Back to results
US 2020/0004964 A1Published application
Systems and methods for detecting malicious activity in a computer system
AssigneeAO Kaspersky Lab
InventorsIGOR I. SOUMENKOV, SERGEY Y. GOLOVANOV
Life of this patent
Estimating the term…
Abstract
Systems and methods for detecting malicious activity in a computer system. One or more graphs can be generated based on information objects about the computer system and relationships between the information objects, where the information objects are vertices in the graphs and the relationships are edges in the graphs. Comparison of generated graphs to existing graphs can determine a likelihood of malicious activity.
Claims20
A system for detecting malicious activity in a computer system, the system comprising:
- a computing platform including computing hardware of at least one processor and memory operably coupled to the at least one processor;
- and
- instructions that, when executed on the computing platform, cause the computing platform to implement:
- a gathering tool configured to—
- collect a plurality of information objects about the computer system, and
- determine a plurality of relationships between the plurality of information objects,
- a graph-building tool configured to—
- build at least a first intermediate graph and a second intermediate graph based on the plurality of information objects and the plurality of relationships, wherein the first and second intermediate graphs are formed with the plurality of information objects as vertices and the plurality of relationships as edges, and
- build a final graph based on the at least first and second intermediate graphs, wherein the final graph includes at least one vertex from the first intermediate graph and at least one vertex from the second intermediate graph and at least one edge connecting the at least one vertex from the first intermediate graph and at least one vertex from the second intermediate graph,
- a search tool configured to—
- select, from a graphs database, at least one preexisting graph similar to the final graph based on a degree of similarity threshold, the at least one preexisting graph assigned a malicious activity ratio,
- an analysis tool configured to determine malicious activity based on the at least one preexisting graph.
9 more elements
A method for detecting malicious activity in a computer system, the method comprising:
- collecting a plurality of information objects about the computer system;
- determining a plurality of relationships between the plurality of information objects;
- building at least a first intermediate graph and a second intermediate graph based on the plurality of information objects and the plurality of relationships, wherein the first and second intermediate graphs are formed with the plurality of information objects as vertices and the plurality of relationships as edges;
- building a final graph based on the at least first and second intermediate graphs, wherein the final graph includes at least one vertex from the first intermediate graph and at least one vertex from the second intermediate graph and at least one edge connecting the at least one vertex from the first intermediate graph and at least one vertex from the second intermediate graph;
- selecting, from a graphs database, at least one preexisting graph similar to the final graph based on a degree of similarity threshold, the at least one preexisting graph assigned a malicious activity ratio;
- and
- determining malicious activity based on the at least one preexisting graph.
4 more elements
A system for determining a characteristic of a computer system, the system comprising:
- a computing platform including computing hardware of at least one processor and memory operably coupled to the at least one processor;
- and
- instructions that, when executed on the computing platform, cause the computing platform to implement:
- a graph-building tool configured to—
- receive a plurality of information objects about the computer system and a plurality of relationships between the plurality of information objects,
- build a first graph including at least two of the plurality of information objects as vertices and at least one of the plurality of relationships as edges, build a second graph including the at least two of the plurality of information objects,
- build a unified graph based on the first graph and the second graph, wherein the unified graph includes all identical information objects shared between the first graph and the second graph, and
- an analysis tool configured to—
- determine a characteristic of the computer system based on the unified graph.
6 more elements
Dependencies are inferred from the claim text.