# US 12,771,702 B2 · Identifying and eradicating the source of a malware attack > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,771,702 B2 - Document ID: US12771702B2 - Status: Granted - Kind: B2 - Application number: 18/174,364 - Filed: 2023-02-24 - Published: 2024-08-29 - Granted: 2026-10-20 - Earliest claimed: 2023-02-24 - Assignees: Rubrik, Inc. - Applicants: Rubrik, Inc. - Inventors: Rohit Agrawal; Mudit Malpani; Anshul Gupta; Gaurav Maheshwari; Siddharth Sharma; Tyler Vu - Web page: https://patentgrep.com/patent/US12771702B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and devices for data management are described. A system supporting malware detection may obtain event data such as risk scores corresponding to events associated with a set of computing entities. Using the event data, the system may construct a graph that includes nodes that represent the set of computing entities, and edges that represent the events, where the edges are between initiator and affected nodes and are associated with the respective event risk scores. Using the graph, respective node risk scores may be calculated for at least some nodes of the graph, and one or more anomalous nodes may be identified based on the one or more anomalous nodes having respective node risk scores that satisfy a threshold. The system may then output an indication of one or more computing entities corresponding to the one or more anomalous nodes. ## Claims ### Claim 1 A method, comprising: obtaining event data corresponding to events associated with a set of computing entities, wherein the events are initiated by respective initiator entities within the set of computing entities and affect one or more respective affected entities within the set of computing entities, and wherein the event data comprises respective event risk scores for at least some of the events; creating, based at least in part on the event data, a graph comprising nodes representative of the set of computing entities and edges representative of the events, wherein the edges are between nodes corresponding to the respective initiator entities and the one or more respective affected entities for the events, and wherein at least some of the edges are associated with the respective event risk scores; and determining respective node risk scores for at least some nodes of the graph, wherein a respective node risk score for a node is based at least in part on one or more event risk scores associated with one or more edges connected to the node, wherein determining the respective node risk scores for at least some nodes of the graph comprises: pruning one or more non-anomalous edges from the graph to obtain a pruned graph based at least in part on respective edge risk scores for the one or more non-anomalous edges failing to satisfy a risk threshold; identifying, using the pruned graph, one or more anomalous nodes present in the pruned graph based at least in part on the one or more anomalous nodes having respective node risk scores that satisfy the risk threshold; performing a forward tracking procedure by traversing at least a portion of the graph to determine respective node risk scores for one or more previously unscored nodes; determining, based at least in part on the forward tracking procedure, a group of computing entities of the set of computing entities affected by a malware attack that have latent malware, wherein the latent malware comprises malware that is inactive malware present on the group of computing entities; and outputting a first indication of one or more computing entities corresponding to the one or more anomalous nodes and a second indication of the group of computing entities affected by the latent malware. ### Claim 2 (depends on 1) The method of claim 1, wherein determining the respective node risk scores for at least some nodes of the graph comprises performing one or more iterations of a node-scoring procedure, wherein pruning of the one or more non-anomalous edges from the graph results at least in part from the one or more iterations of the node-scoring procedure, and wherein performing an iteration of the node-scoring procedure comprises: determining, for a set of edges of the graph, effective edge risk scores based at least in part on node risk scores for child nodes of the set of edges and the respective event risk scores associated with the set of edges; determining, based at least in part on the effective edge risk scores for the set of edges, whether the set of edges includes one or more anomalous edges; performing a pruning procedure to remove the one or more non-anomalous edges from among the set of edges; and determining, if the set of edges includes the one or more anomalous edges, one or more respective node risk scores for one or more parent nodes of the one or more anomalous edges based at least in part on the one or more event risk scores associated with the one or more anomalous edges. ### Claim 3 (depends on 2) The method of claim 2, wherein performing the one or more iterations of the node-scoring procedure comprises: performing a first iteration in which the child nodes of the set of edges comprise childless nodes within the graph; and performing one or more additional iterations until a root node of the graph