Method and apparatus for monitoring a computer system for malicious software
AssigneeSymantec Corporation
InventorAnand D. Sankruthi
Life of this patent
Estimating the term…
Abstract
A method and apparatus for monitoring a computer system for malicious software is provided. The method for monitoring malicious software proliferation includes processing a deceptive contact address associated with a monitoring device and inserting the deceptive contact address into a contact list, wherein malicious software self-propagates through the contact list, wherein the monitoring device receives a copy of the malicious software through the deceptive contact address.
Claims20
A method for monitoring malicious software proliferation, comprising:
- processing a deceptive contact address associated with a first network domain of a monitoring device;
- inserting the deceptive contact address into a contact list of a system associated with a second network domain;
- and
- processing a copy of malicious software received at the first network domain of the monitoring device from the second network domain through the deceptive contact address, wherein the malicious software self-propagates through the contact list, and wherein the first and second network domains are different.
A method for monitoring malicious software proliferation, comprising:
- storing an email address in a contact list of a system associated with a second network domain for communicating with a monitoring device, wherein the email address is associated with a first network domain of the monitoring device, wherein the first and second network domains are different;
- and
- when malicious software uses the contact list to propagate, sending a copy of the malicious software from the second network domain to the monitoring device at the first network domain using the email address.
A system for monitoring malicious software proliferation, comprising:
- a user computer associated with a second network domain comprising:
- a memory comprising contact information that includes a deceptive contact address for communicating with a monitoring device, wherein the deceptive contact address is associated with a first network domain of the monitoring device, wherein the first and second domains are different;
- and
- a monitoring device coupled to the user computer for capturing malicious software that is sent from the second network domain to the first network domain through the deceptive contact address.
Dependencies are inferred from the claim text.