Back to results
US 12,602,477 B2Granted
Detecting targeted intrusion on mobile devices
AssigneeCrowdStrike, Inc.
InventorsConnor Brant, David Williams
Life of this patent
Estimating the term…
Abstract
Techniques to determining a program installed on a computing device may be indicative of performing a targeted intrusion of the computing device is described. A log file associated with the computing device may be generated. Various indicators from the log file may be determined. A security program may determine that the program may be indicative of performing the targeted intrusion based on at least one of the indicators. The security program may determine an action to take based on the indication of performing the targeted intrusion.
Claims20
A system comprising:
- one or more processors;
- and
- one or more non-transitory computer-readable media storing computer-executable instructions that, when executed, cause the one or more processors to perform operations comprising:
- sending, to a system component associated with an operating system and from an application component, first data representing a request to generate a log file indicative of a current state of the system, wherein the first data causes the system component to generate the log file;
- sending, to the system component and from the application component, second data representing a request to access the log file generated by the system component;
- accessing, at the application component, and based at least in part on the second data, the log file generated by the system component;
- determining, at the application component, a first name associated with a program associated with the log file based on the log file and a system image indicative of an initial state of the system including a second name of a process associated with the system image;
- determining, at the application component and based on a Levenshtein distance between the first name and the second name, that the program is indicative of a targeted intrusion of the system;
- and
- generating, based at least in part on the log file indicating that the program is indicative of the targeted intrusion of the system, a notification that the system is indicative of targeted intrusion.
7 more elements
A method comprising:
- receiving, from a first computing device, a log file generated by an operating system associated with the first computing device, wherein the log file comprises a record of programs installed at the first computing device;
- receiving, from a second computing device, a system image;
- determining, based at least in part on the system image, a system image identifier;
- determining, based at least in part on the log file, a program identifier associated with a program associated with the record of programs;
- determining, based at least in part on the system image identifier and the program identifier, that the program is indicative of a targeted intrusion of the operating system by determining a Levenshtein distance between a first name of the program and a second name of the process associated with the system image;
- and
- performing, based at least in part on the program being indicative with the targeted intrusion of the operating system, an action to mitigate an execution of the program.
4 more elements
One or more non-transitory computer-readable media comprising instructions that when executed by one or more processors cause the one or more processors to perform operations comprising:
- receiving, from a first computing device, a log file generated by an operating system associated with the first computing device, wherein the log file comprises a record of programs installed at the first computing device;
- receiving, from a second computing device, a system image;
- determining, based at least in part on the system image, a system image identifier;
- determining, based at least in part on the log file, a program identifier associated with a program associated with the record of programs;
- determining, based at least in part on the system image identifier and the program identifier, that the program is indicative of a targeted intrusion of the operating system by:
- determining a Levenshtein distance between a first name of the program and a second name of a process associated with the system image, and
- determining that the Levenshtein distance is less than or equal to a threshold Levenshtein distance;
- and
- performing, based at least in part on the program being indicative with the targeted intrusion of the operating system, an action to mitigate an execution of the program.
6 more elements
Dependencies are inferred from the claim text.