Systems and methods for automatically generating malware countermeasures
US11914711B2 · kind B2 · utility
Assignee
Inventor
Key dates
| Filing date | Jul 30, 2020 |
| Grant date | Feb 27, 2024 |
| Priority date | — |
| Expiry date | May 4, 2041 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/034
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
Malware can be automatically detected and countermeasures automatically generated. A virtual machine (VM) is run with an operating system configured with a monitoring subsystem. The monitoring subsystem is configured to generate event data based on events occurring on the virtual machine. The monitoring subsystem can run within the operating system kernel. Kernel drivers can register to receive specific events. The events are therefore sent to the drivers, which can send them to a classifier. The classifier can detect malware based on the events. When a sample is run on the VM, the classifier can detect malware in the sample. While running the sample, event data is collected. A countermeasure compiler can generate a countermeasure to the malware, the countermeasure based on the event data.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.