is either pruned from the graph or has a respective node risk score determined. ### Claim 4 (depends on 2) The method of claim 2, wherein determining the respective node risk score for a parent node of at least one anomalous edge comprises: determining a respective risk factor for each anomalous edge connected to the parent node, the respective risk factor for an anomalous edge equal to one minus an event risk score associated with the anomalous edge; calculating a product quantity that is equal to a product of each determined respective risk factor; and determining the respective node risk score for the parent node as equal to one minus the product quantity. ### Claim 5 (depends on 2) The method of claim 2, wherein determining whether the set of edges comprises the one or more anomalous edges comprises: evaluating the set of edges using at least one anomaly detection algorithm. ### Claim 6 (depends on 5) The method of claim 5, wherein the at least one anomaly detection algorithm comprises an isolation forest algorithm, a decision tree algorithm, a machine-learning based algorithm, or any combination thereof. ### Claim 7 (depends on 1) The method of claim 1, further comprising: identifying, after the pruned graph is obtained via one or more iterations of a node-scoring procedure, a computing entity as an infection source of the malware attack based at least in part on the computing entity corresponding to a root node of the pruned graph. ### Claim 8 (depends on 1) The method of claim 1, wherein the group of computing entities affected by the malware attack corresponds to a blast radius of the malware attack. ### Claim 9 (depends on 1) The method of claim 1, wherein outputting the first indication of the one or more computing entities corresponding to the one or more anomalous nodes comprises: outputting an indication of one or more procedures for reducing risk associated with the one or more anomalous nodes. ### Claim 10 (depends on 9) The method of claim 9, wherein the one or more procedures comprise one or more malware eradication procedures comprising deletion of one or more affected files, replacement of one or more affected files, removal of one or more users associated with the set of computing entities, reset of one or more passwords associated with the set of computing entities, or any combination thereof. ### Claim 11 (depends on 1) The method of claim 1, wherein the respective event risk scores for the events indicate a presence of encrypted data or data that is at risk of being encrypted at a computing entity of the set of computing entities. ### Claim 12 (depends on 1) The method of claim 1, wherein the event data comprises one or more event data fields including an initiator entity field, an affected entity field, an event risk score field, an event type field, or any combination thereof. ### Claim 13 (depends on 1) The method of claim 1, wherein the graph comprises a directed acyclic graph and the edges of the graph comprise directed edges. ### Claim 14 An apparatus, comprising: one or more processors; one or more memories coupled with the one or more processors; and instructions stored in the one or more memories and executable by the one or more processors to cause the apparatus to: obtain event data corresponding to events associated with a set of computing entities, wherein the events are initiated by respective initiator entities within the set of computing entities and affect one or more respective affected entities within the set of computing entities, and wherein the event data comprises respective event risk scores for at least some of the events; create, based at least in part on the event data, a graph comprising nodes representative of the set of computing entities and edges representative of the events, wherein the edges are between nodes corresponding to the respective initiator entities and the one or more respective affected entities for the events, and wherein at least some of the edges are associated with the respective event risk scores; and determine respective node risk scores for at least some nodes of the graph, wherein a respective node risk score for a node is based at least in part on one or more event risk scores associated with one or more edges connected to the node, wherein, to determine the respective node risk scores for at least some nodes of the graph, the instructions are executable by the one or more processors to cause the apparatus to: prune one or more non-anomalous edges from the graph to obtain a pruned graph based at least in part on respective edge risk scores for the one or more non-anomalous edges failing to satisfy a risk threshold; identify, using the pruned graph, one or more anomalous nodes present in the pruned graph based at least in part on the one or more anomalous nodes having respective node risk scores that satisfy the risk threshold; perform a forward tracking procedure by traversing at least a portion of the graph to determine respective node risk scores for one or more previously unscored nodes; determine, based at least in part on the forward tracking procedure, a group of computing entities of the set of computing entities affected by a malware attack that have latent malware, wherein the latent malware comprises