US 2020/0089875 A1 · OBSERVATION AND CLASSIFICATION OF DEVICE EVENTS

Abstract

Systems and methods observe and classify device events. A model containing a set of features to be observed can be determined based on machine learning and training methods. A client application can issue a transaction request to an operating system service. A determination can be made whether the operating system service, a method associated with the transaction request, and the client application are currently being observed. In response to determining that the operating system service, a method associated with the transaction request, and the client application are being observed, a behavioral vector associated with the client application can be modified to indicate that the feature represented by the method is associated with the client application. The behavioral vector can be used to determine if the client application is malware.

Claims20

Dependent claims

A method for observing device events, the method comprising:

receiving a transaction request from a client application for an operating system service;
determining whether the operating system service, a method associated with the transaction request, and the client application are being observed;
in response to determining that the operating system service, the method associated with the transaction request, and the client application are being observed, modifying a behavioral vector associated with the client application and processing the transaction request;
and
in response to determining that at least one of the operating system service, the method associated with the transaction request, and the client application are not being observed, processing the transaction request without modifying the behavioral vector associated with the client application.

2 more elements

A non-transitory machine-readable storage medium having stored thereon computer-executable instructions for observing device events, the computer-executable instructions to cause one or more processors to perform operations comprising:

receive a transaction request from a client application for an operating system service;
determine whether the operating system service, a method associated with the transaction request, and the client application are being observed;
in response to a determination that the operating system service, the method associated with the transaction request, and the client application are being observed, modify a behavioral vector associated with the client application and process the transaction request;
and
in response to a determination that at least one of the operating system service, the method associated with the transaction request, and the client application are not being observed, process the transaction request without modification of the behavioral vector associated with the client application.

2 more elements

A system for observing device events, the system comprising:

one or more processors;
and
a non-transitory machine-readable medium having stored thereon computer-executable instructions to cause the one or more processors to:
receive a transaction request from a client application for an operating system service,
determine whether the operating system service, a method associated with the transaction request, and the client application are being observed,
in response to a determination that the operating system service, the method associated with the transaction request, and the client application are being observed, modify a behavioral vector associated with the client application and process the transaction request, and
in response to a determination that at least one of the operating system service, the method associated with the transaction request, and the client application are not being observed, process the transaction request without modification of the behavioral vector associated with the client application.

4 more elements

Dependencies are inferred from the claim text.

Observation and classification of device events

Life of this patent

Observation and classification of device events

Life of this patent

Abstract

Claims20