Cryptocurrency based malware and ransomware detection systems and methods
AssigneeCipherTrace, Inc.
InventorsDavid Jevans, Rudi Cilibrasi
Life of this patent
Estimating the term…
Abstract
Cryptocurrency based malware and ransomware detection systems and methods are disclosed herein. An example method includes analyzing a plurality of malware or ransomware attacks to determine cryptocurrency payment address of malware or ransomware attacks, building a malware or ransomware attack database with the cryptocurrency payment addresses of the plurality of malware or ransomware attacks, identifying a proposed cryptocurrency transaction that includes an address that is included in the malware or ransomware attack database, and denying the proposed cryptocurrency transaction.
Claims20
A method for cryptocurrency-based malware detection, the method comprising:
- analyzing a screenshot of a ransomware note displayed on an end user device, associated with a cryptocurrency-based malware or ransomware attack;
- based on the analyzing:
- identifying a uniform resource locator (URL) of a decryptor download site of the cryptocurrency-based malware or ransomware attack;
- and
- identifying a cryptocurrency payment address of the cryptocurrency-based malware or ransomware attack;
- identifying additional cryptocurrency addresses included in a sample code of the cryptocurrency-based malware or ransomware attack;
- storing the additional cryptocurrency addresses to a malware or ransomware attack database;
- tracing a ransom payment paid to the cryptocurrency payment address in response to the cryptocurrency-based malware or ransomware attack;
- based on the tracing of the ransom payment paid to the cryptocurrency payment address, storing the cryptocurrency payment address in the malware or ransomware attack database;
- and
- identifying a proposed cryptocurrency transaction that includes an address that is included in the malware or ransomware attack database.
A system, comprising:
- a processor;
- and
- a memory for storing instructions, the processor executing the instructions to:
- analyze a screenshot of a ransomware note displayed on an end user device, associated with a cryptocurrency-based malware or ransomware attack;
- based on the analyzing:
- identify a uniform resource locator (URL) of a decryptor download site of the cryptocurrency-based malware or ransomware attack;
- and
- identify a cryptocurrency payment address of the cryptocurrency-based malware or ransomware attack;
- identify additional cryptocurrency addresses included in a sample code of the cryptocurrency-based malware or ransomware attack;
- store the additional cryptocurrency addresses to a malware or ransomware attack database;
- trace a ransom payment paid to the cryptocurrency payment address in response to the cryptocurrency-based malware or ransomware attack;
- based on the tracing of the ransom payment paid to the cryptocurrency payment address, store the cryptocurrency payment address in the malware or ransomware attack database;
- and
- identify a proposed cryptocurrency transaction that includes an address that is included in the malware or ransomware attack database.
A method for cryptocurrency-based malware detection, the method comprising:
- analyzing a screenshot of a ransomware note displayed on an end user device, associated with a cryptocurrency-based malware or ransomware attack;
- based on the analyzing, identifying a cryptocurrency payment address of the cryptocurrency-based malware or ransomware attack;
- identifying additional cryptocurrency addresses included in a sample code of the cryptocurrency-based malware or ransomware attack;
- storing the additional cryptocurrency addresses to a malware or ransomware attack database;
- tracing a ransom payment paid to the cryptocurrency payment address in response to the cryptocurrency-based malware or ransomware attack;
- based on the tracing of the ransom payment paid to the cryptocurrency payment address, storing the cryptocurrency payment address in the malware or ransomware attack database;
- identifying a proposed cryptocurrency transaction that includes an address that is included in the malware or ransomware attack database;
- and
- denying the proposed cryptocurrency transaction.
Dependencies are inferred from the claim text.