Title: Malware analysis and recovery

Abstract

A system and method detects malware by processing notifications from an intrusion detection system and baseline snapshots from an image capture utility. The image capture utility constructs an image of the suspected malware intrusion and links the suspected malware intrusion to the baseline snapshots. The system and method propagates the image of the suspected malware intrusion across multiple networks before it distinguishes malicious code, device state, and files from benign code, device state, and files. Some systems and methods include a malware recovery system that executes machine learning instructions and heuristics to revert a client and/or a remote server to one or more baseline snapshots.

Inventors:

Smith, Jared M.

Issue Date:

2021-02-23

Research Org.:

Oak Ridge National Laboratory (ORNL), Oak Ridge, TN (United States)

Sponsoring Org.:

USDOE

OSTI Identifier:

1805551

Patent Number(s):

10931685

Application Number:

15/837,942

Assignee:

UT-Battelle, LLC (Oak Ridge, TN)

Patent Classifications (CPCs):

G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING

G - PHYSICS G06 - COMPUTING G06N - COMPUTER SYSTEMS BASED ON SPECIFIC COMPUTATIONAL MODELS

Show more

G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING

G06F21/55 - Detecting local intrusion or implementing counter-measures
G06F21/56 - Computer malware detection or handling, e.g. anti-virus arrangements

G - PHYSICS G06 - COMPUTING G06N - COMPUTER SYSTEMS BASED ON SPECIFIC COMPUTATIONAL MODELS

G06N20/00 - Machine learning

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

H04L63/1408 - {by monitoring network traffic
H04L63/1416 - {Event detection, e.g. attack signature detection}
H04L63/1425 - {Traffic logging, e.g. anomaly detection}
H04L63/145 - {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}

Show less

DOE Contract Number:  

AC05-00OR22725

Resource Type:

Patent

Resource Relation:

Patent File Date: 12/11/2017

Country of Publication:

United States

Language:

English