Methods and apparatus for identifying and removing malicious applications
AssigneeSunStone Information Defense, Inc.
InventorDavid K. Ford
Life of this patent
Estimating the term…
Abstract
A system, method, and apparatus for identifying and removing malicious applications are disclosed. An example apparatus includes an executable application configured to collect data regarding processes operating on a client device during a time period. The executable application is also configured to purposefully access, during the time period, an application server using a web browser on the client device in an attempt to trigger a malicious application potentially located on the client device. The executable application is configured to transmit, after the time period, the collected data to an analysis server to determine whether the malicious application is located on the client device.
Claims20
An apparatus comprising:
- a client device including a processor and a memory, the client device being communicatively coupled to a network;
- and
- an executable application including instructions stored in the memory, which when executed, cause the processor to:
- collect data regarding processes operating on the client device during a time period that begins before a predetermined application server is accessed,
- purposefully access automatically without user direction, during the time period, the predetermined application server via the network using a web browser on the client device in an attempt to trigger a malicious application potentially located on the client device,
- after the time period, stop collecting the data regarding processes operating on the client device, and
- transmit, after the time period, the collected data to an analysis server to determine whether the malicious application is located on the client device.
A machine-accessible device having instructions stored thereon that, when executed, cause a machine to at least:
- collect data regarding processes operating on a client device before a predetermined application server is accessed;
- access automatically the predetermined application server using a web browser or a software application related to the predetermined application server in an attempt to trigger a malicious application potentially located on the client device;
- collect the data regarding processes operating on the client device during the access of the predetermined application server;
- stop collecting the data regarding processes operating on the client device after the predetermined application server has been accessed;
- transmit the collected data to an analysis server to enable determination as to whether the malicious application is located on the client device;
- receive a message from the analysis server indicative of the malicious application;
- and
- provide an alert indicative of the malicious application on the client device after receiving the message.
A method for detecting a malicious application on a client device, the method comprising:
- collecting, via a processor, data regarding processes operating on a client device before a predetermined application server is accessed;
- accessing automatically, vie the processor, the predetermined application server using a web browser or a software application related to the predetermined application server in an attempt to trigger a malicious application potentially located on the client device;
- collecting, via the processor, the data regarding processes operating on the client device during the access of the predetermined application server;
- stop collecting, via the processor, the data regarding processes operating on the client device after the access of the predetermined application server;
- transmitting, via the processor, the collected data to an analysis server to enable determination as to whether the malicious application is located on the client device;
- receiving, via the processor, a message from the analysis server indicative of the malicious application;
- and
- after receiving the message, at least one of:
- (a) displaying, on the client device via the processor, an alert indicative of the malicious application on the client device,
- (b) removing, via the processor, the malicious application from operation on the client device, or
- (c) preventing, via the processor, the malicious application from interfering or interacting with the client device after receiving the message.
Dependencies are inferred from the claim text.