USOO9104864B2

(12) United States Patent (10) Patent No.: US 9,104,864 B2

Penton et al. (45) Date of Patent: Aug. 11, 2015
(54) THREAT DETECTION THROUGH THE (56) References Cited
ACCUMULATED DETECTION OF THREAT
CHARACTERISTICS U.S. PATENT DOCUMENTS
6,973,577 B1 12/2005 Kouznetsov
(71) Applicant: Sophos Limited, Abingdon Oxfordshire 8,201,257 B1 * 6/2012 Andres et al. ................... 726/25
2004/0243829 A1 12/2004 Jordan
(GB) 2010, 0169973 A1 7/2010 Kim et al.
2011/0173699 A1* 7/2011 Figlin et al. ..................... T26/23
(72) Inventors: Clifford Penton, Abingdon (GB); Irene 2012/0030767 A1* 2/2012 Rippert et al. .................. 726/25
2012/0192279 A1* 7, 2012 Muttik et al. ................... T26/24
Michlin, Bucks (GB)
FOREIGN PATENT DOCUMENTS
(73) Assignee: Sophos Limited, Abingdon Oxfordshire
(GB) EP 1708114 10, 2006
OTHER PUBLICATIONS
(*) Notice: Subject to any disclaimer, the term of this
patent is extended or adjusted under 35 “UK Application No. 1303928.4, Search and Examination Report
U.S.C. 154(b) by 0 days. dated Sep. 30, 2013', 7 pages.
United Kingdom Patent Office, “UK Application No. 1303928.4.
Office Action dated May 8, 2015”. 4 pages.
(21) Appl. No.: 13/658,977
* cited by examiner
(22) Filed: Oct. 24, 2012 Primary Examiner — Harunur Rashid
(65) Prior Publication Data
Assistant Examiner — Angela Holmes
(74) Attorney, Agent, or Firm — Strategic Patents, P.C.
US 2014/O115703 A1 Apr. 24, 2014
(57) ABSTRACT
(51) Int. Cl. Embodiments of the present disclosure provide for improved
G06F2L/00 (2013.01) capabilities in the detection of malware, where malware
G06F 2/55 (2013.01) threats are detected through the accumulated identification of
GO6F 2 1/56 (2013.01) threat characteristics for targeted computer objects. Methods
HO4L 29/06 (2006.01)
and systems include dynamic threat detection providing a
GO6F 21/60 (2013.01)
first database that correlates a plurality of threat characteris
tics to a threat, wherein a presence of the plurality of the threat
(52) U.S. Cl. characteristics confirms a presence of the threat; detecting a
CPC ............ G06F2I/554 (2013.01); G06F2 1/563 change event in a computer run-time process; testing the
(2013.01); G06F 21/606 (2013.01); H04L 63/12 change event for a presence of one or more of the plurality of
(2013.01); H04L 63/1425 (2013.01) characteristics upon detection of the change event, storing a
(58) Field of Classification Search detection of one of the plurality of characteristics in a second
database that accumulates detected characteristics for the
CPC. H04L 63/1425; H04L 63/12: G06F 21/563: computer run-time process; and identifying the threat when
GO6F 21 F606
each one of the plurality of characteristics appears in the
USPC ................. 726/22–25; 709/223 225: 714/39; second database.
370/254, 252, 241
See application file for complete search history. 10 Claims, 3 Drawing Sheets

A METHOD OF DYNAMIC THREAT DETECTION ) r?

PROWINGAFIRST)AABASEAT CORRELATESA - 304

PLYRALIY or THREACHARACRISTICSOATHREAT,
WHereIMAPRESENCE or the PLYRALITY or the ThreAT
204 CHARACTERISTICS ConrSAPRESenicer The REAT

CCNPTING DETECING ACHANGEEWEN INACOMPUERRUN-TIME - 308

EiE PROCESS

ESING THE CHAMGE WENT FORAPRESENCE of ONE OR / 30

NOR F THE PLURALITY OF CHARACRISTICS FON
ECTION CHCHANGWEN

STORING ADETECTION OF ONE OF THE PLURALITY OF Ir'

CHARACERSTICS INASCON AABASE THAT
ACCUMULASECTE) CARACTERISTICSORTH
COMPUTERRUM-IME PROCSS
228 V
7 ? 34
THREAT NTIFYINETHREAT WHEN EA8HON OF TH
sis - PLURALITY OF CHARACTERISTICS
AABASE
APPEARS IN THE SECOND
U.S. Patent Aug. 11, 2015 Sheet 2 of 3 US 9,104,864 B2

ZOZ 2
U.S. Patent Aug. 11, 2015 Sheet 3 of 3 US 9,104,864 B2

Z09

//
 US 9,104,864 B2
1. 2
THREAT DETECTION THROUGH THE preferred embodiment and the drawings. All documents men
ACCUMULATED DETECTION OF THREAT tioned herein are hereby incorporated in their entirety by
CHARACTERISTICS reference.

