# US 8,474,039 B2 · System and method for proactive detection and repair of malware memory infection via a remote memory reputation system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,474,039 B2 - Document ID: US8474039B2 - Status: Granted - Kind: B2 - Application number: 12/695,011 - Filed: 2010-01-27 - Published: 2011-07-28 - Granted: 2013-06-25 - Earliest claimed: 2010-01-27 - Assignees: McAfee, Inc. - Applicants: Ahmed Said Sallam - Inventors: Ahmed Said Sallam - Web page: https://patentgrep.com/patent/US8474039B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/568: {eliminating virus, restoring damaged files} - H04L 63/1433: {Vulnerability analysis} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for detecting malware memory infections includes the steps of scanning a memory on an electronic device, determining a suspicious entry present in the memory, accessing information about the suspicious entry in a reputation system, and evaluating whether the suspicious entry indicates a malware memory infection. The memory includes memory known to be modified by malware. The suspicious entry is not recognized as a safe entry. The reputation system is configured to store information on suspicious entries. The evaluation is based upon historical data regarding the suspicious entry. ## Claims ### Claim 1 A method for detecting malware memory infections, comprising the steps of: scanning a memory on an electronic device, the memory comprising memory vulnerable to memory modifications caused by malware; determining a suspicious entry present in the memory, the suspicious entry not recognized as a safe entry, the suspicious entry comprising a modification to an existing entry in memory; accessing information about the suspicious entry from a reputation system, the reputation system configured to store information on suspicious entries; and evaluating whether the suspicious entry indicates a malware memory infection, wherein the evaluation is based upon historical data regarding the suspicious entry, comprising: comparing the distribution pattern of the suspicious entry against a known distribution pattern, the known distribution pattern indicating a safe memory modification or indicating a malware memory infection; comparing a determined quantity of devices for which the suspicious entry has been reported against an upper threshold; comparing the time range of the determined quantity of devices against a lower threshold; and determining that the suspicious entry does not indicate a malware memory infection if the determined quantity of devices exceeds the upper threshold and the time range of the determined quantity of devices is less than the lower threshold. ### Claim 2 (depends on 1) The method of claim 1, further comprising the step of adding a suspicious entry data to a whitelist, wherein the evaluation is that the suspicious entry does not indicate a malware memory infection. ### Claim 3 (depends on 1) The method of claim 1, further comprising the step of adding information concerning suspicious entry to the reputation system, wherein the evaluation is that it is unknown whether the suspicious entry indicates a malware memory infection. ### Claim 4 (depends on 1) The method of claim 1, further comprising the step of adding suspicious entry to a blacklist, wherein the evaluation is that the suspicious entry indicates a malware memory infection. ### Claim 5 (depends on 1) The method of claim 1, further comprising the step of cleaning the electronic device of a malware memory infection, wherein the evaluation is that the suspicious entry indicates a malware memory infection. ### Claim 6 (depends on 5) The method of claim 5, wherein cleaning the electronic device of a malware memory infection comprises repairing the memory of the electronic device. ### Claim 7 (depends on 1) The method of claim 1, further comprising the step of generating a repair driver for the electronic device, wherein the evaluation is that the suspicious entry indicates a malware memory infection. ### Claim 8 (depends on 1) The method of claim 1, wherein evaluating whether the suspicious entry indicates a malware memory infection further comprises: determining a range of networks from which the suspicious entry has been reported; and if the suspicious entry has been reported from a single network, determining that the suspicious entry does not comprise a malware infection. ### Claim 9 (depends on 1) The method of claim 1, further comprising the step of sending information concerning unrecognized values associated with the suspicious entry to the reputation system. ### Claim 10 (depends on 9) The method of claim 9, further comprising the step of sending information identifying the electronic device to the reputation system. ### Claim 11 A method for detecting malware memory infections, comprising the steps of: scanning a memory on an electronic device, the memory comprising memory vulnerable to memory modifications caused by malware; determining a suspicious entry present in the memory, the suspicious entry not recognized as a safe entry, the suspicious entry comprising a modification to an existing entry in memory; accessing information about the suspicious entry from a reputation system, the reputation system configured to store information on suspicious entries; and evaluating whether the suspicious entry indicates a malware memory infection, wherein the evaluation is based upon historical data regarding the suspicious entry, comprising: comparing the distribution pattern of the suspicious entry