Back to results
US 11,689,560 B2Granted
Network-wide malware mapping
AssigneeCisco Technology, Inc.
InventorsMichal Garcarz, Piotr Kupisiewicz, Paweł Tybinka
Life of this patent
Estimating the term…
Abstract
A network management system is configured to detect one or more malicious activities at one or more devices connected to a network. The network management system is configured to determine a malware root of the one or more malicious activities and generate a network-wide indicating a hierarchical relationship between the malicious activities spawned by the malware root and the malware root. The malicious activities spawned by the malware root represented in the network-wide malware include the one or more malicious activities and include a plurality of malicious activities spawned across a plurality of devices connected to the network.
Claims20
A method comprising:
- detecting one or more malicious activities at one or more devices connected to a network;
- determining a malware root of the one or more malicious activities;
- generating a network-wide malware mapping indicating a hierarchical relationship between all activities spawned by the malware root and the malware root,
- wherein the network-wide malware mapping identifies all of the activities spawned by the malware root, including a plurality of activities spawned across a plurality of devices connected to the network as a result of the malware root;
- assessing one or more effects of performing a network-wide rollback of at least one malicious activity spawned on at least one of the plurality of devices connected to the network, wherein assessing the one or more effects comprises assessing a risk associated with performing a rollback of an action previously performed on the at least one of the plurality of devices connected to the network wherein the risk is based, at least in part, on a determination indicating whether each activity spawned by the malware root is a malicious activity or a non-malicious activity;
- and
- initiating a network-wide rollback of a plurality of malicious activities spawned across the plurality of devices connected to the network based, at least in part, on the risk associated with performing the rollback of the action previously performed on the at least one of the plurality of devices connected to the network.
4 more elements
One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to:
- detect one or more malicious activities at one or more devices connected to a network;
- determine a malware root of the one or more malicious activities;
- generate a network-wide malware mapping indicating a hierarchical relationship between all activities spawned by the malware root and the malware root,
- wherein the network-wide malware mapping identifies all of the activities spawned by the malware root, including a plurality of activities spawned across a plurality of devices connected to the network as a result of the malware root;
- assess one or more effects of performing a network-wide rollback of at least one malicious activity spawned on at least one of the plurality of devices connected to the network, wherein to assess the one or more effects comprises assessing a risk associated with performing a rollback of an action previously performed on the at least one of the plurality of devices connected to the network wherein the risk is based, at least in part, on a determination indicating whether each activity spawned by the malware root is a malicious activity or a non-malicious activity;
- and
- initiate a network-wide rollback of a plurality of malicious activities spawned across the plurality of devices connected to the network based, at least in part, on the risk associated with performing the rollback of the action previously performed on the at least one of the plurality of devices connected to the network.
4 more elements
An apparatus comprising:
- one or more network interfaces;
- memory;
- and
- one or more processors configured to:
- detect one or more malicious activities at one or more devices connected to a network,
- determine a malware root of the one or more malicious activities,
- generate a network-wide malware mapping indicating a hierarchical relationship between all activities spawned by the malware root and the malware root,
- wherein the network-wide malware mapping identifies all of the activities spawned by the malware root, including a plurality of activities spawned across a plurality of devices connected to the network as a result of the malware root;
- assess one or more effects of performing a network-wide rollback of at least one malicious activity spawned on at least one of the plurality of devices connected to the network, wherein to assess the one or more effects comprises assessing a risk associated with performing a rollback of an action previously performed on the at least one of the plurality of devices connected to the network wherein the risk is based, at least in part, on a determination indicating whether each activity spawned by the malware root is a malicious activity or a non-malicious activity;
- and
- initiate a network-wide rollback of a plurality of malicious activities spawned across the plurality of devices connected to the network based, at least in part, on the risk associated with performing the rollback of the action previously performed on the at least one of the plurality of devices connected to the network.
8 more elements
Dependencies are inferred from the claim text.