpoint in an enterprise network, the endpoint including a memory and a processor, the processor configured by computer executable code stored in the memory to perform the steps of providing an identification of a code segment on a compute instance as suspicious based on one or more behavioral characteristics of the code segment during execution, determining a deferral window that provides a predetermined time period to wait between the identification and a malware scan of the code segment, determining a security update deferral time period that is less than the predetermined time period of the deferral window and that defines a minimum time to wait between the identification and receipt of a security update for use in the malware scan of the code segment, in response to the identification, transmitting a notification about the identification to a remote resource, and after waiting the security update deferral time period, performing the malware scan upon the earlier of expiration of the predetermined time period and a time at which the security update is received after the security update deferral time period;
- and
- a threat management facility for the enterprise network, the threat management facility configured to receive the notification from the endpoint and to generate security resolution data responsive to the identification, the security resolution data including one or more of an update to detection data for the malware scan, a remediation for the code segment, a whitelist of the code segment, and an adjustment to security monitoring for the enterprise network to address a threat by the code segment.
Dependencies are inferred from the claim text.