System, method, and computer program product for dynamically adjusting a level of security applied to a system
View Patent ↗A system, method, and computer program product are provided for dynamically adjusting a level of security applied to a system. In use, predetermined activity that is at least potentially associated with unwanted activity is identified on a system. Further, a level of security applied to the system is dynamically adjusted, in response to the identification of the predetermined activity.
1. A non-transitory computer readable medium comprising instructions stored thereon to cause one or more processors to:
determine, by a device, an absence of a first activity that was previously identified on the device, wherein the first activity is predetermined to be associated with an increased vulnerability of the device to unwanted data, and wherein the absence is determined utilizing a first level of monitoring of the device;
dynamically adjust to a second level of monitoring of the device in response to the determination of the absence of the first activity, wherein the second level of monitoring of the device comprises monitoring for one or more fewer types of accesses performed by the first activity, the one or more fewer types of accesses representing a subset of types of accesses being monitored utilizing the first level of monitoring; and
dynamically adjust from a first level of scanning to a second level of scanning in response to the identification of the first activity, wherein the first level of scanning comprises scanning a first subset of a memory local to the device for the unwanted data and the second level of scanning comprises scanning a second subset of the memory local to the device for the unwanted data.
2. The non-transitory computer readable medium of claim 1 , wherein the unwanted data comprises malware.
3. The non-transitory computer readable medium of claim 1 , further comprising instructions to cause one or more processors to:
identify a suspect activity on the device that is predetermined to be associated with an increased vulnerability of the device to unwanted data, the suspect activity identified utilizing the second level of monitoring;
dynamically adjust to a third level of monitoring of the device in response to the identification of the suspect activity, wherein the third level of monitoring of the device comprises monitoring for one or more additional types of accesses performed by the suspect activity;
determine an absence of the suspect activity on the device, wherein the absence is determined utilizing the third level of monitoring of the device; and
dynamically adjust to the second level of monitoring of the device in response to the determination of the absence of the suspect activity.
4. The non-transitory computer readable medium of claim 3 , wherein the instructions to cause the one or more processors to identify the suspect activity comprise instructions to cause the one or more processors to identify a process connecting to an external network.
5. The non-transitory computer readable medium of claim 3 , wherein the instructions to cause the one or more processors to identify the suspect activity comprise instructions to cause the one or more processors to identify a loading of an executable excluded from a predefined list of known non-malicious executables.
6. The non-transitory computer readable medium of claim 3 , wherein the instructions to cause the one or more processors to identify the suspect activity comprise instructions to cause the one or more processors to identify an attempt to access a website excluded from a predefined list of known non-malicious websites.
7. The non-transitory computer readable medium of claim 3 , wherein the instructions to cause the one or more processors to identify the suspect activity comprise instructions to cause the one or more processors to identify a change of privileges by a process.
8. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause the one or more processors to utilize at least one of the first level of monitoring and the second level of monitoring comprise instructions to cause the one or more processors to monitor input and output operations of the device utilizing filter drivers.
9. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause the one or more processors to utilize at least one of the first level of monitoring and the second level of monitoring comprise instructions to cause the one or more processors to implement host environment callbacks functions.
10. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause the one or more processors to utilize at least one of the first level of monitoring and the second level of monitoring comprise instructions to cause the one or more processors to redirect an interface invocation to a monitoring callback function utilizing a hook.
11. The non-transitory computer readable medium of claim 3 , wherein the instructions to cause the one or more processors to utilize the second level of scanning comprise instructions to cause the one or more processors to scan at least a portion of data associated with the suspect activity for the unwanted data.
12. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause the one or more processors to dynamically adjust to the second level of monitoring comprise instructions to cause the one or more processors to adjust to the second level of monitoring based on a behavioral analysis of the first activity and a history of collected events of a predetermined type.
13. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause the one or more processors to utilize the first level of monitoring comprise instructions to cause the one or more processors to utilize a base level of monitoring.
14. The non-transitory computer readable medium of claim 1 , wherein the second subset of the memory is smaller than the first subset of the memory.
15. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause the one or more processors to utilize the first level of scanning and the second level of scanning comprise instructions to cause the one or more processors to scan for malware.
16. The non-transitory computer readable medium of claim 3 , wherein the instructions to cause the one or more processors to identify the suspect activity comprise instructions to cause the one or more processors to identify a change of privileges by a process.
17. A method, comprising:
determining, with a processor of a device, an absence of a first activity that was previously identified on the device, wherein the first activity is predetermined to be associated with an increased vulnerability of the device to unwanted data, and wherein the absence is determined utilizing a first level of monitoring of the device;
dynamically adjusting, with the processor, to a second level of monitoring of the device in response to the determination of the absence of the first activity, wherein the second level of monitoring of the device comprises monitoring for one or more fewer types of accesses performed by the first activity, the one or more fewer types of accesses representing a subset of types of accesses being monitored utilizing the first level of monitoring; and
dynamically adjusting, with the processor, from a first level of scanning to a second level of scanning in response to the identification of the first activity, wherein the first level of scanning comprises scanning a first subset of a memory local to the device for the unwanted data and the second level of scanning comprises scanning a second subset of the memory local to the device for the unwanted data.
18. The method of claim 17 , further comprising:
identifying a suspect activity on the device that is predetermined to be associated with an increased vulnerability of the device to unwanted data, the suspect activity identified utilizing the second level of monitoring;
dynamically adjusting to a third level of monitoring of the device in response to the identification of the suspect activity, wherein the third level of monitoring of the device comprises monitoring for one or more additional types of accesses performed by the suspect activity;
determining an absence of the suspect activity on the device, wherein the absence is determined utilizing the third level of monitoring of the device; and
dynamically adjusting to the second level of monitoring of the device in response to the determination of the absence of the suspect activity.
19. The method of claim 18 , wherein the act of identifying the suspect activity that is predetermined to be associated with an increased vulnerability of the device to unwanted data comprises the act of identifying a process connecting to an external network.
20. A system, comprising:
a memory;
a network connection communicatively coupled to the memory and configured to receive data from a network;
a user interface adapter communicatively coupled to the memory and configured to receive input from a user; and
a processing device operatively communicatively coupled to the memory, the network connection and the user interface adapter, the processing device adapted to execute program code stored in the memory to:
determine an absence of a first activity that was previously identified on the system, wherein the first activity is predetermined to be associated with an increased vulnerability of the device to unwanted data, and wherein the absence is determined utilizing a first level of monitoring of the system;
dynamically adjust to a second level of monitoring of the system in response to the determination of the absence of the first activity, wherein the second level of monitoring of the system comprises monitoring for one or more fewer types of accesses performed by the first activity, the one or more fewer types of accesses representing a subset of types of accesses being monitored utilizing the first level of monitoring; and
dynamically adjust from a first level of scanning to a second level of scanning in response to the identification of the first activity, wherein the first level of scanning comprises scanning a first subset of the memory for the unwanted data and the second level of scanning comprises scanning a second subset of the memory for the unwanted data.
21. The system of claim 20 , wherein the second subset of the memory is smaller than the first subset of the memory.