Dynamically updating rules for detecting compromised devices
AssigneeVMware, Inc.
InventorsSimon Brooks, Daniel E. Zeck, Xinpi Du, Ali Mohsin, Kishore Sajja, Nikhil Mehta
Life of this patent
Estimating the term…
Abstract
Examples for detecting a compromised device are described. A set of threat detection rules can instruct an application on the client device how to detect whether the client device is compromised. The rules can be updated dynamically and without updating the application that is performing the compromise detection. The rules can be encoded in an interpreted scripting language and executed by a runtime environment that is embedded within the application.
Claims20
A system for detecting a compromised device, comprising:
- a client device comprising at least one hardware processor;
- and
- program instructions executable in the client device that, when executed, direct the client device to:
- detect a launch condition associated with a threat detection runtime environment, the program instructions being embedded within the application;
- retrieve one or more rules from a remotely executed service, the rules specifying how to determine that the client device has been compromised;
- execute the threat detection runtime environment within the application;
- register an event handler within the threat detection runtime environment based upon the rules, the event handler configured to detect a condition specified by the rules indicating a compromised state;
- and
- detect, using the event handler, the condition.
A non-transitory computer-readable medium for detecting a compromised device embodying program instructions executable in a client device that, when executed by the client device, direct the client device to:
- detect a launch condition associated with a threat detection runtime environment, the program instructions being embedded within the application, the program instructions being embedded within the application;
- retrieve one or more rules from a remotely executed service, the rules specifying how to determine that the client device has been compromised;
- execute the threat detection runtime environment within the application;
- register an event handler within the threat detection runtime environment based upon the rules, the event handler configured to detect a condition specified by the rules indicating a compromised state;
- and
- detect, using the event handler, the condition.
A method for detecting a compromised client device, comprising:
- detecting a launch condition associated with a threat detection runtime environment, the program instructions being embedded within the application;
- retrieving one or more rules from a remotely executed service, the rules specifying how to determine that the client device has been compromised;
- executing the threat detection runtime environment within the application;
- registering an event handler within the threat detection runtime environment based upon the rules, the event handler configured to detect a condition specified by the rules indicating a compromised state;
- and
- detecting, using the event handler, the condition.
Dependencies are inferred from the claim text.