US 11,641,366 B2Granted

Centralized tool for identifying and blocking malicious communications transmitted within a network

AssigneeBank of America Corporation

InventorMaharaj Mukherjee

Life of this patent

Estimating the term…

Loading patent…

Abstract

An apparatus includes a memory and a processor. The memory stores a first list of applications that includes a first application and a second list of applications that includes a second application. Each application of the first list is assigned to a first trust level, indicating that a probability that the application is malicious is less than a lower threshold. Each application of the second list is assigned to a second trust level, indicating that a probability that the application is malicious is greater than the lower threshold. The processor determines that the second application transmitted a communication destined for the first application, and that the first and second applications are assigned to different trust levels. In response, the processor determines that a probability that the transmitted communication is malicious is greater than a threshold and prevents the communication from reaching the computer system of the first application.

Claims17

Dependent claims

An apparatus comprising:

a memory configured to store:
a first list of applications comprising a first application;
and
a second list of applications comprising a second application, wherein:
each application of the first list of applications is assigned to a first trust level of a set of trust levels, the assignment of the application to the first trust level indicating that the application is a trusted application having a probability that the application is malicious less than a lower threshold;
each application of the second list of applications is assigned to a second trust level of the set of trust levels, the assignment of the application to the second trust level indicating that the application is an untrusted application or a malicious application having a probability that the application is malicious greater than the lower threshold;
and
each application of the first list of applications and the second list of applications belongs to a set of applications, wherein each application of the set of applications is installed on a computer system of a set of computer systems, each computer system of the set of computer systems located on a network;
and
a communication log comprising information identifying communications that have occurred over the network;
and
a hardware processor communicatively coupled to the memory, the hardware processor configured to:
determine that the second application transmitted a communication destined for the first application;
determine that the first application and the second application are assigned to different trust levels of the set of trust levels;
and
in response to determining that the first application and the second application are assigned to different trust levels, and prior to the communication destined for the first application reaching the computer system of the first application:
detect that the second application is a malicious application with a probability of being a malicious application greater than an upper threshold;
determine, based on detecting that the second application is a malicious application, that a probability that the communication destined for the first application is malicious is greater than a threshold;
in response to determining that the probability that the communication destined for the first application is malicious is greater than the threshold, prevent the communication destined for the first application from reaching the computer system of the first application;
and
reclassify, based on detecting that the second application is a malicious application, the first application as an untrusted application with a probability of being a malicious application between the lower threshold and an upper threshold.

18 more elements

A method comprising:

determining that a second application transmitted a communication destined for a first application, wherein:
the first application belongs to a first list of applications that is assigned to a first trust level of a set of trust levels, the assignment of each application of the first list of applications to the first trust level indicating that the application is a trusted application having a probability that the application is malicious less than a lower threshold;
the second application belongs to a second list of applications that is assigned to a second trust level of the set of trust levels, the assignment of each application of the second list of applications to the second trust level indicating that the application is an untrusted application or a malicious application having a probability that the application is malicious greater than the lower threshold;
determining that the first application and the second application are assigned to different trust levels of the set of trust levels;
and
in response to determining that the first application and the second application are assigned to different trust levels, and prior to the communication destined for the first application reaching a computer system on which the first application is installed:
detecting that the second application is a malicious application with a probability of being a malicious application greater than an upper threshold;
determining, based on detecting that the second application is a malicious application, that a probability that the communication destined for the first application is malicious is greater than a threshold;
in response to determining that the probability that the communication destined for the first application is malicious is greater than the threshold, preventing the communication destined for the first application from reaching the computer system on which the first application is installed;
reclassifying, based on detecting that the second application is a malicious application, the first application as an untrusted application with a probability of being a malicious application between the lower threshold and an upper threshold.

7 more elements

A system comprising:

a first computer system on which a first application is installed, the first computer system located on a network;
a second computer system on which a second application is installed, the second computer system located on the network;
a memory configured to store:
a first list of applications comprising the first application, wherein each application of the first list of applications is assigned to a first trust level of a set of trust levels, the assignment of the application to the first trust level indicating that the application is a trusted application having a probability that the application is malicious less than a lower threshold;
and
a second list of applications comprising the second application, wherein each application of the second list of applications is assigned to a second trust level of the set of trust levels, the assignment of the application to the second trust level indicating that the application is an untrusted application or a malicious application having a probability that the application is malicious greater than the lower threshold;
and
a communication log comprising information identifying communications that have occurred over the network;
and
a hardware processor communicatively coupled to the memory, the hardware processor configured to:
determine that the second application transmitted a communication destined for the first application;
determine that the first application and the second application are assigned to different trust levels of the set of trust levels;
and
in response to determining that the first application and the second application are assigned to different trust levels, and prior to the communication destined for the first application reaching the first computer system:
detect that the second application is a malicious application with a probability of being a malicious application greater than an upper threshold;
determine, based on detecting that the second application is a malicious application, that a probability that the communication destined for the first application is malicious is greater than a threshold;
in response to determining that the probability that the communication destined for the first application is malicious is greater than the threshold, prevent the communication destined for the first application from reaching the first computer system;
and
reclassify, based on detecting that the second application is a malicious application, the first application as an untrusted application with a probability of being a malicious application between the lower threshold and an upper threshold.

16 more elements

Dependencies are inferred from the claim text.