Granted Patent B2

US 11,301,569 · App. 16/296,039 · Granted Apr 12, 2022

Inventors: Timothy Micheal Wyatt (Toronto, CA); William Neil Robinson (Sunnyvale, CA); Brian James Buck (Livermore, CA); Alex Richard Gladd (Crofton, MD)

Assignee: Lookout, Inc.

G06F21/577G06F8/61G06F21/554G06F21/566G06F2221/033

Abstract

Claims (55)

1. A method, comprising:

analyzing software to determine whether a security threat is associated with the software;

in response to determining that a security threat is not associated with the software, causing, by a first computing device, installation of the software on a second computing device;

after installation of the software on the second computing device, receiving, by the first computing device, first data from a third computing device;

analyzing, by the first computing device and using a data repository, the first data to provide a security assessment, the data repository comprising component data pertaining to components of the software, the component data comprising behavioral characteristics and structural characteristics associated with the components, the analyzing comprising:

determining that a new component in the software corresponds to a known component in the data repository; and

comparing at least one behavior characteristic of the new component with at least one known behavior characteristic of the known component;

determining, based on the security assessment, a first security threat associated with the software; and

in response to determining the first security threat, causing sending of a message to the second computing device, the message causing the second computing device to perform an action.

2. The method of claim 1 , wherein the action is implementing a quarantine of the software.

3. The method of claim 1 , wherein the action is at least one of deleting the software, uninstalling the software, preventing the software from launching, or changing a permission associated with the software.

4. The method of claim 1 , wherein the action is displaying an alert to a user of the second computing device, the alert requesting that the user perform at least one of disabling the software, or changing a permission on the second computing device.

5. The method of claim 1 , further comprising sending a message to a computing device of an administrator for the second computing device, the message indicating the first security threat.

6. The method of claim 5 , further comprising providing a recommended response for a user of the second computing device, wherein the computing device of the administrator automatically quarantines the software on the second computing device in response to determining that the user has not performed the recommended response.

7. The method of claim 1 , wherein the message to the second computing device includes at least one of an identifier of a source of the first security threat, an assessment of the first security threat, a context for the first security threat, or a recommended response.

8. The method of claim 1 , wherein a proxy resides on the second computing device, and the action comprises executing the proxy to prevent the software from transferring data to or from the second computing device.

9. The method of claim 8 , further comprising identifying at least one of a source or destination associated with the software, wherein executing the proxy comprises blocking data transfer from the source or to the destination.

10. The method of claim 9 , wherein the proxy is coupled to a physical network interface of the second computing device, and the proxy inspects all incoming or outgoing network packets passing through the physical network interface to identify those packets associated with the source or destination.

11. The method of claim 10 , wherein an operating system of the second computing device provides an application programming interface (API), and the proxy uses the API to inspect the incoming or outgoing network packets.

12. The method of claim 9 , wherein the proxy permits network traffic, other than that associated with the source or the destination, to be exchanged with applications, other than the software, that are installed on the second computing device.

13. The method of claim 1 , further comprising, in response to determining the first security threat:

determining a source of the software;

determining other software obtained from the source; and

analyzing the other software to determine a security threat associated with the other software;

wherein the action is implementing a quarantine of the other software.

14. The method of claim 1 , wherein the software has a package name, the method further comprising:

determining a domain of a source of the software;

sending a query to a fourth computing device associated with the domain, the query requesting verification of the package name; and

receiving, from the fourth computing device in response to the query, an indication that the package name is not valid;

wherein the action comprises implementing a quarantine of the software.

15. The method of claim 14 , wherein the software is signed with a private key, a public key is associated with the private key as part of a key pair, and the query includes the public key.

16. The method of claim 1 , further comprising, in response to determining the first security threat:

determining, using the data repository, a respective risk level associated with each of a plurality of devices, the software having been installed on each of the plurality of devices prior to receiving the first data; and

in response to determining the respective risk level, sending a message to each corresponding device, the message causing the device to perform the action corresponding to the respective risk level.

17. A system, comprising:

at least one processor; and

memory storing instructions configured to instruct the at least one processor to:

after installation of software on a first computing device, receive first data from a second computing device;

analyze, using a data repository, the first data to provide a security assessment, the data repository comprising component data pertaining to components of the software, the component data comprising behavioral characteristics and structural characteristics associated with the components, the analyzing comprising:

determining that a new component in the software corresponds to a known component in the data repository; and

comparing at least one behavior characteristic of the new component with at least one known behavior characteristic of the known component;

determine, based on the security assessment, a first security threat associated with the software; and

in response to determining the first security threat, cause the first computing device to perform an action.

18. The system of claim 17 , wherein a proxy resides on the first computing device, and the action comprises executing the proxy to block network traffic for at least one of a network source or network destination associated with the software.

19. A non-transitory computer-readable storage medium storing computer-readable instructions, which when executed, cause a computing device at least to:

after installation of software on a first computing device, receive first data from a second computing device;

analyze, using a data repository, the first data to provide a security assessment, the data repository comprising component data pertaining to components of the software, the component data comprising behavioral characteristics and structural characteristics associated with the components, the analyzing comprising:

determining that a new component in the software corresponds to a known component in the data repository; and

comparing at least one behavior characteristic of the new component with at least one known behavior characteristic of the known component;

determine, based on the security assessment, a first security threat associated with the software;

in response to determining the first security threat, determine a source of the software;

determine other software obtained from the source;

analyze the other software to determine a second security threat associated with the other software; and

in response to determining the second security threat, cause the first computing device to perform an action.

20. The non-transitory computer-readable storage medium of claim 19 , wherein the action is implementing a quarantine of the other software on the first computing device.

Assignments (8)