BACKGROUND 5 BRIEF DESCRIPTION OF THE FIGURES

1. Field The invention and the following detailed description of

The present invention is related to malware threat detection certain embodiments thereofmay be understood by reference
in a computer system. to the following figures:
2. Description of the Related Art 10 FIG. 1 depicts a block diagram of a threat management
facility
Current methods and systems for the detection of malware ity of threats. providing protection to an enterprise against a plural
in a computer system (e.g. the detection Software viruses) FIG. 2 depicts a block diagram of a method and system for
generally employ signature-based detection through systems detection
that search the computer software for data patterns that have 15 istics. of threats through accumulation of threat character
previously been identified with malicious software. However, FIG. 3 depicts a flow diagram for detection of threats
since the number of known malicious data patterns can be through accumulation of threat characteristics.
very large, searching a computer system for all known mali While the invention has been described in connection with
cious data patterns can impair the computer's performance. certain preferred embodiments, other embodiments would be
Therefore there is need for methods and systems that are able 20 understood by one of ordinary skill in the art and are encom
to identify evidence of malware in a computer system without passed herein.
the need to search all possible malicious data patterns for all All documents referenced herein are hereby incorporated
possible threats each time a computer system is scanned for by reference.
malware.
25 DETAILED DESCRIPTION
SUMMARY
FIG. 1 depicts a block diagram of a threat management
This disclosure describes methods and systems for search facility providing protection to an enterprise against a plural
ing computer Software for malware through the accumulated ity of threats. An aspect of the present invention relates to
identification of threat characteristics for targeted computer 30 corporate policy management and implementation through a
objects (e.g. run-time processes) that allows for the dynamic unified threat management facility 100. As will be explained
detection of complex threats in a way that scales with the in more detail below, a threat management facility 100 may be
number of threat descriptions and the number of system used to protect computer assets from many threats, both com
objects tracked. puter-generated threats and user-generated threats. The threat
In embodiments, the present disclosure may provide a
35 management facility 100 may be multi-dimensional in that it
method of dynamic threat detection comprising a first data may be designed to protect corporate assets from a variety of
base that correlates a plurality of threat characteristics to a threats and it may be adapted to learn about threats in one
dimension (e.g. worm detection) and apply the knowledge in
threat, wherein a presence of the plurality of the threat char another dimension (e.g. spam detection). Policy management
acteristics confirms a presence of the threat; detecting a 4 is one of the dimensions for which the threat management
change event in a computer run-time process; testing the facility can provide a control capability. A corporation or
change event for a presence of one or more of the plurality of other entity may institute a policy that prevents certain people
characteristics upon detection of the change event; storing a (e.g. employees, groups of employees, types of employees,
detection of one of the plurality of characteristics in a second guest of the corporation, etc.) from accessing certain types of
database that accumulates detected characteristics for the 45 computer programs. For example, the corporation may elect
computer run-time process; and identifying the threat when to prevent its accounting department from using a particular
each one of the plurality of characteristics appears in the version of an instant messaging service orall Such services. In
second database. The threat may include a malware threat to this example, the policy management facility 112 may be
a computer facility, or any other like threat Such as listed used to update the policies of all corporate computing assets
herein. The threat may include a violation of an enterprise 50 with a proper policy control facility or it may update a select
security policy. The plurality of characteristics may include a few. By using the threat management facility 100 to facilitate
plurality of code functionality, a property of a program, and the setting, updating and control of Such policies the corpo
like. Such as referred to herein as genes. The run-time pro ration only needs to be concerned with keeping the threat
cess may include at least one of an access to a file, a process, 55 management facility 100 up to date on such policies. The
a mutual exclusion object, a registry key, and the like. The threat management facility 100 can take care of updating all
second database may accumulate detected characteristics for of the other corporate computing assets.
each of a plurality of computer run-time processes. The first It should be understood that the threat management facility
100 may provide multiple services, and policy management
database may correlate a different plurality of characteristics may be offered as one of the services. We will now turn to a
to each one of a plurality of different threats. The disclosure 60 description of certain capabilities and components of the
may provide for creating a new threat characteristic for inclu threat management system 100.
sion into the database when the detected change event is Over recent years, malware has become a major problem
identified as a threat by a threat identification facility but is not across the internet 154. From both technical and userperspec
currently in the database. tives, the categorization of a specific threat type, whether as
These and other systems, methods, objects, features, and 65 virus, worm, spam, phishing exploration, spyware, adware, or
advantages of the present invention will be apparent to those the like, is becoming reduced in significance. The threat, no
skilled in the art from the following detailed description of the matter how it is categorized, may need to be stopped at Vari
 US 9,104,864 B2
3 4
ous points of a networked computing environment, Such as ary location threats 108, and the like. Clients 144 may be
one of an enterprise facility 102, including at one or more protected from threats even when the client 144 is not located
laptops, desktops, servers, gateways, communication ports, in association with the enterprise 102, such as when a client
handheld or mobile devices, firewalls, and the like. Similarly, 144E-F moves in and out of the enterprise 102 such as inter
there may be less and less benefit to the user in having differ facing with an unprotected server 142C through the Internet
ent solutions for known and unknown threats. As such, a 154, when a client 144F is moving into a secondary location
consolidated threat management facility 100 may need to threat 108 such as interfacing with components 136B, 142B,
apply a similar set of technologies and capabilities for all 148C, 148D that are not protected, and the like. In embodi
threats. In certain embodiments, the threat management facil ments, the threat management facility 100 may provide an
ity 100 may provide a single agent on the desktop, and a single 10 enterprise facility 102 protection from a plurality of threats to
scan of any Suspect file. This approach may eliminate the multiplatform computer resources in a plurality of locations
inevitable overlaps and gaps in protection caused by treating and network configurations, with an integrated system
viruses and spyware as separate problems, while simulta approach.
neously simplifying administration and minimizing desktop In embodiments, the threat management facility 100 may
load. As the number and range of types of threats has 15 be provided as a stand-alone solution. In other embodiments,
increased, so may have the level of connectivity available to the threat management facility 100 may be integrated into a
all IT users. This may have lead to a rapid increase in the third-party product. An application programming interface
speed at which threats may move. Today, an unprotected PC (e.g. a source code interface) may be provided Such that the
connected to the internet 154 may be infected quickly (per threat management facility 100 may be integrated. For
haps within 10 minutes) which may require acceleration for instance, the threat management facility 100 may be stand
the delivery of threat protection. Where once monthly updates alone in that it provides direct threat protection to an enter
may have been sufficient, the threat management facility 100 prise or computer resource, where protection is Subscribed to
may automatically and seamlessly update its product set directly 100. Alternatively, the threat management facility
against spam and virus threats quickly, for instance, every five may offer protection indirectly, through a third-party product,
minutes, every minute, continuously, or the like. Analysis and 25 where an enterprise may subscribe to services through the
testing may be increasingly automated, and also may be per third-party product, and threat protection to the enterprise
formed more frequently; for instance, it may be completed in may be provided by the threat management facility 100
15 minutes, and may do so without compromising quality. through the third-party product.
The threat management facility 100 may also extend tech The security management facility 122 may include a plu
niques that may have been developed for virus and malware 30 rality of elements that provide protection from malware to
protection, and provide them to enterprise facility 102 net enterprise facility 102 computer resources, including end
work administrators to better control their environments. In point security and control, email security and control, web
addition to stopping malicious code, the threat management security and control, reputation-based filtering, control of
facility 100 may provide policy management that may be able unauthorized users, control of guest and non-compliant com
to control legitimate applications, such as VoIP, instant mes 35 puters, and the like. The security management facility 122
saging, peer-to-peer file-sharing, and the like, that may under may be a Software application that may provide malicious
mine productivity and network performance within the enter code and malicious application protection to a client facility
prise facility 102. 144 computing resource. The security management facility
The threat management facility 100 may provide an enter 122 may have the ability to scan the client facility 144 files for
prise facility 102 protection from computer-based malware, 40 malicious code, remove or quarantine certain applications
including viruses, spyware, adware, Trojans, intrusion, spam, and files, prevent certain actions, perform remedial actions
policy abuse, uncontrolled access, and the like, where the and perform other security measures. In embodiments, scan
enterprise facility 102 may be any entity with a networked ning the client facility 144 may include Scanning some or all
computer-based infrastructure. In an embodiment, FIG. 1 of the files stored to the client facility 144 on a periodic basis,
may depict a block diagram of the threat management facility 45 may scan applications once the application has been
100 providing protection to an enterprise againstaplurality of requested to execute, may scan files as the files are transmitted
threats. The enterprise facility 102 may be corporate, com to or from the client facility 144, or the like. The scanning of
mercial, educational, governmental, or the like, and the enter the applications and files may be to detect known malicious
prise facility's 102 computer network may be distributed code or known unwanted applications. In an embodiment,
amongst a plurality of facilities, and in a plurality of geo 50 new malicious code and unwanted applications may be con
graphical locations, and may include administration 134, a tinually developed and distributed, and updates to the known
firewall 138A, an appliance 140A, server 142A, network code database may be provided on a periodic basis, on a
devices 148A-B, clients 144A-D, such as protected by com demand basis, on an alert basis, or the like.
puter security facilities 152, and the like. The threat manage In an embodiment, the security management facility 122
ment facility 100 may include a plurality of functions, such as 55 may provide for email security and control, where security
security management facility 122, policy management facil management may help to eliminate spam, viruses, spyware
ity 112, update facility 120, definitions facility 114, network and phishing, control of email content, and the like. The
access rules facility 124, remedial action facility 128, detec security management facility’s 122 email security and con
tion techniques facility 130, testing facility 118, threat trol may protect against inbound and outbound threats, pro
research facility 132, and the like. In embodiments, the threat 60 tect email infrastructure, prevent data leakage, provide spam
protection provided by the threat management facility 100 filtering, and the like. In an embodiment, security manage
may extend beyond the network boundaries of the enterprise ment facility 122 may provide for web security and control,
facility 102 to include client facilities 144D that have moved where security management may help to detect or block
into network connectivity not directly associated or con viruses, spyware, malware, unwanted applications, help con
trolled by the enterprise facility 102. Threats to client facili 65 trol web browsing, and the like, which may provide compre
ties 144 may come from a plurality of Sources, such as from hensive web access control enabling safe, productive web
network threats 104, physical proximity threats 110, second browsing. Web security and control may provide internet use
 US 9,104,864 B2
5 6
