IP Library Granted Patent US 9,848,010
Granted Patent B2
US 9,848,010 · App. 14/950,022 · Granted Dec 19, 2017

Identifying and remediating malware-compromised devices

Inventors: Anne L. Bolgert (Austin, TX); Richard J. Cohen (Austin, TX); Miguel Sang (Austin, TX); Krishna K. Yellepeddy (Austin, TX)
Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION
H04L63/1433H04L63/145H04L63/1416H04L63/1425
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,848,010
App. No.
14/950,022
Granted
Dec 19, 2017
Kind
B2
Abstract

Systems and methods for identifying and remediating malware-compromised mobile devices are disclosed. A computer-implemented method includes accessing, by a computing device, malware risk data; determining, by the computing device, a mobile device is at risk from malware based on the malware risk data; identifying, by the computing device, a set of connections of a user of the mobile device, wherein each connection in the set of connections is associated with a user computer device; identifying, by the computing device, at least one user computer device from the set of connections at risk from the malware; and outputting, by the computer device, a malware notification for the mobile device at risk and at least one user computer device at risk.

Claims (66)

1. A computer-implemented method, comprising:

accessing, by a computing device, malware risk data;

determining, by the computing device, a mobile device is at risk from malware based on the malware risk data;

identifying, by the computing device, a set of connections of a user of the mobile device, wherein each connection in the set of connections is associated with a user computer device;

identifying, by the computing device, at least one user computer device from the set of connections at risk from the malware;

outputting, by the computing device, a malware notification for the mobile device at risk and the at least one user computer device at risk;

ranking the set of connections of the user of the mobile device using a set of weighted parameters; and

identifying a subset of the set of connections having a risk level greater than or equal to a predetermined risk level based on the ranking.

2. The method of claim 1 , wherein the determining the mobile device is at risk from malware includes:

receiving information from the mobile device during login;

retrieving mobile device user data; and

identifying that the mobile device is at risk from malware based on the mobile device user data.

3. The method of claim 1 , wherein the determining the mobile device is at risk from malware includes:

accessing information regarding the mobile device stored in a user database or directly from the mobile device;

determining, based on the information, that the mobile device is utilizing an application identified as being at risk from malware.

4. The method of claim 1 , wherein the malware risk data comprises anti-virus software.

5. The method of claim 1 , wherein the parameters comprise at least one of:

the riskiness of an application used by a connection, wherein the riskiness of the application is positively correlated with a security risk;

the reputation of one or more social media applications being used by the connection; and

detected anomalies in activities within a social media network of the user of the mobile device.

6. The method of claim 1 , wherein the risk level is based on the riskiness of at least one computer device of the user of the mobile device and the mobile device, wherein the riskiness is positively correlated with a security risk.

7. The method of claim 1 , further comprising sending the malware notification to the mobile device at risk and the at least one user computer device at risk through a network connection.

8. The method of claim 1 , wherein the malware notification includes remediation instructions.

9. The method of claim 1 , wherein the connections are social media connections.

10. The method of claim 1 , wherein the connections are inter-enterprise connections.

11. A computer program product for identifying malware-compromised mobile devices, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computing device to cause the computing device to:

access, by the computing device, malware risk data via a network connection;

determine, by the computing device, a mobile device is at risk from malware based on the malware risk data;

identify, by the computing device, a set of connections of a user of the mobile device;

identify, by the computing device, at least one other user from the set of connections at risk from the malware;

issue, by the computing device through a network connection, a notification of malware risk to the user of the mobile device and the at least one other user from the set of connections at risk from malware;

rank the set of connections using a set of weighted parameters; and

identify a subset of the set of connections having a risk level greater or equal to a predetermined risk level based on the ranking.

12. The computer program product of claim 11 , wherein the program instructions further cause the computing device to:

receive information from the mobile device during login; and

retrieve mobile device user data; and

identify that the mobile device is at risk from malware based on the mobile device user data.

13. The computer program product of claim 11 , wherein the program instructions further cause the computing device to:

access information regarding the mobile device stored in a user database;

determine, based on the information, that the mobile device is utilizing an application identified as being at risk from malware.

14. The computer program product of claim 11 , wherein the malware risk data comprises anti-virus software.

15. The computer program product of claim 11 , wherein the parameters comprise at least one of:

the riskiness of an application used by a connection, wherein the riskiness of the application is positively correlated with a security risk;

the reputation of one or more social media applications being used by the connection;

detected anomalies in activities within a social media network of the user of the mobile device; and

a level of current, known vulnerabilities for the mobile device and a device of the at least one other user.

16. The computer program product of claim 11 , wherein the risk level is based on the riskiness of at least one computer device of the user of the mobile device and the mobile device, wherein the riskiness is positively correlated with a security risk.

17. The computer program product of claim 11 , wherein issuing the notification of malware risk comprises emailing the notification.

18. The computer program product of claim 17 , wherein the notification includes remediation instructions.

19. The computer program product of claim 11 , wherein the connections are social media connections.

20. The computer program product of claim 11 , wherein the connections are inter-enterprise connections.

21. A system for identifying malware-compromised personal computing devices comprising:

a CPU, a computer readable memory and a computer readable storage medium associated with a computing device;

program instructions to access malware risk data;

program instructions to determine a personal computing device is at risk from malware based on the malware risk data;

program instructions to identify a set of connections of a user of the personal computing device, wherein each connection in the set of connections is associated with a user device;

program instructions to identify at least one user device from the set of connections at risk from the malware; and

program instructions to implement malware remediation steps to remove the malware from the personal computing device at risk from malware;

program instructions to rank the set of connections using a set of weighted parameters;

program instructions to identify a subset of the set of connections having a risk level greater or equal to a predetermined risk level based on the ranking; and

program instructions to implement malware remediation steps to remove malware from user devices associated with each of the connections of the subset,

wherein the program instructions are stored on the computer readable storage medium for execution by the CPU via the computer readable memory.

22. The system of claim 21 , wherein the parameters comprise at least one of:

the riskiness of an application used by a connection, wherein the riskiness of the application is positively correlated with a security risk;

the reputation of one or more social media applications being used by the connection; and

detected anomalies in activities within a social media network of the user of the personal computing device.

Assignments (2)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 13, 2021
From: INTERNATIONAL BUSINESS MACHINES CORPORATION
To: KYNDRYL, INC.
Reel/Frame 057885/0644 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Nov 24, 2015
From: BOLGERT, ANNE L.; COHEN, RICHARD J.; SANG, MIGUEL; YELLEPEDDY, KRISHNA K.
To: INTERNATIONAL BUSINESS MACHINES CORPORATION
Reel/Frame 037128/0588 →
Continuity (1)
Related Publication 20170149815A1 · May 25, 2017