# US 2017/0286684 A1 · Method for Identifying and Removing Malicious Software

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0286684 A1
- Document ID: US20170286684A1
- Status: Published application
- Kind: A1
- Application number: 15/625,772
- Filed: 2017-06-16
- Published: 2017-10-05
- Earliest claimed: 2014-05-30
- Assignees: Beestripe LLC
- Applicants: BeeStripe LLC
- Inventors: Aaron Ford Lovelace; Ciaran Seoirse Thompson; Steven Michael Markowitz
- Web page: https://patentgrep.com/patent/US20170286684A1

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- G06F 21/6263: {during internet communication, e.g. revealing personal data from cookies}
- G06F 2221/033: Test or assess software
- G06Q 30/0255: {based on user history}
- G06Q 30/0269: {based on user profile or attribute}
- G06Q 30/0277: {Online advertisement}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR

## Abstract

A method for identifying and removing malicious code uses a personal computing device that can communicate with a remote server. The remote server manages a blacklist and a whitelist. The blacklist is a list of programs that are known to contain malicious code. The whitelist is a list of programs that are known to be free of malicious code. The method begins when a scan request is received. The scan request is a command that directs the personal computing device to work with the remote server to perform a scan of a collection of files that will identify malicious code. The method then performs a sandboxed-evaluation process to identify files that are found to contain malicious code. The sandboxed-evaluation process is an isolated testing routine that runs program files to detect malicious code. Finally, the method executes a threat remediation process if malicious code is found.

## Claims

### Claim 1

A method for identifying and removing malicious software comprises:
(A) providing a personal computing (PC) device communicably coupled to at least one remote server, wherein the PC device contains a plurality of personal files, and wherein each of the plurality of personal files is associated with a corresponding program identifier (PID);
(B) providing a blacklist and a whitelist that are managed by the remote server;
(C) receiving a scan request for at least one specific file with the PC device, wherein the specific file is from the plurality of personal files;
(D) executing a sandboxed-evaluation process for the specific file with the remote server in order to append the corresponding PID of the specific file to either the blacklist or the whitelist, if the corresponding PID for the specific file is not on either the blacklist or the whitelist; and
(E) executing a threat remediation process for the specific file with the remote server, if the corresponding PID for the specific file is on the blacklist.

### Claim 2 (depends on 1)

The method for identifying and removing malicious software as claimed in claim 1 comprises:
prompting to select at least one desired file from the plurality of personal files with the PC device; and
designating the at least one desired file as the at least one specific file with the PC device before step (C).

### Claim 3 (depends on 1)

The method for identifying and removing malicious software as claimed in claim 1 comprises:
downloading a new file onto the PC device;
appending the new file into the plurality of personal files with the PC device; and
designating the new file as the at least one specific file with the PC device before step (C).

### Claim 4 (depends on 1)

The method for identifying and removing malicious software as claimed in claim 1 comprises:
prompting to select a time interval for the plurality of personal files with the PC device;
designating all of the plurality of personal files as the at least one specific file with the PC device before step (C); and
periodically executing steps (C) through (E) at the time interval.

### Claim 5 (depends on 1)

The method for identifying and removing malicious software as claimed in claim 1 comprises:
(F) wherein the corresponding PID of the specific file is not on either the blacklist or the whitelist;
(G) generating a sandboxed virtual machine with the remote server;
(H) installing a virtual copy of the specific file on to the sandboxed virtual machine with the remote server;
(I) performing a malicious-code scan on the virtual copy of the specific file with the remote server in order to detect malicious code on the virtual copy of the specific file;
(J) appending the correspond PID of the specific file onto the blacklist with the remote server, if the malicious-code scan does detect malicious code on the virtual copy of the specific file; and
(K) appending the correspond PID of the specific file onto the whitelist with the remote server, if the malicious-code scan does not detect malicious code on the virtual copy of the specific file during step (D).

### Claim 6 (depends on 1)

The method for identifying and removing malicious software as claimed in claim 1 comprises:
(L) providing a plurality of remediation commands for the threat-remediation process, wherein the plurality of remediation commands is stored on the remote server;
(M) prompting to select a desired command for the specific file with the PC device, wherein the desired command is one of the plurality of remediation commands; and
(N) executing the desired command for the specific file with the PC device during step (E).

### Claim 7 (depends on 6)

The method for identifying and removing malicious software as claimed in claim 6 comprises:
providing the desired command is a delete command; and
uninstalling the specific file off the PC device during step (N).

### Claim 8 (depends on 6)

The method for identifying and removing malicious software as claimed in claim 6 comprises:
providing the desired command is a quarantine command; and
disabling the specific file on the PC device during step (N).

### Claim 9 (depends on 1)

The method for identifying and removing malicious software as claimed in claim 1 comprises:
providing a plurality of advertisements stored on the remote server;
retrieving at least one contextual identifier for each of the plurality of personal files with the remote server;
compiling the at least one contextual identifier for each of the plurality of personal files into a user summarization profile with the remote server;
comparing the user summarization profile to each of the plurality of advertisements in order to identify at least one matching advertisement from the plurality of advertisements; and
displaying the at least one matching advertisement with the PC device after step (E).