policies, reporting on Suspect devices, security and content tions to enterprise facility 102 networks, distribution of mali
filtering, active monitoring of network traffic, URI filtering, cious code descriptions to client facilities 144, or the like. In
and the like. In an embodiment, the security management an embodiment, the management of malicious code informa
facility 122 may provide for network access control, which tion may be provided to the enterprise facility's 102 network,
may provide control over network connections. Network con where the enterprise facility’s 102 network may provide the
trol may stop unauthorized, guest, or non-compliant systems malicious code information through the enterprise facility’s
from accessing networks, and may control network traffic that 102 network distribution system.
may not be bypassed from the client level. In addition, net The threat management facility 100 may provide a policy
work access control may control access to virtual private management facility 112 that may be able to block non
networks (VPN), where VPNs may be a communications 10 malicious applications. Such as VoIP 164, instant messaging
network tunneled through another network, establishing a 162, peer-to-peer file-sharing, and the like, that may under
logical connection acting as a virtual network. In embodi mine productivity and network performance within the enter
ments, a VPN may be treated in the same manner as a physical prise facility 102. The policy management facility 112 may be
network. a set of rules or policies that may indicate enterprise facility
In an embodiment, the security management facility 122 15 102 access permissions for the client facility 144, such as
may provide for host intrusion prevention through behavioral access permissions associated with the network, applications,
based protection, which may guard against unknown threats external computer devices, and the like. The policy manage
by analyzing behavior before software code executes. Behav ment facility 112 may include a database, a text file, a com
ioral based protection may monitor code when it runs and bination of databases and text files, or the like. In an embodi
intervene if the code is deemed to be suspicious or malicious. ment, a policy database may be a block list, a black list, an
Advantages of behavioral based protection over runtime pro allowed list, a white list, or the like that may provide a list of
tection may include code being prevented from running, enterprise facility 102 external network locations/applica
whereas runtime protection may only interrupt code that has tions that may or may not be accessed by the client facility
already partly executed; behavioral protection may identify 144. The policy management facility 112 may include rules
malicious code at the gateway or on the file servers and 25 that may be interpreted with respect to an enterprise facility
deletes it before reaching end-point computers and the like. 102 network access request to determine if the request should
In an embodiment, the security management facility 122 be allowed. The rules may provide a generic rule for the type
may provide for reputation filtering, which may target or of access that may be granted; the rules may be related to the
identify sources of known malware. For instance, reputation policies of an enterprise facility 102 for access rights for the
filtering may include lists of URIs of known sources of mal 30 enterprise facility’s 102 client facility 144. For example, there
ware or known Suspicious IP addresses, or domains, say for may be a rule that does not permit access to sporting websites.
spam, that when detected may invoke an action by the threat When a website is requested by the client facility 144, a
management facility 100. Such as dropping them immedi security facility may access the rules within a policy facility
ately. By dropping the source before any interaction can ini to determine if the requested access is related to a sporting
tiate, potential threat sources may be thwarted before any 35 website. In an embodiment, the security facility may analyze
exchange of data can be made. the requested website to determine if the website matches
In embodiments, information may be sent from the enter with any of the policy facility rules.
prise back to a third party, a vendor, or the like, which may The policy management facility 112 may be similar to the
lead to improved performance of the threat management security management facility 122 but with the addition of
facility 100. For example, the types, times, and number of 40 enterprise facility 102 wide access rules and policies that may
virus interactions that a client experiences may provide useful be distributed to maintain control of client facility 144 access
information for the preventions of future virus threats. This to enterprise facility 102 network resources. The policies may
type offeedback may be useful for any aspect of threat detec be defined for application type, Subset of application capa
tion. Feedback of information may also be associated with bilities, organization hierarchy, computer facility type, user
behaviors of individuals within the enterprise, such as being 45 type, network location, time of day, connection type, or the
associated with most common violations of policy, network like. Policies may be maintained by the administration facil
access, unauthorized application loading, unauthorized exter ity 134, through the threat management facility 100, in asso
nal device use, and the like. In embodiments, this type of ciation with a third party, or the like. For example, a policy
information feedback may enable the evaluation or profiling may restrict IM 162 activity to only support personnel for
of client actions that are violations of policy that may provide 50 communicating with customers. This may allow communi
a predictive model for the improvement of enterprise policies. cation for departments requiring access, but may maintain the
In an embodiment, the security management facility 122 network bandwidth for other activities by restricting the use
may provide for the overall security of the enterprise facility of IM 162 to only the personnel that need access to IM 162 in
102 network or set of enterprise facility 102 networks, may support of the enterprise facility 102. In an embodiment, the
provide updates of malicious code information to the enter 55 policy management facility 112 may be a stand-alone appli
prise facility 102 network, and associated client facilities 144. cation, may be part of the network server facility 142, may be
The updates may be a planned update, an update in reaction to part of the enterprise facility 102 network, may be part of the
a threat notice, an update in reaction to a request for an update, client facility 144, or the like.
an update based on a search of known malicious code infor In embodiments, the threat management facility 100 may
mation, or the like. The administration facility 134 may pro 60 provide configuration management, which may be similar to
vide control over the security management facility 122 when policy management, but may specifically examine the con
updates are performed. The updates may be automatically figuration set of applications, operating systems, hardware,
transmitted without an administration facility’s 134 direct and the like, and managing changes to their configurations.
control, manually transmitted by the administration facility Assessment of a configuration may be made against a stan
134, or the like. The security management facility 122 may 65 dard configuration policy, detection of configuration changes,
include the management of receiving malicious code descrip remediation of improper configuration, application of new
tions from a provider, distribution of malicious code descrip configurations, and the like. An enterprise may keep a set of
 US 9,104,864 B2
7 8
standard configuration rules and policies which may repre policy update module and security update module may be
sent the desired state of the device. For example, a client combined into a single update module.
firewall may be running and installed, but in the disabled As threats are identified and characterized, the threat man
state, where remediation may be to enable the firewall. In agement facility 100 may create definition updates that may
another example, the enterprise may set a rule that disallows be used to allow the threat management facility 100 to detect
the use of USB disks, and sends a configuration change to all and remediate the latest malicious Software, unwanted appli
clients, which turns off USB drive access via a registry. cations, configuration and policy changes, and the like. The
In embodiments, the threat management facility 100 may threat definition facility 114 may contain threat identification
also provide for the removal of applications that may interfere updates, also referred to as definition files. A definition file
with the operation of the threat management facility 100, such 10 may be a virus identity file that may include definitions of
as competitor products that may also be attempting similar known or potential malicious code. The virus identity (IDE)
threat management functions. The removal of such products definition files may provide information that may identify
may be initiated automatically whenever Such products are malicious code within files, applications, or the like. The
definition files may be accessed by security management
detected. In the case where Such applications are services are 15 facility 122 when scanning files or applications within the
provided indirectly through a third-party product, the appli client facility 144 for the determination of malicious code that
cation may be suspended until action is taken to remove or may be within the file or application. The definition files may
disable the third-party products protection facility. contain a number of commands, definitions, or instructions,
Threat management against a Sometimes quickly evolving to be parsed and acted upon, or the like. In embodiments, the
malware environment may require timely updates, and the client facility 144 may be updated with new definition files
update management facility 120 may be provided by the periodically to provide the client facility 144 with the most
threat management facility 100. In addition, a policy manage recent malicious code definitions; the updating may be per
ment facility 112 may also require update management (e.g. formed on a set time period, may be updated on demand from
as provided by the update facility 120 herein described), as the client facility 144, may be updated on demand from the
the enterprise facility 102 requirements for policies change 25 network, may be updated on a received malicious code alert,
enterprise facility 102, client facility 144, server facility 142 or the like. In an embodiment, the client facility 144 may
enterprise facility 102. The update management for the secu request an update to the definition files from an update facility
rity facility 122 and policy management facility 112 may be 120 within the network, may request updated definition files
provided directly by the threat management facility 100, such from a computing facility external to the network, updated
as by a hosted system or in conjunction with the administra 30 definition files may be provided to the client facility 114 from
tion facility 134. In embodiments, the threat management within the network, definition files may be provided to the
facility 100 may provide for patch management, where a client facility 144 from an external computing facility from an
patch may be an update to an operating system, an applica external network, or the like.
tion, a system tool, or the like, where one of the reasons for the In an embodiment, a definition management facility 114
patch is to reduce vulnerability to threats. 35 may provide for the timely updates of definition files infor
In embodiments, the security facility 122 and policy man mation to the network, client facilities 144, and the like. New
agement facility 112 may push information to the enterprise and altered malicious code and malicious applications may be
facility 102 network and/or client facility 144, the enterprise continually created and distributed to networks worldwide.
facility 102 network and/or client facility 144 may pull infor The definition files that maintain the definitions of the mali
mation from the security facility 122 and policy management 40 cious code and malicious application information for the
facility 112 network server facilities 142, there may be a protection of the networks and client facilities 144 may need
combination of pushing and pulling of information between continual updating to provide continual defense of the net
the security facility 122 and the policy management facility work and client facility 144 from the malicious code and
112 network servers 142, enterprise facility 102 network, and malicious applications. The definition files management may
client facilities 144, or the like. For example, the enterprise 45 provide for automatic and manual methods of updating the
facility 102 network and/or client facility 144 may pull infor definition files. In embodiments, the network may receive
mation from the security facility 122 and policy management definition files and distribute the definition files to the net
facility 112 network server facility 142 may request the infor work client facilities 144, the client facilities 144 may receive
mation using the security facility 122 and policy management the definition files directly, or the network and client facilities
facility 112 update module; the request may be based on a 50 144 may both receive the definition files, or the like. In an
certain time period, by a certain time, by a date, on demand, embodiment, the definition files may be updated on a fixed
or the like. In another example, the security facility 122 and periodic basis, on demand by the network and/or the client
policy management facility 112 network servers 142 may facility 144, as a result of an alert of a new malicious code or
push the information to the enterprise facility's 102 network malicious application, or the like. In an embodiment, the
and/or client facility 144 by providing notification that there 55 definition files may be released as a Supplemental file to an
are updates available for download and then transmitting the existing definition files to provide for rapid updating of the
information. The combination of the security management definition files.
122 network server facility 142 and security update module In a similar manner, the security management facility 122
may function Substantially the same as the policy manage may be used to scan an outgoing file and Verify that the
ment facility 112 network server and policy update module by 60 outgoing file is permitted to be transmitted per the enterprise
providing information to the enterprise facility 102 network facility 102 rules and policies. By checking outgoing files, the
and the client facility 144 in a push or pull method. In an security management facility 122 may be able discover mali
embodiment, the policy management facility 112 and the cious code infected files that were not detected as incoming
security facility 122 management update modules may work files as a result of the client facility 144 having been updated
in concert to provide all the needed information to the enter 65 with either new definition files or policy management facility
prise facility's 102 network and/or client facility 144 for 112 information. The definition files may discover the mali
control of application execution. In an embodiment, the cious code infected file by having received updates of devel
 US 9,104,864 B2
9 10
oping malicious code from the administration facility 134, adding rules, changing rules, deleting rules, or the like. Addi
updates from a definition files provider, or the like. The policy tionally, the administration facility 134 may be able to
management facility 112 may discover the malicious code retrieve predefined rule sets from a provider that may provide
infected file by having received new updates from the admin a set of rules to be applied to an entire enterprise facility 102.
istration facility 134, from a rules provider, or the like. The network administration facility 134 may be able to
The threat management facility 100 may provide for a way modify the predefined rules as needed for a particular enter
to control access to the enterprise facility 102 networks. For prise facility 102 using the network access rules management
instance, the enterprise facility 102 may want to restrict facility 124.
access to certain applications, networks, files, printers, serv When a threat or policy violation is detected by the threat
ers, databases, or the like. In addition, the enterprise facility 10
management facility 100, the threat management facility 100
102 may want to restrict user access under certain conditions, may provide for a remedial action facility 128. Remedial
Such as the user's location, usage history, need to know, job action may take a plurality of forms, such as terminating or
position, connection type, time of day, method of authentica modifying an ongoing processorinteraction, sending a warn
tion, client-system configuration, or the like. Network access
rules may be developed by the enterprise facility 102, or 15 ing to a client or administration facility 134 of an ongoing
pre-packaged by a Supplier, and managed by the threat man process or interaction, executing a program or application to
agement facility 100 in conjunction with the administration remediate against a threat or violation, record interactions for
facility 134. Network access rules and control may be respon Subsequent evaluation, or the like. Remedial action may be
sible for determining ifa client facility 144 application should associated with an application that responds to information
be granted access to a requested network location. The net that a client facility 144 network access request has been
work location may be on the same network as the facility or denied. In an embodiment, when the data file is received,
may be on another network. In an embodiment, the network remedial action may parse the data file, interpret the various
access control may verify access rights for client facilities 144 aspects of the data file, and act on the parsed data file infor
from within the network or may verify access rights of com mation to determine actions to be taken on an application
puter facilities from external networks. When network access 25 requesting access to a denied network location. In an embodi
for a client facility 144 is denied, the network access control ment, when the data file is received, remedial action may
may send an information file to the client facility 144, the access the threat definitions to parse the data file and deter
information file may contain data or commands that may mine an action to be taken on an application requesting access
provide instructions for the remedial action facility 128. The to a denied network location. In an embodiment, the infor
information sent by the network access facility 124 control 30 mation received from the facility may be a command or a
may be a data file. The data file may contain a number of command file. The remedial action facility may carry out any
commands, definitions, instructions, or commands to be commands that are received or parsed from a data file from the
parsed and acted upon through the remedial action facility facility without performing any interpretation of the com
128, or the like. The information sent by the network access mands. In an embodiment, the remedial action facility may
facility 124 control may be a command or command file that 35 interact with the received information and may perform vari
the remedial action facility 128 may access and take action ous actions on a client requesting access to a denied network
upon. location. The action may be one or more of continuing to
In an embodiment, the network access rules 124 may pro block all requests to a denied network location, a malicious
vide an information store to be accessed by the network code scan on the application, a malicious code scan on the
access control. The network access rules facility 124 may 40 client facility 144, quarantine of the application, terminating
include databases such as a block list, a black list, an allowed the application, isolation of the application, isolation of the
list, a white list, an unacceptable network site database, an client facility 144 to a location within the network that
acceptable network site database, a network site reputation restricts network access, blocking a network access port from
database, or the like of network access locations that may or a client facility 144, reporting the application to a adminis
may not be accessed by the client facility 144. Additionally, 45 tration facility 134, or the like.
the network access rules facility 124 may incorporate rule Remedial action may be provided as a result of a detection
evaluation; the rule evaluation may parse network access of a threat or violation. The detection techniques facility 130
requests and apply the parsed information to network access may include monitoring the enterprise facility 102 network or
rules. The network access rule facility 124 may have a generic end-point devices, such as by monitoring streaming data
set of rules that may be in support of an enterprise facility’s 50 through the gateway, across the network, through routers and
102 network access policies, such as denying access to certain hubs, and the like. The detection techniques facility 130 may
types of websites 158, controlling instant messenger 162 include monitoring activity and stored files on computing
accesses, or the like. Rule evaluation may include regular facilities, such as on server facilities 142, desktop computers,
expression rule evaluation, or other rule evaluation method laptop computers, other mobile computing devices, and the
for interpreting the network access request and comparing the 55 like. Detection techniques, such as scanning a computers
interpretation to the established rules for network access. In stored files, may provide the capability of checking files for
an embodiment, the network access rules facility 124 may stored threats, either in the active or passive state. Detection
receive a rules evaluation request from the network access techniques, such as streaming file management, may provide
control and may return the rules evaluation to the network the capability of checking files received at the network, gate
access control. 60 way facility, client facility 144, and the like. This may provide
Similar to the threat definitions facility 114, the network the capability of not allowing a streaming file or portions of
access rule facility 124 may provide updated rules and poli the streaming file containing malicious code from entering
cies to the enterprise facility 102. The network access rules the client facility 144, gateway facility, or network. In an
facility 124 may be maintained by the network administration embodiment, the streaming file may be broken into blocks of
facility 134, using network access rules facility 124 manage 65 information, and a plurality of virus identities may be used to
ment. In an embodiment, the network administration facility check each of the blocks of information formalicious code. In
134 may be able to maintain a set of access rules manually by an embodiment, any blocks that are not determined to be clear
 US 9,104,864 B2
11 12
of malicious code may not be delivered to the client facility components provided as hubs and routers 148, server facility
144, gateway facility, or network. 142, firewalls 138, and the like, may require unique security
Verifying that the threat management facility 100 is detect application software to protect their portion of the system
ing threats and violations to established policy, may require infrastructure, while providing an element in an integrated
the ability to test the system, either at the system level or for threat management system that extends out beyond the threat
a particular computing component. The testing facility 118 management facility 100 to incorporate all computer
may allow the administration facility 134 to coordinate the resources under its protection.
testing of the security configurations of client facility 144 The enterprise facility 102 may include a plurality of client
computing facilities on a network. The administration facility facility 144 computing platforms on which the end-point
134 may be able to send test files to a set of client facility 144 10 computer security facility 152 is adapted. A client facility 144
computing facilities to test the ability of the client facility 144 computing platform may be a computer system that is able to
to determine acceptability of the test file. After the test file has access a service on another computer. Such as a server facility
been transmitted, a recording facility may record the actions 142, via a network. This client facility 144 server facility 142
taken by the client facility 144 in reaction to the test file. The model may apply to a plurality of networked applications,
recording facility may aggregate the testing information from 15 Such as a client facility 144 connecting to an enterprise facil
the client facility 144 and report the testing information to the ity 102 application server facility 142, a web browser client
administration facility 134. The administration facility 134 facility 144 connecting to a web server facility 142, an e-mail
may be able to determine the level of preparedness of the client facility 144 retrieving e-mail from an internet 154 ser
client facility 144 computing facilities by the reported infor vice provider's mail storage servers 142, and the like. In
mation. Remedial action may be taken for any of the client embodiments, traditional large client facility 144 applica
facility 144 computing facilities as determined by the admin tions may be switched to websites, which may increase the
istration facility 134; remedial action may be taken by the browser's role as a client facility 144. Clients 144 may be
administration facility 134 or by the user of the client facility classified as a function of the extent to which they perform
144. their own processing. For instance, client facilities 144 are
The threat research facility 132 may provide a continu 25 sometimes classified as a fat client facility 144 or thin client
ously ongoing effort to maintain the threat protection capa facility 144. The fat client facility 144, also known as a thick
bilities of the threat management facility 100 in light of con client facility 144 or rich client facility 144, may be a client
tinuous generation of new or evolved forms of malware. facility 144 that performs the bulk of data processing opera
Threat research may include researchers and analysts work tions itself, and does not necessarily rely on the server facility
ing on known and emerging malware. Such as viruses, root 30 142. The fat client facility 144 may be most common in the
kits a spyware, as well as other computer threats Such as form of a personal computer, where the personal computer
phishing, spam, scams, and the like. In embodiments, through may operate independent of any server facility 142. Program
threat research, the threat management facility 100 may be ming environments for fat clients 144 may include CURI,
able to provide swift, global responses to the latest threats. Delphi, Droplets, Java, win32, X11, and the like. Thin clients
The threat management facility 100 may provide threat 35 144 may offer minimal processing capabilities, for instance,
protection to the enterprise facility 102, where the enterprise the thin client facility 144 may primarily provide a graphical
facility 102 may include a plurality of networked compo user interface provided by an application server facility 142,
nents, such as client facility 144, server facility 142, admin which may perform the bulk of any required data processing.
istration facility 134, firewall 138, gateway, hubs and routers Programming environments for thin clients 144 may include
148, threat management appliance 140, desktop users, mobile 40 JavaScript/AJAX, ASP, JSP. Ruby on Rails, Python's Django,
users, and the like. In embodiments, it may be the end-point PHP, and the like. The client facility 144 may also be a mix of
computer security facility 152, located on a computer's desk the two. Such as processing data locally, but relying on a
top, which may provide threat protection to a user, and asso server facility 142 for data storage. As a result, this hybrid
ciated enterprise facility 102. In embodiments, the term end client facility 144 may provide benefits from both the fat
point may refer to a computer system that may source data, 45 client facility 144 type. Such as multimedia Support and high
receive data, evaluate data, buffer data, or the like (such as a performance, and the thin client facility 144 type, such as high
user's desktop computer as an end-point computer), a firewall manageability and flexibility. In embodiments, the threat
as a data evaluation end-point computer system, a laptop as a management facility 100, and associated end-point computer
mobile end-point computer, a PDA as a hand-held end-point security facility 152, may provide seamless threat protection
computer, a mobile phone as an end-point computer, or the 50 to the plurality of clients 144, and client facility 144 types,
like. In embodiments, end-point may refer to a source or across the enterprise facility 102.
destination for data, including Such components where the The enterprise facility 102 may include a plurality of server
destination is characterized by an evaluation point for data, facilities 142. Such as application servers, communications
and where the data may be sent to a Subsequent destination servers, file servers, database servers, proxy servers, mail
after evaluation. The end-point computer security facility 152 55 servers, fax servers, game servers, web servers, and the like.
may be an application loaded onto the computer platform or A server facility 142, which may also be referred to as a server
computer Support component, where the application may facility 142 application, server facility 142 operating system,
accommodate the plurality of computer platforms and/or server facility 142 computer, or the like, may be an applica
functional requirements of the component. For instance, a tion program or operating system that accepts client facility
client facility 144 computer may be one of a plurality of 60 144 connections in order to service requests from clients 144.
computer platforms. Such as Windows, Macintosh, Linux, The server facility 142 application may run on the same
and the like, where the end-point computer security facility computer as the client facility 144 using it, or the server
152 may be adapted to the specific platform, while maintain facility 142 and the client facility 144 may be running on
ing a uniform product and product services across platforms. different computers and communicating across the network.
Additionally, components may have different functions to 65 Server facility 142 applications may be divided among server
serve within the enterprise facility’s 102 networked com facility 142 computers, with the dividing depending upon the
puter-based infrastructure. For instance, computer Support workload. For instance, under light load conditions all server
 US 9,104,864 B2
13 14
facility 142 applications may run on a single computer and like. In embodiments, the personal firewall may be provided
under heavy load conditions a single server facility 142 appli by the threat management facility 100.
cation may run on multiple computers. In embodiments, the Another important component that may be protected by an
threat management facility 100 may provide threat protection end-point computer security facility 152 is a network firewall
to server facilities 142 within the enterprise facility 102 as 5 facility 138, which may be a hardware or software device that
load conditions and application changes are made. may be configured to permit, deny, or proxy data through a
A server facility 142 may also be an appliance facility 140, computer network that has different levels of trust in its
where the appliance facility 140 provides specific services source of data. For instance, an internal enterprise facility 102
onto the network. Though the appliance facility 140 is a network may have a high level of trust, because the source of
server facility 142 computer, that may be loaded with a server 10 all data has been sourced from within the enterprise facility
facility 142 operating system and server facility 142 applica 102. An example of a low level of trust is the Internet 154,
tion, the enterprise facility 102 user may not need to configure because the Source of data may be unknown. A Zone with an
it, as the configuration may have been performed by a third intermediate trust level, situated between the Internet 154 and
party. In an embodiment, an enterprise facility 102 appliance a trusted internal network, may be referred to as a “perimeter
may be a server facility 142 appliance that has been config 15 network”. Since firewall facilities 138 represent boundaries
ured and adapted for use with the threat management facility between threat levels, the end-point computer security facil
100, and located within the facilities of the enterprise facility ity 152 associated with the firewall facility 138 may provide
102. The enterprise facility's 102 threat management appli resources that may control the flow of threats at this enterprise
ance may enable the enterprise facility 102 to administer an facility 102 network entry point. Firewall facilities 138, and
on-site local managed threat protection configuration, where associated end-point computer security facility 152, may also
the administration facility 134 may access the threat be associated with a network node that may be equipped for
resources through an interface. Such as a web portal. In an interfacing between networks that use different protocols. In
alternate embodiment, the enterprise facility 102 may be embodiments, the end-point computer security facility 152
managed remotely from a third party, Vendor, or the like, may provide threat protection in a plurality of network infra
without an appliance facility 140 located within the enterprise 25 structure locations, such as at the enterprise facility 102 net
facility 102. In this instance, the appliance functionality may work entry point, i.e. the firewall facility 138 or gateway; at
be a shared hardware product between pluralities of enter the server facility 142; at distribution points within the net
prises 102. In embodiments, the appliance facility 140 may be work, i.e. the hubs and routers 148; at the desktop of client
located at the enterprise facility 102, where the enterprise facility 144 computers; and the like. In embodiments, the
facility 102 maintains a degree of control. In embodiments, a 30 most effective location for threat detection may be at the
hosted service may be provided, where the appliance 140 may user's computer desktop end-point computersecurity facility
still be an on-site black box to the enterprise facility 102, 152.
physically placed there because of infrastructure require The interface between the threat management facility 100
ments, but managed by a third party, Vendor, or the like. and the enterprise facility 102, and through the appliance
Simple server facility 142 appliances may also be utilized 35 facility 140 to embedded end-point computer security facili
across the enterprise facility's 102 network infrastructure, ties, may include a set of tools that may be the same for all
Such as Switches, routers, wireless routers, hubs and routers, enterprise implementations, but allow each enterprise to
gateways, print servers, net modems, and the like. These implement different controls. In embodiments, these controls
simple server facility appliances may not require configura may include both automatic actions and managed actions.
tion by the enterprise facility 102, but may require protection 40 Automatic actions may include downloads of the end-point
from threats via an end-point computer security facility 152. computer security facility 152 to components of the enter
These appliances may provide interconnection services prise facility 102, downloads of updates to existing end-point
within the enterprise facility 102 network, and therefore may computer security facilities of the enterprise facility 102,
advance the spread of a threat if not properly protected. uploaded network interaction requests from enterprise facil
One way for a client facility 144 to be protected from 45 ity 102 components to the threat management facility 100,
threats from within the enterprise facility 102 network may be and the like. In embodiments, automatic interactions between
a personal firewall. A personal firewall may be an application the enterprise facility 102 and the threat management facility
that controls network traffic to and from a client, permitting or 100 may be configured by the threat management facility 100
denying communications based on a security policy. Personal and an administration facility 134 in the enterprise facility
firewalls may be designed for use by end-users, which may 50 102. The administration facility 134 may configure policy
result in protection for only the computer on which its rules that determine interactions. Such as developing rules for
installed. Personal firewalls may be able to control network accessing applications, as in who is authorized and when
traffic by providing prompts each time a connection is applications may be used; establishing rules for ethical
attempted and adapting security policy accordingly. Personal behavior and activities; rules governing the use of entertain
firewalls may also provide some level of intrusion detection, 55 ment software such as games, or personal use Software Such
which may allow the software to terminate or block connec as IM 162 and VoIP 164; rules for determining access to
tivity where it Suspects an intrusion is being attempted. Other enterprise facility 102 computing resources, including
features that may be provided by a personal firewall may authentication, levels of access, risk assessment, and usage
include alerts about outgoing connection attempts, control of history tracking; rules for when an action is not allowed, Such
program access to networks, hiding the client from port scans 60 as whetheran action is completely deigned or just modified in
by not responding to unsolicited network traffic, monitoring its execution; and the like. The administration facility 134
of applications that may be listening for incoming connec may also establish license management, which in turn may
tions, monitoring and regulation of incoming and outgoing further determine interactions associated with a licensed
network traffic, prevention of unwanted network traffic from application. In embodiments, interactions between the threat
installed applications, reporting applications that make con 65 management facility 100 and the enterprise facility 102 may
nection attempts, reporting destination servers with which provide threat protection to the enterprise facility 102 by
applications may be attempting communications, and the managing the flow of network data into and out of the enter
 US 9,104,864 B2
15 16
prise facility 102 through automatic actions that may be con facility 100, where contacting the threat management facility
figured by the threat management facility 100 or the admin 100 may be performed prior to any other network action. In
istration facility 134. embodiments, the client facility’s 144 end-point computer
Client facilities 144 within the enterprise facility 102 may security facility 152 may manage actions in unprotected net
be connected to the enterprise facility 102 network by way of 5 work environments such as when the client facility 144F is in
wired network facilities 148A or wireless network facilities a secondary location 108 or connecting wirelessly to a non
148B. Client facilities 144 connected to the enterprise facility enterprise facility 102 wireless internet connection, where the
102 network via a wired facility 148A or wireless facility end-point computer security facility 152 may dictate what
148B may receive similar protection, as both connection actions are allowed, blocked, modified, or the like. For
types are ultimately connected to the same enterprise facility 10 instance, if the client facility's 144 end-point computer Secu
102 network, with the same end-point computer security rity facility 152 is unable to establish a secured connection to
facility 152, and the same threat protected enterprise facility the threat management facility 100, the end-point computer
102 environment. Mobile wireless facility clients 144B-F, security facility 152 may inform the user of such, and recom
because of their ability to connect to any wireless 148B.D mend that the connection not be made. In the instance when
network access point, may connect to the Internet 154 outside 15 the user chooses to connect despite the recommendation, the
the enterprise facility 102, and therefore outside the threat end-point computer security facility 152 may perform spe
protected environment of the enterprise facility 102. In this cific actions during or after the unprotected connection is
instance the mobile client facility 144B-F, if not for the pres made, including running scans during the connection period,
ence of the end-point computer security facility 152 may running scans after the connection is terminated, storing
experience a malware attack or perform actions counter to interactions for Subsequent threat and policy evaluation, con
enterprise facility 102 established policies. In addition, there tacting the threat management facility 100 upon first instance
may be a plurality of ways for the threat management facility of a secured connection for further actions and or scanning,
100 to protect the out-of-enterprise facility 102 mobile client restricting access to network and local resources, or the like.
facility 144D-F that has an embedded end-point computer In embodiments, the end-point computer security facility 152
security facility 152, such as by providing URI filtering in 25 may perform specific actions to remediate possible threat
personal routers, using a web appliance as a DNS proxy, or incursions or policy violations during or after the unprotected
