US 2015/0101010 A1 · MALICIOUS CODE INFECTION CAUSE-AND-EFFECT ANALYSIS

Abstract

A malware analysis system for automating cause and effect analysis of malware infections is provided. The malware analysis system monitors and records computer system activities. Upon being informed of a suspected malware infection, the malware analysis system creates a time-bounded snapshot of the monitored activities that were conducted within a time frame prior to the notification of the suspected malware infection. The malware analysis system may also create a time-bounded snapshot of the monitored activities that are conducted within a time frame subsequent to the notification of the suspected malware infection. The malware analysis system provides the created snapshot or snapshots for further analysis.

Claims20

Dependent claims

A method performed by a computing device for analyzing a malware infection, the method comprising:

receiving post-infection snapshots from a plurality of machines suspected of being infected with malware, the post-infection snapshots identifying monitored activities of machines suspected of being infected with malware subsequent to the machines being suspected of being infected with malware;
and
comparing the monitored activities of the post-infection snapshots to identify monitored activities that are common across multiple post-infection snapshots and that may be caused by the malware.

Dependencies are inferred from the claim text.

Malicious code infection cause-and-effect analysis

Life of this patent

Malicious code infection cause-and-effect analysis

Life of this patent

Abstract

Claims20