# US 2021/0344686 A1 · System and method for strategic anti-malware monitoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344686 A1 - Document ID: US20210344686A1 - Status: Published application - Kind: A1 - Application number: 17/367,126 - Filed: 2021-07-02 - Published: 2021-11-04 - Earliest claimed: 2012-07-05 - Assignees: Tenable, Inc. - Applicants: Tenable, Inc. - Inventors: Marcus J. RANUM; Ron GULA - Web page: https://patentgrep.com/patent/US20210344686A1 ## CPC - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 16/903: Querying (for retrieval from the web G06F16/953) - G06F 21/564: {by virus signature recognition} - H04L 61/4511: using domain name system [DNS] - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1433: {Vulnerability analysis} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The system and method described herein may leverage active network scanning and passive network monitoring to provide strategic anti-malware monitoring in a network. In particular, the system and method described herein may remotely connect to managed hosts in a network to compute hashes or other signatures associated with processes running thereon and suspicious files hosted thereon, wherein the hashes may communicated to a cloud database that aggregates all known virus or malware signatures that various anti-virus vendors have catalogued to detect malware infections without requiring the hosts to have a local or resident anti-virus agent. Furthermore, running processes and file system activity may be monitored in the network to further detect malware infections. Additionally, the network scanning and network monitoring may be used to detect hosts that may potentially be participating in an active botnet or hosting botnet content and audit anti-virus strategies deployed in the network ## Claims ### Claim 1 A method for remote scanning, comprising: receiving, via a credentialed scan of a scanning target located in a network or from a local agent executing on the scanning target, information describing a set of current connections on the scanning target; detecting that a current connection among the set of current connections is associated with a compromised host having a known malicious Internet Protocol (IP) address; performing one or more actions to facilitate isolation of the network from malicious traffic attributable to the compromised host. ### Claim 2 (depends on 1) The method of claim 1, wherein the known malicious IP address corresponds to a known botnet IP address. ### Claim 3 (depends on 1) The method of claim 1, wherein the one or more actions comprise: generation of a report that identifies the compromised host as being associated with the known malicious IP address, or disablement of network connectivity for at least the compromised host to isolate the network from malicious traffic, or a combination thereof. ### Claim 4 (depends on 1) The method of claim 1, wherein the detecting includes: identification of one or more IP addresses associated with each of the set of current connections on the scanning targets; comparison of the one or more identified IP addresses to a list that includes one or more known malicious IP addresses. ### Claim 5 (depends on 4) The method of claim 4, wherein the one or more identified IP addresses comprise a source IP address and a destination IP address associated with each of the set of current connections on the scanning target, wherein the source IP address and the destination IP address are compared to the list. ### Claim 6 (depends on 1) The method of claim 1, wherein the known malicious IP address is previously identified as associated with a respective host with one or more virus infections, one or more malware infections, one or more backdoor installations, one or more exploitable default accounts, one or more adware installations, one or more software installations known to be vulnerable to infection, one or more peer-to-peer (P2P) software installations, or a combination thereof. ### Claim 7 A method for remote scanning, comprising: receiving, via a credentialed scan of a scanning target located in a network, information describing an object on the scanning target; determining that the scanning target includes an infection or a vulnerability based at least in part upon the information describing the object on the scanning target; performing one or more actions to facilitate remediation of the infection or the vulnerability based on the determination. ### Claim 8 (depends on 7) The method of claim 7, wherein the one or more actions comprise: generation of a report that identifies the scanning target as infected or vulnerable to infection, or disabling network connectivity for at least the scanning target to isolate the network from malicious traffic, or a combination thereof. ### Claim 9 (depends on 7) The method of claim 7, wherein the object comprises a running process. ### Claim 10 (depends on 7) The method of claim 7, wherein the object comprises a configuration. ### Claim 11 (depends on 10) The method of claim 10, wherein the configuration comprises an operating system running on the scanning target, whether one or more passwords for one or more users associated with the scanning target complies with one or more policies, whether the scanning target stores a particular type of data, or a combination thereof. ### Claim 12 (depends on 7) The method