Forensic analysis on consistent system footprints
US12242606B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Mar 29, 2022 |
| Grant date | Mar 4, 2025 |
| Priority date | — |
| Expiry date | Dec 5, 2042 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/033
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
Forensic analysis on consistent system footprints relates to a system and method for rootkit detection based on forensic analysis performed on consistent system footprints, such as application events, application network communications and application files. The system includes a security system periodically monitoring one or more applications of a computing system. The security system includes a threat detection unit for collecting and storing system memory dumps, a machine learning module trained on clean and infectious memory dump, a similarity scanner to identify similarity between suspicious memory block and consistent system footprints, and a forensic analyzer to perform forensic analysis and detect infection, if any, based on the similarity found. The suspicious memory block is identified by the threat detection unit based on the analysis performed by the machine learning model. Upon rootkit detection an alert and forensic analysis report are generated.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.