against a known distribution pattern, the known distribution pattern indicating a safe memory modification or indicating a malware memory infection; comparing a determined quantity of devices for which the suspicious entry has been reported against a lower threshold; comparing the time range of the determined quantity of devices against an upper threshold; and determining that the suspicious entry indicates a malware memory infection if the determined quantity of devices is less than the lower threshold and the time range of the determined quantity of devices exceeds the upper threshold. ### Claim 12 An article of manufacture, comprising: a non-transitory computer readable medium; and computer-executable instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to: scan a memory on an electronic device, the memory comprising memory vulnerable to memory modifications caused by malware; determine a suspicious entry present in the memory, the suspicious entry not recognized as a safe entry, the suspicious entry comprising a modification to an existing entry in memory; access information about the suspicious entry from a reputation system, the reputation system configured to store information on suspicious entries; and evaluate whether the suspicious entry indicates a malware memory infection, wherein the evaluation is based upon historical data regarding the suspicious entry, comprising: comparing the distribution pattern of the suspicious entry against a known distribution pattern, the known distribution pattern indicating a safe memory modification, or indicating a malware memory infection; comparing a determined quantity of devices for which the suspicious entry has been reported against an upper threshold; comparing the time range of the determined quantity of devices against a lower threshold; and determining that the suspicious entry does not indicate a malware memory infection if the determined quantity of devices exceeds the upper threshold and the time range of the determined quantity of devices is less than the lower threshold. ### Claim 13 (depends on 12) The article of claim 12, wherein the processor is further caused to add the suspicious entry's information to a whitelist, wherein the evaluation is that the suspicious entry does not indicate a malware memory infection. ### Claim 14 (depends on 12) The article of claim 12, wherein the processor is further caused to add information concerning the suspicious entry to the reputation system, wherein the evaluation is that it is unknown whether the suspicious entry indicates a malware memory infection. ### Claim 15 (depends on 12) The article of claim 12, wherein the processor is further caused to add the suspicious entry's information to a blacklist, wherein the evaluation is that the suspicious entry indicates a malware memory infection. ### Claim 16 (depends on 12) The article of claim 12, wherein the processor is further caused to clean the electronic device of a malware memory infection, wherein the evaluation is that the suspicious entry indicates a malware memory infection. ### Claim 17 (depends on 12) The article of claim 12, wherein causing the processor to clean electronic device of a malware memory infection comprises causing the processor to repair the memory of the electronic device. ### Claim 18 (depends on 12) The article of claim 12, wherein the processor is further caused to generate a repair driver for the electronic device, wherein the evaluation is that the suspicious entry indicates a malware memory infection. ### Claim 19 (depends on 12) The article of claim 12, wherein causing the processor to evaluate whether the suspicious entry indicates a malware memory infection further comprises causing the processor to: determine a range of networks from which the suspicious entry has been reported; and if the suspicious entry has been reported from a single network, determine that the suspicious entry does not comprise a malware infection. ### Claim 20 (depends on 12) The article of claim 12, wherein the processor is further caused to send information concerning unrecognized values associated with the suspicious entry to the reputation system. ### Claim 21 (depends on 20) The article of claim 20, wherein the processor is further caused to send information identifying the electronic device to the reputation system. ### Claim 22 An article of manufacture, comprising: a non-transitory computer readable medium; and computer-executable instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to: scan a memory on an electronic device, the memory comprising memory vulnerable to memory modifications caused by malware; determine a suspicious entry present in the memory, the suspicious entry not recognized as a safe entry, the suspicious entry comprising a modification to an existing entry in memory; access information about the suspicious entry from a reputation system, the reputation system configured to store information on suspicious entries; and evaluate whether the suspicious entry indicates a malware memory infection, wherein the evaluation is based upon historical data regarding the suspicious entry, comprising: comparing the distribution pattern of the suspicious entry against a known distribution pattern, the known distribution pattern indicating a safe memory modification, or indicating a malware memory infection; comparing a determined quantity of devices for which the suspicious entry has been reported against a lower threshold; comparing the time range of the determined quantity of devices against an upper