of claim 7, wherein the object comprises a file. ### Claim 13 (depends on 12) The method of claim 12, wherein the information comprises a signature of the file, a hash of the file, a checksum associated with the file, or a combination thereof. ### Claim 14 (depends on 13) The method of claim 13, wherein the information comprises a message digest 5 (MD5) hash or checksum of the file. ### Claim 15 (depends on 12) The method of claim 12, wherein the information comprises a hash of the file, and wherein the determination is based on a comparison between the hash of the file to a database of file signatures. ### Claim 16 (depends on 15) The method of claim 15, wherein the database of file signatures comprises a blacklist of known malware signatures. ### Claim 17 (depends on 15) The method of claim 15, wherein the database of file signatures comprises a whitelist of trusted file signatures. ### Claim 18 An apparatus, comprising: a memory; and at least one processor communicatively coupled to the memory, the at least one processor configured to: receive, via a credentialed scan of a scanning target located in a network or from a local agent executing on the scanning target, information describing a set of current connections on the scanning target; detect that a current connection among the set of current connections is associated with a compromised host having a known malicious Internet Protocol (IP) address; perform one or more actions to facilitate isolation of the network from malicious traffic attributable to the compromised host. ### Claim 19 (depends on 18) The apparatus of claim 18, wherein the known malicious IP address corresponds to a known botnet IP address. ### Claim 20 (depends on 18) The apparatus of claim 18, wherein the one or more actions comprise: generation of a report that identifies the compromised host as being associated with the known malicious IP address, or disablement of network connectivity for at least the compromised host to isolate the network from malicious traffic, or a combination thereof. ### Claim 21 (depends on 18) The apparatus of claim 18, wherein the detecting includes: identification of one or more IP addresses associated with each of the set of current connections on the scanning targets; comparison of the one or more identified IP addresses to a list that includes one or more known malicious IP addresses. ### Claim 22 (depends on 21) The apparatus of claim 21, wherein the one or more identified IP addresses comprise a source IP address and a destination IP address associated with each of the set of current connections on the scanning target, wherein the source IP address and the destination IP address are compared to the list. ### Claim 23 (depends on 18) The apparatus of claim 18, wherein the known malicious IP address is previously identified as associated with a respective host with one or more virus infections, one or more malware infections, one or more backdoor installations, one or more exploitable default accounts, one or more adware installations, one or more software installations known to be vulnerable to infection, one or more peer-to-peer (P2P) software installations, or a combination thereof. ### Claim 24 An apparatus, comprising: a memory; and at least one processor communicatively coupled to the memory, the at least one processor configured to: receive, via a credentialed scan of a scanning target located in a network, information describing an object on the scanning target; determine that the scanning target includes an infection or a vulnerability based at least in part upon the information describing the object on the scanning target; perform one or more actions to facilitate remediation of the infection or the vulnerability based on the determination. ### Claim 25 (depends on 24) The apparatus of claim 24, wherein the one or more actions comprise: generation of a report that identifies the scanning target as infected or vulnerable to infection, or disabling network connectivity for at least the scanning target to isolate the network from malicious traffic, or a combination thereof. ### Claim 26 (depends on 24) The apparatus of claim 24, wherein the object comprises a running process. ### Claim 27 (depends on 24) The apparatus of claim 24, wherein the object comprises a configuration. ### Claim 28 (depends on 27) The apparatus of claim 27, wherein the configuration comprises an operating system running on the scanning target, whether one or more passwords for one or more users associated with the scanning target complies with one or more policies, whether the scanning target stores a particular type of data, or a combination thereof. ### Claim 29 (depends on 24) The apparatus of claim 24, wherein the object comprises a file. ### Claim 30 (depends on 29) The apparatus of claim 29, wherein the information comprises a signature of the file, a hash of the file, a checksum associated with the file, or a combination thereof. ### Claim 31 (depends on 30) The apparatus of claim 30, wherein the information comprises a message digest 5 (MD5) hash or checksum of the file. ### Claim 32 (depends on 29) The apparatus of claim 29, wherein the information comprises a hash of the file, and wherein the determination is based on a comparison between the hash of the file to a database of file signatures. ### Claim 33 (depends on 32) The apparatus of claim 32, wherein the