the like. Mobile client facilities 144D-F that are components connection.
of the enterprise facility 102 but temporarily outside connec The secondary location 108 may have no end-point com
tivity with the enterprise facility 102 network, may be pro puter security facilities 152 as a part of its computer compo
vided with the same threat protection and policy control as 30 nents, such as its firewalls 138B, servers 142B, clients 144G,
client facilities 144 inside the enterprise facility 102. In addi hubs and routers 148C-D, and the like. As a result, the com
tion, mobile client facilities 144B-F may receive the same puter components of the secondary location 108 may be open
interactions to and from the threat management facility 100 as to threat attacks, and become potential sources of threats, as
client facilities 144 inside the enterprise facility 102, where well as any mobile enterprise facility clients 144B-F that may
mobile client facilities 144B-F may be considered a virtual 35 be connected to the secondary location's 108 network. In this
extension of the enterprise facility 102, receiving all the same instance, these computer components may now unknowingly
services via their embedded end-point computer security spread a threat to other components connected to the network.
facility 152. Some threats may not come directly from the Internet 154,
Interactions between the threat management facility 100 such as from non-enterprise facility controlled mobile
and the components of the enterprise facility 102, including 40 devices that are physically brought into the enterprise facility
mobile client facility 144B-F extensions of the enterprise 102 and connected to the enterprise facility 102 client facili
facility 102, may ultimately be connected through the internet ties 144. The connection may be made from direct connection
154. Threat management facility 100 downloads and with the enterprise facility’s 102 client facility 144, such as
upgrades to the enterprise facility 102 may be passed from the through a USB port, or in physical proximity with the enter
firewalled networks of the threat management facility 100 45 prise facility’s 102 client facility 144 such that a wireless
through to the end-point computer security facility 152 facility connection can be established. Such as through a
equipped components of the enterprise facility 102. In turn Bluetooth connection. These physical proximity threats 110
the end-point computer security facility 152 components of may be another mobile computing device, a portable memory
the enterprise facility 102 may upload policy and access storage device, a mobile communications device, or the like,
requests back across the internet 154 and through to the threat 50 such as CDs and DVDs 170, memory stick 174, flash drive
management facility 100. The Internet 154 however, is also 174, external hard drive, cell phone 178, PDAs 180, MP3
the path through which threats may be transmitted from their players, digital cameras, point-to-point devices, digital pic
source. These network threats may include threats from a ture frames, digital pens, navigation devices, appliances, and
plurality of sources, including websites 158, e-mail 160, IM the like. A physical proximity threat 110 may have been
162, VoIP 164, application software, and the like. These 55 previously infiltrated by network threats while connected to
threats may attempt to attack a mobile enterprise client facil an unprotected network connection outside the enterprise
ity 144B-F equipped with an end-point computer security facility 102, and when connected to the enterprise facility 102
facility 152, but in embodiments, as long as the mobile client client facility 144, pose a threat. Because of their mobile
facility 144B-F is embedded with an end-point computer nature, physical proximity threats 110 may infiltrate comput
security facility 152, as described above, threats may have no 60 ing resources in any location, Such as being physically
better success than if the mobile client facility 144B-F were brought into the enterprise facility 102 site, connected to an
inside the enterprise facility 102. enterprise facility 102 client facility 144 while that client
However, if the mobile client facility 144 were to attempt to facility 144 is mobile, plugged into an unprotected client
connect into an unprotected connection point, Such as at a facility 144 at a secondary location 108, and the like. A
secondary location 108 that is not a part of the enterprise 65 mobile device, once connected to an unprotected computer
facility 102, the mobile client facility 144 may be required to resource, may become a physical proximity threat 110. In
request network interactions through the threat management embodiments, the end-point computer security facility 152
 US 9,104,864 B2
17 18
may provide enterprise facility 102 computing resources with plurality of run-time processes 210 as computer system
threat protection against physical proximity threats 110, for objects, such as files, processes, registry keys, and the like.
instance, through scanning the device prior to allowing data The threat detection facility 202 may monitor, capture, filter,
transfers, through security validation certificates, through and the like, system events on the computer objects through
establishing a safe Zone within the enterprise facility 102 event capture 212 functionality. For instance, a system event
computing resource to transfer data into for evaluation, and may be a change to a system process that is run by the
the like. operating system (e.g. FileOpen, FileWrite, Registry Write,
Now that the overall system has been described, we turn and the like). The detection of the event may then initiate a
towards a set of threat detection embodiments utilizing the process that generates a list of threat characteristics associ
accumulated detection of threat characteristics. It should be 10 ated with the object that has experienced the event, where a
understood that the following embodiments may be managed threat characteristics detector 214 produces the list. In
through a threat management facility 100 along with other embodiments, an anti-virus engine may provide the function
services, such as those described herein. ality of the threat characteristics detector 214. The list of
Referring to FIG. 2, a system diagram embodiment of a threat characteristics associated with the event may then be
threat detection technique 130 is depicted, where the tech 15 passed to a threat detection analyzer 218 for creation of or
nique utilizes the accumulation of threat detection character insertion into threat tables 220 that keep an accumulated
istics in identifying a threat to a computing device, such as record of threat characteristics that have been associated with
one of the threats listed herein. In traditional on-access mal events to objects over time, where there may be a separate
ware detection every on-access scan runs through a full set of threat table 220 for each object that has experienced an event.
threat characteristic identities (also referred to herein as A threat analyzer 222 then monitors the content of each threat
geneidentities), and then runs threat-describing identities table 220 to see if the accumulated set of threat characteristics
one by one. A threat characteristic, or gene, may be a code detected in events of a particular object match a threat index
Strand, functionality, property, and the like piece of informa 224 that lists what threat characteristics constitute a given
tion collected on system objects that may be reused and threat.
combined in different threat detections. A threat may be iden 25 In an example, and referring to the example threat index of
tified by the presence of a particular set of genes that are Table 1, a threat T1 may be comprised of genes G1, G2.
indicative of the threat. The traditional approach is very and G3. That is, when genes G1, G2, and G3 are detected in
sequential, where an on-access Scan is triggered after any the same computer object by the threat analyzer, the threat
target computing device object changes, and the system recal analyzer will have determined that the threat T1 has been
culates all the genes and checks all the threat descriptions to 30 detected in the object. In embodiments, the threat analyzer
find out whether any given threat is active. This approach to may then update a threat status 228, such as with a list of
threat identification is very inefficient, and does not scale with identified threats, a clean system status, and the like.
the number of genes or threat descriptions. For instance,
calculating all the genes in each on-access Scan includes TABLE 1
genes that are likely to not be relevant to the potential of a 35
particular threat, threat environment, computing platform, Example threat index
application, and the like, and running threat identities sequen Threat Genes
tially fails to preserve knowledge between identities.
In the present disclosure a threat detection facility 202 is
provided that allows dynamic detection of complex threats in 40
a way that scales linearly with the number of threat descrip
tions and the number of computer system objects tracked. The
threat detection facility 202 may provide an algorithm to A detailed example of how the threat characteristics ana
detect threats in a dynamic detection environment, where lyzer 218 generates and maintains threat tables 220, and
threats are described as a list of threat characteristics (e.g. 45 finally how the threat analyzer 222 identifies the presence of
genes) that must be present, and where the threat character a threat, will now be presented. This example is meant to be
istics may be generated/detected dynamically through behav illustrative of the process for detection of a threat using the
ioral detection. The threat detection facility 202 may allow for threat detection facility 202, and is not meant to be limiting in
the tracking of all known threats efficiently, and only recal any way, including the use of the term gene to represent the
culate genes that may potentially provide new information. 50 more generic threat characteristic, which includes sequences
Through this process, processing may be kept to a minimum, within the code of an object, behavioral characteristics of an
allowing increased efficiency. The invention may provide for object, occurrence of a change event with respect to the occur
a scalable solution that is able to cope with a large number of rence of another change event, characteristics that are listed as
threat descriptions. Benefits of the threat detection facility part of a policy, and the like.
202 may include stopping threats earlier in the detection 55 In this example, a first step in the process begins with the
process, an increase in the performance of the target comput example threat index presented in Table 1 where three threats
ing device through decreased processing requirements from are listed along with the group of genes that when identified
scanning, reduced memory usage, and the like, all of which together in a particular object, identify that threat as being
may be especially important in mobile and virtualization present in that object. An inverted threat index 226 is then
applications. 60 generated, such as provided in Table 2 as a result of inverting
Referring again to FIG. 2, the threat detection facility 202 the threat index provided in Table 1. The inverted threat index
may be resident in or interfacing with a computing device 226 provides what threats are associated with a particular
204, such as a client 144A, a wireless client 144B, a server gene from Table 1, and how many total number of genes are
142A, a firewall 138A, a gateway, and the like, such as in part required to detect those threats. For instance, the gene G1 in
of a computer security facility 152 in association with the 65 Table 2 shows that it is associated only with threat T1, and that
computing device 204 as described herein. The computing there are three different genes required to identify threat T1.
device 204 may include an operating system 208 running a In another instance, the gene G3 in Table 2 shows that it is
 US 9,104,864 B2
19 20
associated with two threats, T1 and T3, where again there are threats listed in Table 1. In embodiments, the threats included
three different genes required to identify threat T1, and where in a threat index 224 may be limited to a subset of known
there are two different genes required to identify threat T3. threats, include all known threats, limited to threats relevant
to a type of computing device (e.g. laptop, mobile phone,
TABLE 2 5 enterprise server), and the like.
Example inverted threat index TABLE 5
Gene Threat (total genes required) Object Genes Threats
G1 T1(3) 10 F1 G1 T1 (1,3)
G2 T1(3), T2(3) F2 G31
G3 T1(3), T3(2) F3
G4 T2(3)
G5 T3(2)
G6 T2(3) Referring to Table 6, a new event is captured, where gene
15 G2 is detected in object F3. Gene G2 is relevant to both threat
A next step in the process is for the threat characteristics T1 and threat T2, and so threat status indicators are added to
analyzer 218 to generate a new threat table 220 for each object the threats column for object F3 to indicate that one of the
for which an event has been detected. Table three provides an three genes have been detected for T1, T1 (1.3), and similarly
example of a blank set of threat tables, where each row of that one of the three genes have been detected for T2, T2(1,3).
Table 3 represents a separate threat table 220. In embodi- 20
ments, the threat characteristics analyzer 218 may generate a TABLE 6
new threat table 220 as events dictate, or may create a set of
blank threat tables 220 for a group of objects to be monitored. Object Genes Threats
In this example, threat tables for objects F1, F2, and F3 F1 G1 T1(1,3)
are listed in a blank set of threat tables 220. 25 F2 G31
F3 G2 T1(1,3), T2(1,3)
TABLE 3
Referring to Table 7, a new event is captured, where the
Object Genes Threats (genes detected, total required) gene G10 is detected in object F1. No additional entry is
F1 30 entered under the threats column of any of the threat tables
F2 because G10 is not relevant to any of the threats listed in Table
F3 1.

