IP Library › Granted Patent US 11,379,582

Granted Patent B2

US 11,379,582 · App. 17/011,398 · Granted Jul 5, 2022

Methods and apparatus for malware threat research

Inventors: Melvyn Morris (Turnditch, GB); Paul Stubbs (Wyboston, GB); Markus Hartwig (Milton Keynes, GB); Darren Harter (Hucclecote, GB)

Assignee: Webroot Inc.

G06F21/56 G06F21/577

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 11,379,582
App. No.: 17/011,398
Granted: Jul 5, 2022
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

In one aspect, a method of classifying a computer object as malware includes receiving at a base computer data about a computer object from each of plural remote computers on which the object or similar objects are stored. The data about the computer object received from the plural computers is compared in the base computer. The computer object is classified as malware on the basis of said comparison. In one embodiment, the data about the computer object includes one or more of: executable instructions contained within or constituted by the object; the size of the object; the name of the object; the logical storage location or path of the object on the respective remote computers; the vendor of the object; the software product and version associated with the object; and, events initiated by or involving the object when the object is created, configured or runs on the respective remote computers.

Claims (61)

1. A method for monitoring execution of a process for unsafe behavior, comprising:

upon execution of a process, at a monitor agent, searching a database for a pre-authorization of the process;

when the pre-authorization for the process is found in the database,

executing the process and, at the monitor agent, monitoring the execution of the process to determine whether the process is executing within an expected behavior of a mask for the process;

if the process is determined not to be executing with the expected behavior of the mask for the process, issuing an alert; and

if the process is determined to be executing within the expected behavior of the mask for the process, continuing execution of the process and continuing to monitor the process for the expected behavior of the mask for the process; and

when the pre-authorization for the process is not found in the database,

executing the process and, at the monitor agent, monitoring the execution of the process;

based on said monitoring of the execution of the process, generating a mask for the process;

wherein the database is one of a local database stored on a machine or a shared database stored on a central server for saving information for a plurality of processes and accessed by a plurality of monitor agents executing on client machines, and when the pre-authorization for the process is not found in the database and as result of said monitoring of the execution of the process, generating the mask comprises:

determining that the process is not executing within the expected behavior of the mask for the process when a behavior of the process comprises unsafe behavior comprising ill effects or results in a computing environment, attempting to connect to a known unsafe website or database, or taking an action that is known to be unsafe;

modifying the mask to include information associated with the unsafe behavior; and

storing the modified mask in the community database for the process, thereby enabling monitor agents to access the mask when executing the process.

2. The method of claim 1 , wherein the database is one of: a local database stored on a machine that also executes the process, or a community database stored on a central server for saving information for a plurality of processes, the plurality of processes executing on a plurality of client machines executing a plurality of monitor agents, the process information comprising a pre-authorization flag for each process and a mask for each process.

3. The method of claim 1 , wherein the pre-authorization for the process is received from a trusted authority comprising an anti-malware company, an authorization organization, or a governmental department.

4. The method of claim 1 , wherein when the pre-authorization for the process is found in the database and as result of said monitoring of the execution of the process, the process is determined not to be executing within the expected behavior of the mask for the process when a behavior of the process comprises unsafe behavior comprising ill effects or results in a computing environment, attempting to connect to a known unsafe website or database, or taking an action that is known to be unsafe.

5. The method of claim 4 , wherein the issuing the alert comprises terminating the process or contacting a trusted authority that issued the pre-authorization for the process to confirm that the unsafe behavior is unsafe.

6. The method of claim 1 , wherein the database is a community database stored on a central server and accessed by a plurality of monitor agents executing on client machines, and generating the mask comprises:

comparing the behavior of the execution of the process to known behaviors and modifying the mask based on Previously Presented behaviors; and

storing the modified mask in the community database, thereby enabling monitor agents to access the mask when executing the process.

7. A system for monitoring execution of a process for unsafe behavior, comprising:

a processor;

memory coupled to the processor, the memory comprising computer executable instructions that, when executed by the processor, perform a method for monitoring execution of a process for unsafe behavior; comprising:

upon execution of a process, at a monitor agent, searching a database for a pre-authorization of the process;

when the pre-authorization for the process is found in the database,

executing the process and, at the monitor agent, monitoring the execution of the process to determine whether the process is executing within an expected behavior of a mask for the process;

if the process is determined not to be executing with the expected behavior of the mask for the process, issuing an alert; and

when the pre-authorization for the process is not found in the database,

executing the process and, at the monitor agent, monitoring the execution of the process; and

based on said monitoring of the execution of the process, generating a mask for the process;

modifying the mask to include information associated with the unsafe behavior; and

storing the modified mask in the community database for the process, thereby enabling monitor agents to access the mask when executing the process.

8. The system of claim 7 , wherein the database is one of: a local database stored on a machine that also executes the process, or a community database stored on a central server for saving information for a plurality of processes, the plurality of processes executing on a plurality of client machines executing a plurality of monitor agents, the process information comprising a pre-authorization flag for each process and a mask for each process.

9. The system of claim 7 , wherein the pre-authorization for the process is received from a trusted authority comprising an anti-malware company, an authorization organization, or a governmental department.

10. The system of claim 7 , wherein when the pre-authorization for the process is found in the database and as result of said monitoring of the execution of the process, the process is determined not to be executing within the expected behavior of the mask for the process when a behavior of the process comprises unsafe behavior comprising ill effects or results in a computing environment, attempting to connect to a known unsafe website or database, or taking an action that is known to be unsafe.

11. The system of claim 10 , wherein the issuing the alert comprises terminating the process or contacting a trusted authority that issued the pre-authorization for the process to confirm that the unsafe behavior is unsafe.

12. The system of claim 7 , wherein the database is a community database stored on a central server and accessed by a plurality of monitor agents executing on client machines, and generating the mask comprises:

comparing the behavior of the execution of the process to known behaviors and modifying the mask based on Previously Presented behaviors; and

storing the modified mask in the community database, thereby enabling monitor agents to access the mask when executing the process.

13. A computer program product comprising a non-transitory computer readable medium storing instructions executable by a processor to perform a set of operations for monitoring execution of a process for unsafe behavior, the set of operations comprising: