Back to results
US 9,961,091 B2Granted
Apparatus and method for characterizing the risk of a user contracting malicious software
AssigneeSymantec Corporation
InventorsJoseph H. Levy, Matthew S. Wood
Life of this patent
Estimating the term…
Abstract
A non-transitory computer readable storage medium includes executable instructions to identify specified network interactions initiated by a client machine. The specified network interactions are compared to normative values to produce a promiscuity score indicative of the risk of the client machine contracting malicious software. Depending upon the promiscuity score, prophylactic actions are optionally applied to the client machine.
Claims17
A server comprising:
- a hardware processor;
- and
- a memory storing instructions that are configured, when executed by the hardware processor, to cause the hardware processor to:
- identify specified network interactions including a client machine initiating connections to network endpoints;
- and
- evaluate a statistical deviation of the specified network interactions relative to a normative value for the client machine to produce a promiscuity score indicative of a risk of the client machine contracting malicious software, wherein the specified network interactions include:
- a count of the network endpoints accessed during a specified time period;
- countries associated with the network endpoints and risks associated with the countries;
- Uniform Resource Locators (URLs) of the network endpoints and a length and character distribution structure of each URL;
- combinations, sequences, or distributions of characters of a domain name in a domain name system query and the number of IP addresses the domain name system query resolves to;
- executable file transfers between the client machine and the network endpoints and file characteristics associated with the executable files transferred;
- and
- encrypted SSL and TLS session characteristics including one or more of a common name of an SSL/TLS certificate, a certificate authority, and a public key length.
10 more elements
A method comprising:
- identifying, by a computer, specified network interactions including a client machine initiating connections to network endpoints;
- and
- evaluating, by the computer, a statistical deviation of the specified network interactions relative to a normative value for the client machine to produce a promiscuity score indicative of a risk of the client machine contracting malicious software, wherein the specified network interactions include:
- a count of the network endpoints accessed during a specified time period;
- countries associated with the network endpoints and risks associated with the countries;
- Uniform Resource Locators (URLs) of the network endpoints and a length and character distribution structure of each URL;
- combinations, sequences, or distributions of characters of a domain name in a domain name system query and the number of IP addresses the domain name system query resolves to;
- executable file transfers between the client machine and the network endpoints and file characteristics associated with the executable files transferred;
- and
- encrypted SSL and TLS session characteristics including one or more of a common name of an SSL/TLS certificate, a certificate authority, and a public key length.
7 more elements
A non-transitory computer readable storage medium, comprising executable instructions operable, when executed on a hardware processor, to:
- identify specified network interactions including a client machine initiating connections to network endpoints;
- and
- evaluate a statistical deviation of the specified network interactions relative to a normative value for the client machine to produce a promiscuity score indicative of a risk of the client machine contracting malicious software, wherein the specified network interactions include:
- a count of the network endpoints accessed during a specified time period;
- countries associated with the network endpoints and risks associated with the countries;
- Uniform Resource Locators (URLs) of the network endpoints and a length and character distribution structure of each URL;
- combinations, sequences, or distributions of characters of a domain name in a domain name system query and the number of IP addresses the domain name system query resolves to;
- executable file transfers between the client machine and the network endpoints and file characteristics associated with the executable files transferred;
- and
- encrypted SSL and TLS session characteristics including one or more of a common name of an SSL/TLS certificate, a certificate authority, and a public key length.
7 more elements
Dependencies are inferred from the claim text.