Back to results
US 2021/0012005 A1Published application
Tracking malicious software movement with an event graph
AssigneeSophos Limited
InventorsBeata Ladnai, Mark David Harris, Andrew J. Thomas, Andrew G. P. Smith, Russell Humphries
Life of this patent
Estimating the term…
Abstract
A multi-endpoint event graph is used to detect malware based on malicious software moving through a network.
Claims20
A computer program product for malware detection comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
- instrumenting a first endpoint and a second endpoint to monitor a number of causal relationships among a number of computing objects at a plurality of logical locations within a computing environment;
- selecting a set of logical locations for monitoring from the plurality of logical locations, the set of logical locations including a first logical location at the first endpoint and a second logical location at the second endpoint;
- recording a sequence of events causally relating the number of computing objects at the set of logical locations, wherein the sequence of events spans multiple devices including at least the first endpoint and the second endpoint;
- creating an event graph spanning multiple devices based on the sequence of events;
- applying a malware detection rule for tracking malicious software movement through a network to the event graph;
- evaluating a security state of the first endpoint based on the event graph and the malware detection rule;
- and
- initiating remediation of the first endpoint in response to a change in the security state indicating a presence of malware on the first endpoint.
5 more elements
A method for malware detection comprising:
- instrumenting a first endpoint and a second endpoint to monitor a number of causal relationships among a number of computing objects at a plurality of logical locations within a computing environment;
- selecting a set of logical locations for monitoring from the plurality of logical locations, the set of logical locations including a first logical location at the first endpoint and a second logical location at the second endpoint;
- recording a sequence of events causally relating the number of computing objects at the set of logical locations, wherein the sequence of events spans multiple devices including at least the first endpoint and the second endpoint;
- creating an event graph spanning at least the first endpoint and the second endpoint based on the sequence of events;
- evaluating a security state of the first endpoint based on the event graph;
- and
- responding to a change in the security state.
4 more elements
A system comprising:
- a first endpoint having a first network interface, a first memory, and a first processor;
- a second endpoint having a second network interface, a second memory, and a second processor;
- and
- computer executable code stored in the first memory and the second memory that configures the first processor and the second processor to perform the steps of instrumenting the first endpoint and the second endpoint to monitor a number of causal relationships among a number of computing objects at a plurality of logical locations within a computing environment, selecting a set of logical locations for monitoring from the plurality of logical locations, the set of logical locations including a first logical location at the first endpoint and a second logical location at the second endpoint, recording a sequence of events causally relating the number of computing objects at the set of logical locations, wherein the sequence of events spans multiple devices including at least the first endpoint and the second endpoint, creating an event graph spanning multiple devices based on the sequence of events, evaluating a security state of the first endpoint based on the event graph, and responding to a change in the security state.
1 more element
Dependencies are inferred from the claim text.