US 11,768,933 B2Granted

System and method for protecting against ransomware without the use of signatures or updates

AssigneeSaudi Arabian Oil Company

InventorUrfan Ahmed

Life of this patent

Estimating the term…

Loading patent…

Abstract

A cybersecurity solution for preventing malware from infecting a computing device or a computer resource on the computing device. The solution can include detecting a computer resource process running or attempting to run on an operating system and comparing details of the computer resource process against an authorized processes database containing details of previously run computer resources processes to determine if the computer resource process is running or attempting to run for a first time on the operating system. The solution can include adding, during a learning mode, the details of the computer resource process to the authorized processes database when it is determined that the computer resource process is running or attempting to run for the first time on the operating system, and suspending, during a protect mode, the computer resource process from running on the operating system when it is determined that the computer resource process is running or attempting to run for the first time on the operating system. The details of the computer resource process can include at least one of semaphore data, mutex data or atom data for the computer resource process.

Claims17

Dependent claims

A computer-implemented method for preventing malware from infecting a computing device or a computer resource on the computing device, the method comprising:

providing an authorized processes database including a computer resource process (CRP) whitelist;
performing a cybersecurity threat remediation process;
checking the case that the cybersecurity threat remediation process is in a learning mode or a protect mode;
in the case that the cybersecurity threat remediation process is in the learning mode:
(a) initializing a learn timer;
(b) detecting a computer resource process running or attempting to run on an operating system;
(c) comparing details of the computer resource process against the authorized processes database containing details of previously run computer resources processes to determine if the computer resource process is running or attempting to run for a first time on the operating system;
(d) automatically adding the details of the computer resource process to the authorized processes database when it is determined that the computer resource process is running for the first time or attempting to run for the first time on the operating system;
and
(e) in the case that the learn timer stops, changing from the learning mode to the protect mode and performing steps (f)-(i);
and
in the case that the cybersecurity threat remediation process is in the protect mode:
(f) initializing a protect timer;
(g) disabling an adding of the details of the computer resource (g) process to the CRP whitelist;
(h) suspending the computer resource process from running on the operating system when it is determined that the computer resource process is running or attempting to run for the first time on the operating system;
and
(i) in the case that the protect timer stops, changing from the protect mode to the (i) learning mode and performing steps (a)-(e),
wherein the details of the computer resource process include at least one of semaphore data, mutex data or atom data for the computer resource process.

15 more elements

A system for preventing malware from infecting a computing device or a computer resource on the computing device, the system comprising:

a processor running an operating system;
an authorized processes database including a computer resource process (CRP) whitelist containing details of previously run computer resources processes;
and
a ransomware monitor configured to perform a cybersecurity threat remediation process in a learning mode or a protect mode, the ransomware monitor being arranged to:
check the case that the cybersecurity threat remediation process is in the learning mode or the protect mode;
in the case that the cybersecurity threat remediation process is in the learning mode:
(a) initialize a learn timer;
(b) detect a computer resource process running or attempting to run on the processor;
(c) compare details of the computer resource process against the authorized processes database to determine if the computer resource process is running or attempting to run for a first time on the processor;
(d) automatically add the details of the computer resource process to the authorized processes database when it is determined that the computer resource process is running for the first time or attempting to run for the first time on the operating system;
(e) in the case that the learn timer stops, change from the learning mode to the protect mode and perform steps (f)-(i);
and
in the case that the cybersecurity threat remediation process is in the protect mode;
(f) initialize a protect timer;
(g) disable an adding of the details of the computer resource process to the CRP whitelist;
and
(h) suspend the computer resource process from running on the processor when it is determined that the computer resource process is running or attempting to run for the first time on the processor;
and
(i) in the case that the protect timer stops, change from the protect mode to the learning mode and perform steps (a)-(e).

16 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/990,393Filed 11 Aug 2020
Published: US 2022/0050896 A117 Feb 2022
Granted: 26 Sep 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/562
Computer malware detection or handling, e.g. anti-virus arrangements: static detection
G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…
G06F 21/74
To assure secure computing or processing of information: operating in dual or compartmented mode, i.e. at least one secure mode