The threat detection facility 202 now waits for an event TABLE 7
capture 212. In this example, suppose that the object F1 is a 35 Object Genes Threats
run-time process that experiences a change. The event is
captured 212 and the content is passed on to the threat char- F1 G1, G10 T1(1,3)
acteristic detector 214. The threat characteristics analyzer F2 G31
218 than writes to the gene column of the threat table 220 for F3 G2 T1(1,3), T2(1,3)
the object F1. Referring to Table 4, the threat table for F1 40
shows that the threat characteristics analyzer 218 has inserted Referring to Table 8, a new event is captured, where the
the presence of the gene G1 from the event, where G1 is one gene G1 is detected in object F2, and a threat status indicator
of the three genes that constitute the threat T1, hence the of T1 (1.3) is entered into the column under threats for the
nomenclature T1 (1.3) in added as a threat status indicator in object F2 indicating that one of the three genes required to
the- threats column of table 4, where T1 is the threat, and (1.3) 45 identify threat T1 has been detected in the object F2.
indicates that one of the three genes has been detected toward
the identification of the threat T1 in the object F1. Note that TABLE 8
for the sake of describing this example through the following
tables, new threat table entries from new event captures will Object Genes Threats
be shown in bold.
50 F1 G1, G10 T1(1,3)
F2 G31, G1 T1(1,3)
TABLE 4 F3 G2 T1(1,3), T2(1,3)
Object Genes Threats
F1 G1 T1 (1,3)
Referring to Table 9, a new event is captured, where gene
F2 s 55 G9 is detected in object F3. G9 is not relevant to the threats
F3 listed in Table 1.

