# US 12,762,237 B2 · Integration of inline malware discovery and offline vault ransomware prediction > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,762,237 B2 - Document ID: US12762237B2 - Status: Granted - Kind: B2 - Application number: 18/295,336 - Filed: 2023-04-04 - Published: 2024-10-10 - Granted: 2026-10-13 - Earliest claimed: 2023-04-04 - Assignees: Dell Products L.P. - Applicants: Dell Products L.P. - Inventors: Ofir Ezrielev; Yehiel Zohar; Yevgeni Gehtman; Tomer Shachar; Maxim Balin - Web page: https://patentgrep.com/patent/US12762237B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/554: {involving event detection and direct action} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract One example method includes, by a first malware detection process, checking an aspect of a production system for evidence of a malware process, identifying the aspects as possibly affected by the malware process, generating cues that identify the aspect, and transmitting the cues to a second malware detection process. The second malware detection process checks the cues to identify the aspect, and determines that the malware process has affected the aspect. The first malware detection process may be an inline process, and the second malware detection process may be an offline process. ## Claims ### Claim 1 A method, comprising: by a first malware detection process that is performed, at a datacenter, inline with a production data backup process as production data is being backed up from the datacenter to a vault: in a production system that performs the data backup process, checking the production data, as the production data is being backed up to the vault, for evidence of a malware process; identifying the production system as possibly affected by the malware process by identifying production data that has interacted with a process suspected to be the malware process; and generating one or more cues comprising metadata associated with the production data that has interacted with the suspected malware process, the one or more cues being generated in real time as the production data is being backed up, and the one or more cues prioritizing particular data, of the production data that is being backed up, for inspection; transmitting the cues to the vault during the backup process; and by a second malware detection process that is performed at the vault, offline from the first malware detection process: checking the cues to identify the particular data prioritized for inspection; and performing an offline inspection of the particular data identified by the cues, to the exclusion of uncued data during an inspection cycle, the offline inspection being deeper than the checking performed by the first malware detection process, and determining, based on the offline inspection, that the malware process has affected the production system. ### Claim 2 (depends on 1) The method as recited in claim 1, wherein identifying the production system as possibly affected by the malware process comprises identifying production data that has interacted with a process suspected to be the malware process. ### Claim 3 (depends on 1) The method as recited in claim 1, wherein the cues are transmitted by the first malware detection process to the second malware detection process. ### Claim 4 (depends on 1) The method as recited in claim 1, wherein the malware process comprises a ransomware process. ### Claim 5 (depends on 1) The method as recited in claim 1, wherein the second malware detection process does not check production data other than the particular data identified by the cues. ### Claim 6 (depends on 1) The method as recited in claim 1, wherein the particular data comprises a subset of all data residing in the vault where the second malware detection process runs. ### Claim 7 A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising: by a first malware detection process that is performed, at a datacenter, inline with a production data backup process as production data is being backed up from the datacenter to a vault: in a production system that performs the data backup process, checking the production data, as the production data is being backed up to the vault, for evidence of a malware process; identifying the production system as possibly affected by the malware process by identifying production data that has interacted with a process suspected to be the malware process; and generating one or more cues comprising metadata associated with the production data that has interacted with the suspected malware process, the one or more cues being generated in real time as the production data is being backed up, and the one or more cues prioritizing particular data, of the production data that is being backed up, for inspection; transmitting the cues to the vault during the backup process; and by a second malware detection process that is performed at the vault, offline from the first malware detection process: checking the cues to identify the particular data prioritized for inspection; and performing an offline inspection of the particular data identified by the cues, to the exclusion of uncued data during an inspection cycle, the offline inspection being deeper than the checking performed by the first malware detection process, and determining, based on the offline inspection, that the malware process has affected the production system. ### Claim 8 (depends on 7) The non-transitory storage medium as recited in claim 7, wherein identifying the production system as possibly affected by the malware process comprises identifying production data that has interacted with a process suspected to be the malware process. ### Claim 9 (depends on 7) The non-transitory storage medium as recited in claim 7, wherein the cues are transmitted by the first malware detection process to the second malware detection process. ### Claim 10 (depends on 7) The non-transitory storage medium as recited in claim 7, wherein the malware process comprises a ransomware process. ### Claim 11 (depends on 7) The non-transitory storage medium as recited in claim 7, wherein the second malware detection process does not check production data other than the particular data identified by the cues. ### Claim 12 (depends on 7) The non-transitory storage medium as recited in claim 7, wherein the particular data comprises a subset of all data residing in the vault where the second malware detection process runs.