database of file signatures comprises a blacklist of known malware signatures. ### Claim 34 (depends on 32) The apparatus of claim 32, wherein the database of file signatures comprises a whitelist of trusted file signatures. ### Claim 35 A non-transitory computer-readable medium storing computer-executable instructions that, when executed by an apparatus, cause the apparatus to: receive, via a credentialed scan of a scanning target located in a network or from a local agent executing on the scanning target, information describing a set of current connections on the scanning target; detect that a current connection among the set of current connections is associated with a compromised host having a known malicious Internet Protocol (IP) address; perform one or more actions to facilitate isolation of the network from malicious traffic attributable to the compromised host. ### Claim 36 (depends on 35) The non-transitory computer-readable medium of claim 35, wherein the known malicious IP address corresponds to a known botnet IP address. ### Claim 37 (depends on 35) The non-transitory computer-readable medium of claim 35, wherein the one or more actions comprise: generation of a report that identifies the compromised host as being associated with the known malicious IP address, or disablement of network connectivity for at least the compromised host to isolate the network from malicious traffic, or a combination thereof. ### Claim 38 (depends on 35) The non-transitory computer-readable medium of claim 35, wherein the detecting includes: identification of one or more IP addresses associated with each of the set of current connections on the scanning targets; comparison of the one or more identified IP addresses to a list that includes one or more known malicious IP addresses. ### Claim 39 (depends on 38) The non-transitory computer-readable medium of claim 38, wherein the one or more identified IP addresses comprise a source IP address and a destination IP address associated with each of the set of current connections on the scanning target, wherein the source IP address and the destination IP address are compared to the list. ### Claim 40 (depends on 35) The non-transitory computer-readable medium of claim 35, wherein the known malicious IP address is previously identified as associated with a respective host with one or more virus infections, one or more malware infections, one or more backdoor installations, one or more exploitable default accounts, one or more adware installations, one or more software installations known to be vulnerable to infection, one or more peer-to-peer (P2P) software installations, or a combination thereof. ### Claim 41 A non-transitory computer-readable medium storing computer-executable instructions that, when executed by an apparatus, cause the apparatus to: receive, via a credentialed scan of a scanning target located in a network, information describing an object on the scanning target; determine that the scanning target includes an infection or a vulnerability based at least in part upon the information describing the object on the scanning target; perform one or more actions to facilitate remediation of the infection or the vulnerability based on the determination. ### Claim 42 (depends on 41) The non-transitory computer-readable medium of claim 41, wherein the one or more actions comprise: generation of a report that identifies the scanning target as infected or vulnerable to infection, or disabling network connectivity for at least the scanning target to isolate the network from malicious traffic, or a combination thereof. ### Claim 43 (depends on 41) The non-transitory computer-readable medium of claim 41, wherein the object comprises a running process. ### Claim 44 (depends on 41) The non-transitory computer-readable medium of claim 41, wherein the object comprises a configuration. ### Claim 45 (depends on 44) The non-transitory computer-readable medium of claim 44, wherein the configuration comprises an operating system running on the scanning target, whether one or more passwords for one or more users associated with the scanning target complies with one or more policies, whether the scanning target stores a particular type of data, or a combination thereof. ### Claim 46 (depends on 41) The non-transitory computer-readable medium of claim 41, wherein the object comprises a file. ### Claim 47 (depends on 46) The non-transitory computer-readable medium of claim 46, wherein the information comprises a signature of the file, a hash of the file, a checksum associated with the file, or a combination thereof. ### Claim 48 (depends on 47) The non-transitory computer-readable medium of claim 47, wherein the information comprises a message digest 5 (MD5) hash or checksum of the file. ### Claim 49 (depends on 46) The non-transitory computer-readable medium of claim 46, wherein the information comprises a hash of the file, and wherein the determination is based on a comparison between the hash of the file to a database of file signatures. ### Claim 50 (depends on 49) The non-transitory computer-readable medium of claim 49, wherein the database of file signatures comprises a blacklist of known malware signatures. ### Claim 51 (depends on 49) The non-transitory computer-readable medium of claim 49, wherein the database of file signatures comprises a whitelist of trusted file signatures.