malware that is inactive malware present on the group of computing entities; and output a first indication of one or more computing entities corresponding to the one or more anomalous nodes and a second indication of the group of computing entities affected by the latent malware. ### Claim 15 (depends on 14) The apparatus of claim 14, wherein: to determine the respective node risk scores for at least some nodes of the graph, the instructions are executable by the one or more processors to cause the apparatus to perform one or more iterations of a node-scoring procedure, wherein pruning of the one or more non-anomalous edges from the graph results at least in part from the one or more iterations of the node-scoring procedure; and to perform an iteration of the node-scoring procedure, the instructions are executable by the one or more processors to cause the apparatus to: determine, for a set of edges of the graph, effective edge risk scores based at least in part on node risk scores for child nodes of the set of edges and the respective event risk scores associated with the set of edges; determine, based at least in part on the effective edge risk scores for the set of edges, whether the set of edges includes one or more anomalous edges; perform a pruning procedure to remove the one or more non-anomalous edges from among the set of edges; and determine, if the set of edges includes the one or more anomalous edges, one or more respective node risk scores for one or more parent nodes of the one or more anomalous edges based at least in part on the one or more event risk scores associated with the one or more anomalous edges. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein, to perform the one or more iterations of the node-scoring procedure, the instructions are executable by the one or more processors to cause the apparatus to: perform a first iteration in which the child nodes of the set of edges comprise childless nodes within the graph; and perform one or more additional iterations until a root node of the graph is either pruned from the graph or has a respective node risk score determined. ### Claim 17 (depends on 15) The apparatus of claim 15, wherein, to determine whether the set of edges comprises the one or more anomalous edges, the instructions are executable by the one or more processors to cause the apparatus to: evaluate the set of edges using at least one anomaly detection algorithm. ### Claim 18 (depends on 14) The apparatus of claim 14, wherein the instructions are further executable by the one or more processors to cause the apparatus to: identify, after the pruned graph is obtained via one or more iterations of a node-scoring procedure, a computing entity as an infection source of the malware attack based at least in part on the computing entity corresponding to a root node of the pruned graph. ### Claim 19 A non-transitory computer-readable medium storing code, the code comprising instructions executable by one or more processors to: obtain event data corresponding to events associated with a set of computing entities, wherein the events are initiated by respective initiator entities within the set of computing entities and affect one or more respective affected entities within the set of computing entities, and wherein the event data comprises respective event risk scores for at least some of the events; create, based at least in part on the event data, a graph comprising nodes representative of the set of computing entities and edges representative of the events, wherein the edges are between nodes corresponding to the respective initiator entities and the one or more respective affected entities for the events, and wherein at least some of the edges are associated with the respective event risk scores; and determine respective node risk scores for at least some nodes of the graph, wherein a respective node risk score for a node is based at least in part on one or more event risk scores associated with one or more edges connected to the node, wherein, to determine the respective node risk scores for at least some nodes of the graph, the instructions are executable by one or more processors to: prune one or more non-anomalous edges from the graph to obtain a pruned graph based at least in part on respective edge risk scores for the one or more non-anomalous edges failing to satisfy a risk threshold; identify, using the pruned graph, one or more anomalous nodes present in the pruned graph based at least in part on the one or more anomalous nodes having respective node risk scores that satisfy the risk threshold; perform a forward tracking procedure by traversing at least a portion of the graph to determine respective node risk scores for one or more previously unscored nodes; determine, based at least in part on the forward tracking procedure, a group of computing entities of the set of computing entities affected by a malware attack that have latent malware, wherein the latent malware comprises malware that is inactive malware present on the group of computing entities; and output a first indication of one or more computing entities corresponding to the one or more anomalous nodes and a second indication of the group of computing entities affected by the latent malware.