# US 8,789,185 B1 · Method and apparatus for monitoring a computer system for malicious software > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,185 B1 - Document ID: US8789185B1 - Status: Granted - Kind: B1 - Application number: 12/210,245 - Filed: 2008-09-15 - Granted: 2014-07-22 - Earliest claimed: 2008-09-15 - Assignees: Symantec Corporation - Applicants: Anand D. Sankruthi - Inventors: Anand D. Sankruthi - Web page: https://patentgrep.com/patent/US8789185B1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 2221/2127: Bluffing - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method and apparatus for monitoring a computer system for malicious software is provided. The method for monitoring malicious software proliferation includes processing a deceptive contact address associated with a monitoring device and inserting the deceptive contact address into a contact list, wherein malicious software self-propagates through the contact list, wherein the monitoring device receives a copy of the malicious software through the deceptive contact address. ## Claims ### Claim 1 A method for monitoring malicious software proliferation, comprising: processing a deceptive contact address associated with a first network domain of a monitoring device; inserting the deceptive contact address into a contact list of a system associated with a second network domain; and processing a copy of malicious software received at the first network domain of the monitoring device from the second network domain through the deceptive contact address, wherein the malicious software self-propagates through the contact list, and wherein the first and second network domains are different. ### Claim 2 (depends on 1) The method of claim 1 further comprising analyzing the malicious software to determine that the malicious software is new. ### Claim 3 (depends on 1) The method of claim 1, wherein the deceptive contact address is non-deterministic. ### Claim 4 (depends on 1) The method of claim 1, wherein the deceptive contact address defines an identifier associated with communication software, wherein the identifier comprises at least one of an email address, a phone number, a username, or an internet protocol (IP) address. ### Claim 5 (depends on 4) The method of claim 4, wherein inserting the deceptive contact address further comprises inserting the identifier into the contact list through an interface that is provided by the communication application. ### Claim 6 (depends on 1) The method of claim 1, wherein processing the deceptive contact address further comprises generating the deceptive contact address using information that identifies the monitoring device. ### Claim 7 (depends on 1) The method of claim 1, wherein processing the deceptive contact address further comprises selecting an email address that is randomly generated. ### Claim 8 (depends on 1) The method of claim 1 further comprising modifying the deceptive contact address that is inserted into the contact information. ### Claim 9 A method for monitoring malicious software proliferation, comprising: storing an email address in a contact list of a system associated with a second network domain for communicating with a monitoring device, wherein the email address is associated with a first network domain of the monitoring device, wherein the first and second network domains are different; and when malicious software uses the contact list to propagate, sending a copy of the malicious software from the second network domain to the monitoring device at the first network domain using the email address. ### Claim 10 (depends on 9) The method of claim 9, wherein storing the email address further comprises selecting the email address at random from a plurality of email addresses that are associated with the network location of the monitoring device. ### Claim 11 (depends on 10) The method of claim 10 further comprising: selecting another email address at random from the plurality of email addresses that are associated with the network location of the monitoring device; and replacing the stored email address with the another email address. ### Claim 12 (depends on 9) The method of claim 9 further comprising: modifying a domain name used by the plurality of email addresses; replacing the stored email address with an email address having the modified domain name. ### Claim 13 A system for monitoring malicious software proliferation, comprising: a user computer associated with a second network domain comprising: a memory comprising contact information that includes a deceptive contact address for communicating with a monitoring device, wherein the deceptive contact address is associated with a first network domain of the monitoring device, wherein the first and second domains are different; and a monitoring device coupled to the user computer for capturing malicious software that is sent from the second network domain to the first network domain through the deceptive contact address. ### Claim 14 (depends on 13) The system of claim 13, wherein the user computer further comprises security software for storing the deceptive contact address in the contact information. ### Claim 15 (depends on 14) The system of claim 14 further comprises a backend system coupled to the monitoring device, comprising a contact address generator for creating the deceptive contact address and communicating the deceptive contact address to the security software. ### Claim 16 (depends on 15) The system of claim 15, wherein the backend system analyzes the captured malicious software to generate security definitions. ### Claim 17 (depends on 14) The system of claim 14, wherein the security software selects the deceptive contact address at random from a plurality of deceptive contact addresses that are associated with the network location of the monitoring device. ### Claim 18 (depends on 17) The system of claim 17, wherein the security software replaces the deceptive contact address with another deceptive contact address selected from the plurality of deceptive contact addresses. ### Claim 19 (depends on 14) The system of claim 14, wherein the security software stores the deceptive contact address in the contact information through an interface that is provided by a communication application associated with the contact information. ### Claim 20 (depends on 14) The system of claim 14, wherein the security software modifies the deceptive contact address that is stored within the contact information.