US 7,926,111 B2Granted

Determination of related entities

AssigneeSymantec Corporation

InventorsIan Oliver, Ryan Pereira

Life of this patent

Estimating the term…

Abstract

A method/system for determining a group of related entities of interest in one or more processing systems. The method comprises identifying a starting entity from one or more entities in the one or more processing systems, then obtaining, based on an entity type of the starting entity, a first set of rules for determining at least one other related entity, and then determining, using the first set of rules, the at least one related entity.

Claims16

Dependent claims

A method of determining a group of related entities of interest in one or more processing systems, wherein the method comprises the steps of:

(a) identifying, by a processing system, using a second rule, a starting entity from one or more entities in the one or more processing systems, wherein the second rule comprises an event record indicative of at least one past event that occurred in the processing systems;
(b) obtaining, by the processing system, based on an entity property of the starting entity, a first rule for identifying at least one related entity;
(c) identifying, by the processing system, using the first rule, the at least one related entity relative to the starting entity;
(d) determining, by the processing system, if an end condition is satisfied;
(e) if the end condition is satisfied, transferring data indicative of the at least one identified related entity to a server processing system;
(f) if the end condition is not satisfied, setting the at least one related entity as the starting entity;
(g) repeating steps (b), (c), (d), (e), and (f) until the end condition is satisfied;
(h) receiving, by a server processing system, suspicious entity data indicative of one or more suspicious entities in the one or more processing systems;
(i) determining, by the server processing system, a quantity of malicious assessment rules satisfied by the one or more suspicious entities;
(j) assigning, by the server processing system, a malicious value to the one or more suspicious entities based on the quantity of malicious assessment rules satisfied by the one or more suspicious entities, wherein the malicious value indicates a potential maliciousness of the one or more suspicious entities;
(k) determining, by the server processing system, using a set of malicious assessment rules, the suspicious entity data, and the assigned malicious values, the one or more malicious entities;
(l) generating instructions for quarantining the one or more malicious entities on the one or more processing systems;
and
(m) transferring, to the one or more processing systems, the instructions.

11 more elements

A computer program product for determining a group of related entities of interest in one or more processing systems, the computer program product comprising a non-transitory computer-readable medium having instructions thereon, the instructions comprising:

(a) code programmed to identify, using a second rule, a starting entity from one or more entities in the one or more processing systems, wherein the second rule comprises an event record indicative of at least one past event that occurred in the processing systems;
(b) code programmed to obtain, based on an entity property of the starting entity, a first rule for identifying at least one related entity;
(c) code programmed to identify, using the first rule, the at least one related entity relative to the starting entity;
(d) code programmed to determine if an end condition is satisfied;
(e) if the end condition is satisfied, code programmed to transfer data indicative of the at least one identified related entity to a server processing system;
(f) if the end condition is not satisfied, code programmed to set the at least one related entity as the starting entity;
(g) code programmed to repeat steps (b), (c), (d), (e), and (f) until the end condition is satisfied
(h) code programmed to receive suspicious entity data indicative of one or more suspicious entities in the one or more processing systems;
(i) code programmed to determine a quantity of malicious assessment rules satisfied by the one or more suspicious entities;
(j) code programmed to assign a malicious value to the one or more suspicious entities based on the quantity of malicious assessment rules satisfied by the one or more suspicious entities, wherein the malicious value indicates a potential maliciousness of the one or more suspicious entities;
(k) code programmed to determine, using a set of malicious assessment rules, the suspicious entity data, and the assigned malicious values, the one or more malicious entities;
(l) code programmed to generate instructions for quarantining the one or more malicious entities on the one or more processing systems;
and
(m) code programmed to transfer, to the one or more processing systems, the instructions.

11 more elements

Dependencies are inferred from the claim text.

Facts

Application: 11/707,425Filed 16 Feb 2007 · us provisional application
Priority: 17 Mar 2006
Published: US 2007/0220043 A120 Sep 2007
Granted: 12 Apr 2011
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…
G06F 21/577
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…
H04L 63/104
For controlling access to devices or network resources: grouping of entities

Family

Application60/783,242Us provisional application · filed 17 Mar 2006
US 2007/0220043 A1Pre-grant publication · published 20 Sep 2007
US 7,926,111 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

patentgrep

Loading patent…

Abstract

A method of determining a group of related entities of interest in one or more processing systems, wherein the method comprises the steps of:

(a) identifying, by a processing system, using a second rule, a starting entity from one or more entities in the one or more processing systems, wherein the second rule comprises an event record indicative of at least one past event that occurred in the processing systems;
(b) obtaining, by the processing system, based on an entity property of the starting entity, a first rule for identifying at least one related entity;
(c) identifying, by the processing system, using the first rule, the at least one related entity relative to the starting entity;
(d) determining, by the processing system, if an end condition is satisfied;
(e) if the end condition is satisfied, transferring data indicative of the at least one identified related entity to a server processing system;
(f) if the end condition is not satisfied, setting the at least one related entity as the starting entity;
(g) repeating steps (b), (c), (d), (e), and (f) until the end condition is satisfied;
(h) receiving, by a server processing system, suspicious entity data indicative of one or more suspicious entities in the one or more processing systems;
(i) determining, by the server processing system, a quantity of malicious assessment rules satisfied by the one or more suspicious entities;
(j) assigning, by the server processing system, a malicious value to the one or more suspicious entities based on the quantity of malicious assessment rules satisfied by the one or more suspicious entities, wherein the malicious value indicates a potential maliciousness of the one or more suspicious entities;
(k) determining, by the server processing system, using a set of malicious assessment rules, the suspicious entity data, and the assigned malicious values, the one or more malicious entities;
(l) generating instructions for quarantining the one or more malicious entities on the one or more processing systems;
and
(m) transferring, to the one or more processing systems, the instructions.

11 more elements

Facts

Application

11/707,425Filed 16 Feb 2007 · us provisional application

Priority

17 Mar 2006

Published

US 2007/0220043 A120 Sep 2007

Granted

12 Apr 2011

Term ends

Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…
G06F 21/577
Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates…:…
H04L 63/104
For controlling access to devices or network resources: grouping of entities