# US 12,003,514 B2 · Program verification and malware detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,514 B2
- Document ID: US12003514B2
- Status: Granted
- Kind: B2
- Application number: 16/858,683
- Filed: 2020-04-26
- Published: 2020-10-08
- Granted: 2024-06-04
- Earliest claimed: 2012-10-02
- Applicants: Mordecai Barkan
- Inventors: Mordecai Barkan
- Web page: https://patentgrep.com/patent/US12003514B2

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 21/554: {involving event detection and direct action}
- G06F 21/561: {Virus type analysis}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04W 4/44: for communication between vehicles and infrastructures, e.g. vehicle-to-cloud [V2C] or vehicle-to-home [V2H]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Software programs are updated and upgraded regularly. This is a cause for infection by malware (or a faulty program). By attaining the statistical relation between the input data to the program and the output data from the program the presence of malware may be detected with high fidelity. The base for this approach is the fact the necessary and sufficient conditions to determine the working of a program is evaluation of input against output.

## Claims

### Claim 1

A trusted computing system comprising: a first processor and a first memory;
the first memory stores a first program to be executed by the first processor;
a second computing system comprising a second processor and a second memory;
the second memory stores a second program to be executed by the second processor;
the second computing system receives an input data set;
the input data set is processed by the second program executed by the second processor, to result an output data set;
the trusted computing system receives the input data set or the output data set;
the trusted computing system communicates, the input data set or the output data set, to a third computing system for evaluation or
carries an evaluation by the first program;
the evaluation is based on statistical properties and dependency of the input data set and the output data set, where the first program or the third computing system, detects deviations or discrepancies, and determines, based on the evaluation, that the second program is faulty;
the trusted computing system, by means of the input data set or output data set, carries any of transmitting, monitoring, containing, detecting malware infection, blocking, refreshing, backup operation by means of the input data set, or testing of the second program.

### Claim 2

A method of detecting a faulty program, the method comprising:
storing a trusted program to be executed by a processor;
storing a legacy program to be executed by the processor;
receiving an input data set by the legacy program processing the input data set by the legacy program executed by the processor, to result an output data set;
receiving the input data set or the output data set by the trusted program;
communicating, by the trusted program, the input data set or the output data set to a second computing system for evaluation or
carrying an evaluation by the trusted program, wherein the evaluation is based on statistical properties and dependency of the input data set and the output data set;
detecting, by the trusted program or the second computing system, deviations or discrepancies, and determining, based on the evaluation, that the legacy program is faulty;
carrying, by the trusted program, by means of the input data set or output data set, any of transmitting, monitoring, containing, detecting malware infection, blocking, refreshing, backup operation, or testing of the legacy program.