Segregating executable files exhibiting network activity
US10599846B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Aug 23, 2018 |
| Grant date | Mar 24, 2020 |
| Priority date | — |
| Expiry date | Aug 23, 2038 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/034
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
Systems, computer readable media, apparatuses, and methods are disclosed for segregating executable files exhibiting network activity. An example apparatus includes at least one processor and memory including instructions which, when executed, cause the at least one processor to launch an executable file in a segmented portion of a computing system to load one or more dynamically linked libraries (DLLs) associated with the executable file into a process environment block (PEB) of the segmented portion, enumerate the PEB to generate an address list of the one or more DLLs, scan the one or more DLLs to determine whether the one or more DLLs are to perform network activity, and perform malware analysis on the executable file when at least one of the one or more DLLs are to perform network activity.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.