# US 8,782,786 B2 · Remedial action against malicious code at a client facility > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,782,786 B2 - Document ID: US8782786B2 - Status: Granted - Kind: B2 - Application number: 11/694,109 - Filed: 2007-03-30 - Published: 2008-10-02 - Granted: 2014-07-15 - Earliest claimed: 2007-03-30 - Assignees: Sophos Limited - Applicants: Paul Baccas; Fraser Howard; Vanja Svajcer - Inventors: Paul Baccas; Fraser Howard; Vanja Svajcer - Web page: https://patentgrep.com/patent/US8782786B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) - H04L 67/564: Enhancement of application control based on intercepted application data - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Aspects of this invention may relate to a malicious application remedial action request application where a network site interaction may be requested from a client computing facility; the network site interaction from the client computing facility may be determined to be unacceptable based on an acceptance policy at a gateway facility; access to the network site from the client computing facility may be denied; information relating to the attempted interaction with the network site may be sent from the gateway facility to the client computing facility, wherein the information may indicate that the attempted interaction occurred; and the client computing facility may interpret the information relating to the attempted interaction, determine whether the attempted interaction was the result of an automatically generated request, and take remedial action in the event that the attempted interaction was the result of the automatically generated request. ## Claims ### Claim 1 A method, comprising: requesting an interaction with a network site from a client computing facility; determining that the interaction is unacceptable based on an acceptance policy for an enterprise at a gateway facility to the enterprise; denying access to the network site from the client computing facility; sending an information file to the client including information relating to the attempted interaction with the network site, wherein the information indicates that the interaction was requested; and causing the client computing facility, in response to receipt of the information file, to interpret the information relating to the requested interaction, determine whether the requested interaction was the result of an automatically generated request by malicious code, and take remedial action in the event that the attempted interaction was the result of the automatically generated request by malicious code. ### Claim 2 (depends on 1) The method of claim 1, wherein the acceptance policy comprises an unacceptable network site database. ### Claim 3 (depends on 1) The method of claim 1, wherein the acceptance policy comprises an acceptable network site database. ### Claim 4 (depends on 1) The method of claim 1, wherein the acceptance policy comprises a network site reputation database. ### Claim 5 (depends on 1) The method of claim 1, wherein the acceptance policy comprises a rule evaluation of the network site interaction acceptability. ### Claim 6 (depends on 1) The method of claim 1, wherein the acceptance policy is based on a block list. ### Claim 7 (depends on 1) The method of claim 1, wherein the acceptance policy is based on an acceptance list. ### Claim 8 (depends on 1) The method of claim 1, wherein the network site interaction is an access request to a network system. ### Claim 9 (depends on 1) The method of claim 1, wherein the information is stored on the client computing facility. ### Claim 10 (depends on 9) The method of claim 9, wherein the stored information is parsed by a client computer facility malicious code analysis application using a virus identity file (IDE). ### Claim 11 (depends on 10) The method of claim 10, wherein the IDE parsed information is used to determine an appropriate action by the client computer facility. ### Claim 12 (depends on 1) The method of claim 1, wherein the remedial action taken by the client computer facility is a result of a client computing facility resident malicious code detection application accessing information using IDE information. ### Claim 13 (depends on 1) The method of claim 1, wherein the information comprises data adapted to be interpreted by the client computing facility. ### Claim 14 (depends on 1) The method of claim 1, wherein the information comprises at least one command to be executed by the client computing facility. ### Claim 15 (depends on 1) The method of claim 1, wherein the remedial action comprises scanning the client computing facility for malware. ### Claim 16 (depends on 1) The method of claim 1, wherein the remedial action comprises any action determined by the client computer facility malicious code analysis application interacting with the IDE and the information. ### Claim 17 (depends on 1) The method of claim 1, further comprising the step of sending an access approval request from the client computing facility to the gateway facility indicating that the requested interaction was user initiated and requesting a policy change to allow the requested interaction. ### Claim 18 A system, comprising: a client computing facility associated with an enterprise; a gateway adapted to provide network access to the client computing facility, the gateway further adapted to receive a network site interaction request from the client computing facility, the gateway implementing an acceptance policy for the enterprise that determines an acceptability of the network site interaction from the client computing facility, and the gateway configured to transmit an information file to the client computing facility when the gateway determines that the attempted interaction with the network site is unacceptable based on an acceptance policy for the enterprise; and a remedial action facility executing on the client computing facility responsive to the information file by determining whether the attempted interaction was the result of an automatically generated request from malicious code executing on the client, and taking remedial action in the event that the attempted interaction was the result of the automatically generated request.