Windows registry injection detection
AssigneeDell Products L.P.
InventorsGerald M. Jourdain, Ravindra Lingampeth
Life of this patent
Estimating the term…
Abstract
One example method includes creating a backup of registry files of a system registry, extracting the registry files from the system registry, interrogating the extracted registry files to determine if malware is present in the registry files, comparing the backup with another backup of the registry files to determine if malware is present in the backup, and when malware is determined, by the interrogating and/or the comparing, to be indicated, performing a remedial action to attenuate an impact of the malware.
Claims18
A method, comprising:
- storing registry files of an operating system;
- creating, at a first time, a first backup of the registry files;
- creating, at a second time that is different than the first time, a second backup of the registry files;
- causing the registry files to be stored in a non-native format, which includes an enumerated, normalized format comprising an enumeration of registry key-value pairs extracted from the registry files, wherein the enumerated, normalized format enables comparison of registry keys across multiple backups, including the first backup and the second backup;
- interrogating the extracted, non-natively formatted registry files by analyzing the enumeration of the registry key-value pairs to determine if malware is present in the registry files, wherein said interrogating constitutes a first malware detection process, and wherein the interrogating comprises looking for known ransomware key-value pairs;
- comparing the first backup of the registry files with the second backup of the registry files to determine if malware is present in at least one of the first backup or the second backup, wherein said comparing constitutes a second malware detection process;
- and
- when malware is detected by either or both of the first malware detection process or the second malware detection process, performing a remedial action to attenuate an impact of the malware.
A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
- storing registry files of an operating system;
- creating, at a first time, a first backup of the registry files;
- creating, at a second time that is different than the first time, a second backup of the registry files;
- causing the registry files to be stored in a non-native format, which includes an enumerated, normalized format comprising an enumeration of registry key-value pairs extracted from the registry files, wherein the enumerated, normalized format enables comparison of registry keys across multiple backups, including the first backup and the second backup;
- interrogating the extracted, non-natively formatted registry files by analyzing the enumeration of the registry key-value pairs to determine if malware is present in the registry files, wherein said interrogating constitutes a first malware detection process, and wherein the interrogating comprises looking for known ransomware key-value pairs;
- comparing the first backup of the registry files with the second backup of the registry files to determine if malware is present in at least one of the first backup or the second backup, wherein said comparing constitutes a second malware detection process;
- and
- when malware is detected by either or both of the first malware detection process or the second malware detection process, performing a remedial action to attenuate an impact of the malware.
Dependencies are inferred from the claim text.