Malicious process tracking
AssigneeDiDi Research America, LLC
InventorYinhong CHANG
Life of this patent
Estimating the term…
Abstract
Malicious processes may be tracked by obtaining process history information of a computing device and obtaining an identification of a malicious software on the computing device. An associated process of the malicious software and actions of the associated process may be identified based on the process history information. Related processes of the associated process and actions of the related processes may be iteratively identified based on the process history information. Tracking information for the malicious software may be generated based on the associated process, the actions of the associated process, the related processes, and the actions of the related processes.
Claims20
A system for tracking malicious processes, the system comprising:
- one or more processors;
- and
- a memory storing instructions that, when executed by the one or more processors, cause the system to perform:
- obtaining process history information of a computing device;
- obtaining an identification of a malicious software on the computing device;
- identifying an associated process of the malicious software based on the process history information and the identification of the malicious software on the computing device;
- identifying actions of the associated process based on the process history information;
- iteratively identifying related processes of the associated process and actions of the related processes based on the process history information;
- and
- generating tracking information for the malicious software based on the associated process, the actions of the associated process, the related processes, and the actions of the related processes.
A method for tracking malicious processes, the method implemented by a computing system including one or more processors and non-transitory storage media storing machine-readable instructions, the method comprising:
- obtaining process history information of a computing device;
- obtaining an identification of a malicious software on the computing device;
- identifying an associated process of the malicious software based on the process history information and the identification of the malicious software on the computing device;
- identifying actions of the associated process based on the process history information;
- iteratively identifying related processes of the associated process and actions of the related processes based on the process history information;
- and
- generating tracking information for the malicious software based on the associated process, the actions of the associated process, the related processes, and the actions of the related processes.
A non-transitory computer readable medium for tracking malicious processes, the non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform:
- obtaining process history information of a computing device;
- obtaining an identification of a malicious software on the computing device;
- identifying an associated process of the malicious software based on the process history information and the identification of the malicious software on the computing device;
- identifying actions of the associated process based on the process history information;
- iteratively identifying related processes of the associated process and actions of the related processes based on the process history information;
- and
- generating tracking information for the malicious software based on the associated process, the actions of the associated process, the related processes, and the actions of the related processes.
Dependencies are inferred from the claim text.