US 9,578,045 B2Granted

Method and apparatus for providing forensic visibility into systems and networks

AssigneeWebroot Inc.

InventorsJoseph Jaroch, Jacques Etienne Erasmus, Paul Barnes, Johannes Mayr, Michael Leidesdorff, Marco Giuliani, Christopher Jon Williams, Chad Edward Bacher

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Methods and systems for providing forensic visibility into systems and networks are provided. More particularly, a sensor agent may receive events defining an action of a first object acting on a target. The object, the event, and the target are then correlated to at least one originating object such that an audit trail for each individual event is created. A global perspective indicating an age, popularity, a determination as to whether the object may be malware, and IP/URL information associated with the event may then be applied to at least one of the object, the event, the target, and the originating object. A priority may then be determined and assigned to the event based on at least the global perspective. An event line containing event information is then transmitted to an end recipient where the information may be heuristically displayed.

Claims19

Dependent claims

A method comprising:

gathering one or more events defining an action of a first object acting on a target;
generating a contextual state for at least one of the one or more events by correlating the at least one event to an originating object, the contextual state including an indication of the originating object of the first object and an indication of at least one of a device on which the first object is executed and a user associated with the first object;
obtaining a global perspective for the at least one event by obtaining information associated with one or more of the first object and the originating object, the information including at least one of age, popularity, a determination as to whether the first object is malware, a determination as to whether the originating object is malware, Internet Protocol (IP) Address, and Uniform Resource Locator (URL) information, wherein the global perspective for one or more related events to the at least one event across a network;
assembling an event line including details associated with the at least one event, the details including information uniquely identifying the first object, the action of the first object, the target, and the originating object;
and
transmitting the assembled event line.

3 more elements

A system for providing forensic visibility into a system, comprising:

a device including:
a communication interface;
a processor;
data storage;
and
a sensor agent stored on the data storage that is executable by the processor, wherein the sensor agent is operable to:
gather one or more events defining an action of a first object acting on a target;
generate a contextual state for at least one of the one or more events by correlating the at least one event to an originating object, the contextual state including an indication of the originating object of the first object and an indication of at least one of a device on which the first object is executed and a user associated with the first object;
obtain a global perspective for the at least one event by obtaining information associated with one or more of the first object and the originating object, the information including at least one of age, popularity, a determination as to whether the first object is malware, a determination as to whether the originating object is malware, Internet Protocol (IP) Address, and Uniform Resource Locator (URL) information, wherein the global perspective for one or more related events to the at least one event across a network;
assemble an event line including details associated with the at least one event, the details including information uniquely identifying each of the first object, the action of the first object, the target, and the originating object;
and
transmit the assembled event line utilizing the communication interface.

9 more elements

A system for providing forensic visibility into a system, comprising:

a device including:
a communication interface;
a processor;
data storage;
and
a sensor agent stored on the data storage that is executable by the processor, wherein the sensor agent is operable to:
gather one or more events defining an action of a first object acting on a target;
generate a contextual state for at least one of the one or more events by correlating the at least one event to an originating object, the contextual state including an indication of the originating object of the first object and an indication of at least one of a device on which the first object is executed and a user associated with the first object;
assemble an event line including details associated with the at least one event, the details including information uniquely identifying each of the first object, the action of the first object, the target, the originating object, and global perspective information comprising information about one or more related events to the one or more events across a network;
and
transmit the assembled event line utilizing the communication interface.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/270,069Filed 5 May 2014 · us provisional application
Priority: 3 May 2013
Published: US 2014/0331322 A16 Nov 2014
Granted: 21 Feb 2017
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection