Key management for compromised enterprise endpoints
US10063373B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Nov 23, 2016 |
| Grant date | Aug 28, 2018 |
| Priority date | — |
| Expiry date | Nov 23, 2036 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/2113
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.