threshold; and determining that the suspicious entry indicates a malware memory infection if the determined quantity of devices is less than the lower threshold and the time range of the determined quantity of devices exceeds the upper threshold. ### Claim 23 A system detecting malware memory infections, comprising: a monitor, the monitor configured to: scan a memory on an electronic device, the memory comprising memory vulnerable to memory modifications caused by malware determine a suspicious entry present in the memory, the suspicious entry not recognized as a safe entry, the suspicious entry comprising a modification to an existing entry in memory; and send information about the suspicious entry to a reputation system configured to access information about the suspicious entry in a reputation database configured to store information on suspicious entries; and determine, based on information from the reputation system, whether the suspicious entry indicates a malware memory infection based upon historical data regarding the suspicious entry, comprising: comparing the distribution pattern of the suspicious entry against a known distribution pattern, the known distribution pattern indicating a safe memory modification, or indicating a malware memory infection; comparing a determined quantity of devices for which the suspicious entry has been reported against an upper threshold; comparing the time range of the determined quantity of devices against a lower threshold; and determining that the suspicious entry does not indicate a malware memory infection if the determined quantity of devices exceeds the upper threshold and the time range of the determined quantity of devices is less than the lower threshold. ### Claim 24 (depends on 23) The system of claim 23, wherein the reputation system is further configured to add the suspicious entry's information to a whitelist, wherein the evaluation is that the suspicious entry does not indicate a malware memory infection. ### Claim 25 (depends on 23) The system of claim 23, wherein the reputation server is further configured to add information concerning the suspicious entry to the reputation database, wherein the evaluation is that it is unknown whether the suspicious entry indicates a malware memory infection. ### Claim 26 (depends on 23) The system of claim 23, wherein reputation system is further configured to add the suspicious entry's information to a blacklist, wherein the evaluation is that the suspicious entry indicates a malware memory infection. ### Claim 27 (depends on 23) The system of claim 23, wherein the monitor is further configured to clean the electronic device of a malware memory infection, wherein the evaluation is that the suspicious entry indicates a malware memory infection. ### Claim 28 (depends on 27) The system of claim 27, wherein configuring the monitor to clean electronic device of a malware memory infection comprises configuring the monitor to repair the memory of the electronic device. ### Claim 29 (depends on 23) The system of claim 23, wherein the reputation system is further configured to generate a repair driver for the electronic device, wherein the evaluation is that the suspicious entry indicates a malware memory infection. ### Claim 30 (depends on 23) The system of claim 23, wherein configuring the reputation system to evaluate whether the suspicious entry indicates a malware memory infection further comprises configuring the reputation system to: determine a range of networks from which the suspicious entry has been reported; and if the suspicious entry has been reported from a single network, determine that the suspicious entry does not comprise a malware infection. ### Claim 31 (depends on 23) The system of claim 23, wherein the monitor is further configured to send information concerning unrecognized values associated with the suspicious entry to the reputation system. ### Claim 32 (depends on 31) The system of claim 31, wherein the monitor is further configured to send information identifying the electronic device to the reputation system. ### Claim 33 A system detecting malware memory infections, comprising: a monitor, the monitor configured to: scan a memory on an electronic device, the memory comprising memory vulnerable to memory modifications caused by malware determine a suspicious entry present in the memory, the suspicious entry not recognized as a safe entry, the suspicious entry comprising a modification to an existing entry in memory; and send information about the suspicious entry to a reputation system configured to access information about the suspicious entry in a reputation database configured to store information on suspicious entries; and determine, based on information from the reputation system, whether the suspicious entry indicates a malware memory infection based upon historical data regarding the suspicious entry, comprising: comparing the distribution pattern of the suspicious entry against a known distribution pattern, the known distribution pattern indicating a safe memory modification, or indicating a malware memory infection; comparing a determined quantity of devices for which the suspicious entry has been reported against a lower threshold; comparing the time range of the determined quantity of devices against an upper threshold; and determining that the suspicious entry indicates a malware memory infection if the determined quantity of devices is less than the lower threshold and the time range of the determined quantity of devices exceeds the upper threshold.