Methods And Systems For Distribution And Integration Of Threat Indicators For Information Handling Systems
AssigneeDell Products L.P.
InventorsKathleen M. Moriarty, Ricardo L. Martinez, Samant Kakarla
Life of this patent
Estimating the term…
Abstract
Methods and systems are provided that may be implemented in an automated manner to distribute and integrate information regarding threat indicators as they occur in real time. The provided methods and systems may be implemented to combine threat indicator characteristic information in real time with application behavior patterns, information handling system types, and/or application types; and to automatically apply the resulting intelligence together to improve malicious attack defense at the application and information handling system level at scale.
Claims20
A method, comprising:
- developing a target code;
- then associating the target code with one or more threat indicators and/or one or more behaviors;
- then creating a data set including the target code and the one or more associated threat indicators and/or behaviors;
- and
- then providing the data set across a network from a first information handling system to at least one other information handling system that comprises an endpoint information handling system or a second information handling system coupled to and managing the endpoint information handling system.
A system, comprising:
- at least one first information handling system comprising a first programmable integrated circuit and being coupled to a first network, the first information handling system accessing a data set including a target code and one or more threat indicators and/or one or more behaviors associated with the target code;
- and
- at least one second information handling system comprising a second programmable integrated circuit and being coupled to the first network;
- where the first programmable integrated circuit of the first information handling system is programmed to provide the data set across the first network from the first information handling system to the second information handling system;
- where the second programmable integrated circuit of the second information handling system is programmed to:
- use the associated threat indicators and/or behaviors from the data set to detect the presence of a threat associated with the target code executing on an endpoint information handling system, and
- then take at least one automatic action and/or provide at least one alert only upon detection of the presence of the threat associated with the target code on the endpoint information handling system;
- and
- where the one or more behaviors comprise at least one of expected behaviors associated with the target code or unexpected behaviors associated with the target code.
An information handling system, comprising a programmable integrated circuit programmed to receive a data set across a first network, the data set including a target code and one or more threat indicators and/or one or more behaviors associated with the target code;
- and where the programmable integrated circuit of the information handling system is further programmed to:
- use the associated threat indicators and/or behaviors from the data set to detect the presence of a threat associated with the target code when executing on an endpoint information handling system;
- and
- then take at least one automatic action and/or provide at least one alert only upon detection of the presence of the threat associated with the target code when executing on the endpoint information handling system.
Dependencies are inferred from the claim text.