Labeling objects on an endpoint for encryption management
US9965627B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Sep 14, 2014 |
| Grant date | May 8, 2018 |
| Priority date | — |
| Expiry date | Nov 18, 2035 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/06
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.