# US 12,182,267 B2 · Systems, methods and devices for memory analysis and visualization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,267 B2 - Document ID: US12182267B2 - Status: Granted - Kind: B2 - Application number: 18/218,833 - Filed: 2023-07-06 - Published: 2024-02-01 - Granted: 2024-12-31 - Earliest claimed: 2015-08-25 - Assignees: Volexity, Inc. - Applicants: Volexity, Inc. - Inventors: Aaron Walters; Michael Ligh; Steven Adair - Web page: https://patentgrep.com/patent/US12182267B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/54: by adding security routines or objects to programs - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and processing devices for aiding with cyber intrusion investigations that includes capabilities for extracting data from a specified range of a volatile memory of a target processing device, reconstructing data structures and artifacts from the extracted data; and generating and presenting a visualization of the reconstructed data structures and the reconstructed artifacts. ## Claims ### Claim 1 A method for aiding cyber intrusion investigations, the method comprising: extracting data from a specified range of a volatile memory of a target processing device; reconstructing data structures and artifacts from the extracted data; and generating and presenting a visualization of the reconstructed data structures and the reconstructed artifacts, in the form of at least one of a table layout, a tree layout, a graph layout, and/or a cross-view layout, to assess the condition of the target processing device; and providing a plurality of analysis methods for evaluating a state of the target processing device, the plurality of analysis methods performing at least one of determining differences from a known good state, detecting indications of known attacker activity, detecting indications of malware being present, detecting heuristics associated with suspicious activity, detecting discrepancies in logical relationships among the reconstructed artifacts, and determining whether policies or standards have been violated; wherein the method is performed by at least one processing device. ### Claim 2 (depends on 1) The method of claim 1, wherein the plurality of analysis methods include one or more of scripts, database queries, byte sequence signatures, string matching, and comparison of registry key values. ### Claim 3 (depends on 1) The method of claim 1, further comprising: presenting indications of suspicious activity or indications of abnormal conditions to a user; and providing a facility for the user to bookmark and annotate artifacts. ### Claim 4 (depends on 1) The method of claim 1, further comprising: providing a user an ability to develop custom workflows. ### Claim 5 (depends on 1) The method of claim 1, further comprising: correlating information within the volatile memory with data stored in at least one other data source to determine an existence of at least one inconsistencies or anomalies. ### Claim 6 (depends on 1) The method of claim 1, further comprising: extracting, indexing, and/or correlating information regarding a state of the target processing device over at least one particular point in time; and providing a facility for archiving and tracking changes in the state of the target processing device over time. ### Claim 7 (depends on 1) The method of claim 1, further comprising: providing a facility to generate a sharable analytics catalog. ### Claim 8 (depends on 1) The method of claim 1, further comprising: providing a graphical user interface and a scriptable interface for formulating queries and performing other types of analysis. ### Claim 9 (depends on 1) The method of claim 1, further comprising: generating, managing, and/or sharing detection methods for detecting anomalous conditions using artifacts displayed with the graphical user interface. ### Claim 10 (depends on 9) The method of claim 9, further comprising: importing at least one other detection method for detecting the anomalous conditions using the artifacts displayed with the graphical user interface. ### Claim 11 (depends on 9) The method of claim 9, further comprising: collecting metrics regarding effectiveness of the detection algorithms; and sending the collected metrics to at least one other processing device for remote analytics. ### Claim 12 (depends on 1) The method of claim 1, further comprising: automatically evaluating capabilities of memory resident executables and associated file formats by analyzing imported libraries and exported methods for inconsistencies or anomalies. ### Claim 13 (depends on 1) The method of claim 1, further comprising: providing a facility to associate a response action with at least one analytic pattern. ### Claim 14 (depends on 13) The method of claim 13, wherein the response actions include at least one of querying new types of data, generating an alert, and/or halting a process. ### Claim 15 (depends on 1) The method of claim 1, further comprising: importing or generating whitelists of normal, known, or trusted, conditions; sharing the whitelists; and managing the whitelists. ### Claim 16 (depends on 1) The method of claim 1, further comprising: extracting metadata based on the extracted data; storing the metadata, the metadata describing a system state and including a subset of original runtime state information. ### Claim 17 (depends on 1) The method of claim 1, further comprising: reconstructing data stores based on data found in cached memory of the processing device. ### Claim 18 A method for aiding cyber intrusion investigations, the method comprising: communicating with at least one remote processing device via a secure web services application program interface, providing a graphical user interface for formulating queries and displaying artifacts related to anomalous conditions, providing storage for whitelists and detected anomalies, the whitelists comprising information related to normal known, or trusted, conditions, requesting and receiving information regarding artifacts and data structures found in a memory sample, and generating and presenting a visualization of the data structures and the artifacts, in the form of at least one of a table layout, a tree layout, a graph layout and/or a cross-view layout, to assess the condition of the target processing device.