Back to results
US 8,555,379 B1Granted
Method and apparatus for monitoring communications from a communications device
AssigneeSymantec Corporation
InventorsOliver Whitehouse, Oliver Friedrichs, Elias Levy
Life of this patent
Estimating the term…
Abstract
A method and apparatus for monitoring communications from a communications device comprising monitoring communications from a communications device by storing a data acquisition address in a contact list of the communications device that identifies a location of a monitoring device. Further, when malicious software uses the contact list to send messages, a message is sent using the malicious software to the monitoring device using the data acquisition address.
Claims18
A method for monitoring communications from a communications device, comprising:
- generating a non-deterministic data acquisition address in response to a request from security software on the communications device;
- storing, using at least one computer processor, the non-deterministic data acquisition address in a contact list of the communications device that identifies a location of a monitoring device;
- when malicious software uses the contact list to send messages, sending a message using the malicious software to the monitoring device using the non-deterministic data acquisition address;
- identifying a cause of the message as at least one of malware, SPAM, and a phishing attempt;
- analyzing content of the message based on a receipt of the message at the non-deterministic data acquisition address to determine whether data of the message is a hostile program;
- identifying the data of the message as a hostile program;
- generating global intelligence based on the identification of the hostile program;
- and
- distributing the global intelligence to a plurality of communications devices, wherein distribution of the global intelligence is independent of an indicia of infection of a global intelligence recipient.
6 more elements
An apparatus for monitoring communications from a communications device, comprising:
- a data acquisition address generator configured to generate a non-deterministic data acquisition address in response to a request from security software on the communications device;
- a memory for storing the non-deterministic data acquisition address within a contact list used by communication software of the communications device, where the data acquisition address is used by malicious software to send messages;
- a monitoring device for receiving messages communicated to the data acquisition address, and
- a global intelligence module configured to identify a cause of the message as at least one of malware, SPAM, and a phishing attempt, wherein the global intelligence module is further configured to:
- analyze content of a message based on a receipt of the message at the non-deterministic data acquisition address to determine whether data of the message is a hostile program;
- identify the data of the message as a hostile program;
- generate global intelligence based on the identification of the hostile program;
- and
- distribute the global intelligence to a plurality of communications devices, wherein distribution of the global intelligence is independent of an indicia of infection of a global intelligence recipient.
6 more elements
A system for monitoring communications from a communications device, comprising:
- a plurality of communications devices, each communications device comprising:
- a memory having contact list information, wherein the contact list information comprises at least one non-deterministic data acquisition address of a monitoring device;
- and
- an intelligence system, comprising:
- a data acquisition address generator configured to generate a non-deterministic data acquisition address in response to a request from security software on at least one of the communications devices;
- a monitoring device configured to monitor data communicated from any of the plurality communications devices to the non-deterministic data acquisition address;
- and
- a global intelligence module configured to identify a cause of the message as at least one of malware, SPAM, and a phishing attempt, wherein the global intelligence module is further configured to:
- analyze content of a message based on a receipt of the message at the non-deterministic data acquisition address to determine whether data of the message is a hostile program;
- identify the data of the message as a hostile program;
- generate global intelligence based on the identification of the hostile program;
- and
- distribute the global intelligence to a plurality of communications devices, wherein distribution of the global intelligence is independent of an indicia of infection of a global intelligence recipient.
10 more elements
Dependencies are inferred from the claim text.