The following tables will now depict a series of threat table TABLE 9
updates resulting from a series of new events, where the threat Object Genes Threats
analyzer monitors the threats column of the threat table for "
conditions that indicate a threat is present, Such as in a threat f 3. . E.
status indicator of TH(2.2) indicating that two of two genes for F3 G2G9 E3 T2(1,3)
threat Tit has been found, or Titi (3.3) indicating that three of s 3~ 3 - a w-.
three genes for threat Titi has been found.
Referring to Table 5, a new event is captured, where the 65 Referring to Table 10, a new event is captured, where gene
gene G31 is detected in object F2. No entry is entered under G3 has detected object F1. Gene G3 is relevant to both threat
the threats column because G31 is not relevant to any of the T1 and threat T3. As a result, the threat status indicator for T1
 US 9,104,864 B2
21 22
is changed from T1 (1.3) to T1 (2.3) to indicate that two of the trative example without undue complexity, but with sufficient
three genes have been detected. Additionally, a threat status detail to show how the process may proceed. In embodiments,
indicator for T3 is added to indicate that one of the two genes the number of objects monitored, and the number of threats
for the threat T3 has been detected in the object F1. considered may vary. They may be limited in Some manner or
they may be comprehensive to the extent of knowledge of the
TABLE 10 threat management facility 100. As stated, one of the advan
tages of the threat detection facility 202 may be the ability for
Object Genes Threats the threat detection facility 202 to scale to various applica
F1 G1, G10, G3 T1 (2.3), T3 (1,2) tions, and thereby provide match of the threat protection to
F2 G31, G1 T1(1,3) 10 the threat environment of the application, and thus improved
F3 G2, G9 T1(1,3), T2(1,3) performance over traditional techniques. For instance, threat
protection and performance requirements may be very differ
Referring to Table 11, a new event is captured, where gene ent between a mobile phone application and a desktop com
G3 is now detected in object F2. Similar to the last event puter application, and with the threat detection 202 as
captured in object F1, the detection of gene G3 is added to the 15 described herein may be optionally scaled to match desired
threat table for object F2, where the threat status indicator for performance and threat detection criteria. In embodiments,
T1 is changed from T1 (1.3) to T1 (2.3) to indicate that two of the threat tables used by the threat detection facility 202 may
the three genes have been detected, and additionally, a status be specific to the environment threat landscape, such as for
indicator for T3 is added to indicate that one of the two genes mobile, desktop, server, email server, gateway, centralized
for the threat T3 has been detected in the object F1. network nodes, and the like. In embodiments, the threat
detection facility 202 may utilize threat tables in a hierarchi
TABLE 11 cal manner for improved detection, such as in a hierarchy of
desktop, gateway, enterprise, and the like levels. In embodi
Object Genes Threats ments, the threat detection facility 202 may provide for multi
25 object protection by having the threat analyzer 222 compare
F1 G1, G10, G3 T1(2,3), T3 (1,2) across threat tables. For instance, the multi-object detection
F2 G31, G1, G3 T1 (2.3), T3 (1,2)
F3 G2, G9 T1(1,3), T2(1,3) may require that several objects be infected together in order
to detect a threat. In embodiments, a multi-object detection
Referring to Table 12, a new event is captured, where gene may be detected upon the full or partial detection of threats
30 within each of the multiple objects. For instance, the threat
G6 is detected in object F3. Gene G6 is relevant to threat T2, analyzer may be provided with an algorithm for determining
and so the status indicator for threat T2 is incremented to
indicate T202.3), showing that two of the three genes required the likelihood of a multi-object threat based on the extent to
to identify the threat T2 have been detected in object F3. which threats are completely detected. For example, a com
plete detection in one object, and partial detection in two
TABLE 12
35 other objects. In embodiments, the threat detection facility
may support the detection of threats based on not-gene’
Object Genes Threats detection, where the detection of a plurality of genes in com
bination with a non-detection of a plurality of genes results in
F1 G1, G10, G3 T1(2,3), T3 (1,2) a detection of a threat. For instance, the detection of threat T5
F2 G31, G1, G3 T1(2,3), T3 (1,2)
F3 G2, G9, G6 T1(1,3), T2(2.3)
40 determined with the detection of genes G4, G10, and G42 in
combination with the absence of the detection of gene G14.
Referring to FIG. 3, an embodiment flow diagram for the
Referring to Table 13, a new event is captured, where gene current disclosure is provided. In a first step 320, the process
G5 is detected in object F1. Gene G5 is relevant to threat T3, begins as a method of dynamic threat detection, where the
and represents the second of the two required genes to iden 45 process may be dynamic due to the ability of the threat detec
tify threat T3 as being detected in object F1. The threat ana tion facility 202 providing threat protection over time as
lyzer 222, which as been monitoring the threat tables, detects threat characteristics are detected and accumulated, to scale
the threat, and updates the threat status 228 to indicate that the the use of threat tables 220 for various computing platforms,
threat T3 has been detected in object F1. In embodiments, the applications, and threat environments, and the like. In a sec
threat detection facility may act on this information in a 50 ond step, providing a first database (e.g. the inverted threat
plurality of ways, such as alerting the user of the computer index 226) that correlates a plurality of threat characteristics
device, alerting administration 134, alerting security manage to a threat, wherein a presence of the plurality of the threat
ment 122, taking remedial actions 128, and the like. characteristics confirms a presence of the threat. The inverted
threat index 226 may be stored in a database, a listing, a table,
TABLE 13 55 and the like, where the threat analyzer 222 uses the content of
Object Genes Threats the inverted threat index 226 to update the threat tables 220 as
threat characteristics (e.g. genes) are detected and included
F1 G1, G10, G3, G5 T1 (2.3), T3 (2.2 into the threat tables from the threat characteristics analyzer.
F2 G31, G1, G3 T1(2,3), T3 (1,2) In a third step 308, detecting a change event in a computer
F3 G2, G9, G6 T1(1,3), T2(2,3) 60 run-time process, wherein the detecting is provided by the
event capture 212 in the computing device 204, and the run
The illustrative example presented in association with time process is run on the computer device 204, Such as where
tables 1-13 are meant to show how an embodiment of the the run-time process is a computer object run by the operating
threat detection facility 202 detects a threat through the accu system 208. In a forth step 310, testing the change event for a
mulation of threat characteristics detected in events in pro 65 presence of one or more of the plurality of characteristics
cesses run on a computing device 204. In this illustrative upon detection of the change event, wherein the threat char
example, events have been included to provide a fully illus acteristics detector 214 is extracting threat characteristics
 US 9,104,864 B2
23 24
from the change event for possible insertion into threat tables The methods and systems described herein may be
220. In a fifth step 312, storing a detection of one of the deployed in part or in whole through a machine that executes
plurality of characteristics in a second database that accumu computer software on a server, client, firewall, gateway, hub,
lates detected characteristics for the computer run-time pro router, or other Such computer and/or networking hardware.
cess, where the second database is at least one threat table The Software program may be associated with a server that
220. In embodiments, the threat analyzer 222 may now be may include a file server, print server, domain server, internet
utilizing two databases for the detection of a threat, where one server, intranet server and other variants such as secondary
database is the inverted threat index 226 and the second server, host server, distributed server and the like. The server
database is the at least one threat table 220 being updated by may include one or more of memories, processors, computer
the threat characteristics analyzer 218 as threat characteristics
10 readable media, Storage media, ports (physical and virtual),
are detected in events. In a sixth step 314, identifying the communication devices, and interfaces capable of accessing
threat when each one of the plurality of characteristics other servers, clients, machines, and devices through a wired
appears in the second database. The threat analyzer 222, or a wireless medium, and the like. The methods, programs or
codes as described herein and elsewhere may be executed by
monitoring the at least one threat table 220, detects that a 15 the server. In addition, other devices required for execution of
threat is present when the at least one threat table 220 is methods as described in this application may be considered as
updated to show a completed detected threat. For instance, a part of the infrastructure associated with the server.
where all of the genes required for a threat to be present have The server may provide an interface to other devices
been detected for a given computer object. The threat ana including, without limitation, clients, other servers, printers,
lyzer may then update the threat status 228, and potentially database servers, print servers, file servers, communication
other actions upon detection of a threat, Such as described servers, distributed servers and the like. Additionally, this
herein. coupling and/or connection may facilitate remote execution
The methods and systems described herein may be of program across the network. The networking of some orall
deployed in part or in whole through a machine that executes of these devices may facilitate parallel processing of a pro
computer Software, program codes, and/or instructions on a 25 gram or method at one or more location without deviating
processor. The present invention may be implemented as a from the scope of the invention. In addition, any of the devices
method on the machine, as a system or apparatus as part of or attached to the server through an interface may include at
in relation to the machine, or as a computer program product least one storage medium capable of storing methods, pro
embodied in a computer readable medium executing on one grams, code and/or instructions. A central repository may
or more of the machines. The processor may be part of a 30 provide program instructions to be executed on different
server, client, network infrastructure, mobile computing plat devices. In this implementation, the remote repository may
form, stationary computing platform, or other computing act as a storage medium for program code, instructions, and
platform. A processor may be any kind of computational or programs.
processing device capable of executing program instructions, The software program may be associated with a client that
codes, binary instructions and the like. The processor may be 35 may include a file client, print client, domain client, internet
or include a signal processor, digital processor, embedded client, intranet client and other variants such as secondary
processor, microprocessor or any variant Such as a co-proces client, host client, distributed client and the like. The client
Sor (math co-processor, graphic co-processor, communica may include one or more of memories, processors, computer
tion co-processor and the like) and the like that may directly readable media, Storage media, ports (physical and virtual),
or indirectly facilitate execution of program code or program 40 communication devices, and interfaces capable of accessing
instructions stored thereon. In addition, the processor may other clients, servers, machines, and devices through a wired
enable execution of multiple programs, threads, and codes. or a wireless medium, and the like. The methods, programs or
The threads may be executed simultaneously to enhance the codes as described herein and elsewhere may be executed by
performance of the processor and to facilitate simultaneous the client. In addition, other devices required for execution of
operations of the application. By way of implementation, 45 methods as described in this application may be considered as
methods, program codes, program instructions and the like a part of the infrastructure associated with the client.
described herein may be implemented in one or more thread. The client may provide an interface to other devices includ
The thread may spawn other threads that may have assigned ing, without limitation, servers, other clients, printers, data
priorities associated with them; the processor may execute base servers, print servers, file servers, communication serv
these threads based on priority or any other order based on 50 ers, distributed servers and the like. Additionally, this
instructions provided in the program code. The processor coupling and/or connection may facilitate remote execution
may include memory that stores methods, codes, instructions of program across the network. The networking of some orall
and programs as described herein and elsewhere. The proces of these devices may facilitate parallel processing of a pro
Sor may access a storage medium through an interface that gram or method at one or more location without deviating
may store methods, codes, and instructions as described 55 from the scope of the invention. In addition, any of the devices
herein and elsewhere. The storage medium associated with attached to the client through an interface may include at least
the processor for storing methods, programs, codes, program one storage medium capable of storing methods, programs,
instructions or other type of instructions capable of being applications, code and/or instructions. A central repository
executed by the computing or processing device may include may provide program instructions to be executed on different
but may not be limited to one or more of a CD-ROM, DVD, 60 devices. In this implementation, the remote repository may
memory, hard disk, flash drive, RAM, ROM, cache and the act as a storage medium for program code, instructions, and
like. programs.
A processor may include one or more cores that may The methods and systems described herein may be
enhance speed and performance of a multiprocessor. In deployed in part or in whole through network infrastructures.
embodiments, the process may be a dual core processor, quad 65 The network infrastructure may include elements such as
core processors, other chip-level multiprocessor and the like computing devices, servers, routers, hubs, firewalls, clients,
that combine two or more independent cores (called a die). personal computers, communication devices, routing devices
 US 9,104,864 B2
25 26
and other active and passive devices, modules and/or compo ing to software or hardware engineering practices, the
nents as known in the art. The computing and/or non-com depicted elements and the functions thereof may be imple
puting device(s) associated with the network infrastructure mented on machines through computer executable media
may include, apart from other components, a storage medium having a processor capable of executing program instructions
such as flash memory, buffer, stack, RAM, ROM and the like. stored thereon as a monolithic Software structure, as standa
The processes, methods, program codes, instructions lone software modules, or as modules that employ external
described herein and elsewhere may be executed by one or routines, code, services, and so forth, or any combination of
more of the network infrastructural elements. these, and all Such implementations may be within the scope
The methods, program codes, and instructions described of the present disclosure. Examples of Such machines may
herein and elsewhere may be implemented on a cellular net 10 include, but may not be limited to, personal digital assistants,
work having multiple cells. The cellular network may either laptops, personal computers, mobile phones, other handheld
be frequency division multiple access (FDMA) network or computing devices, medical equipment, wired or wireless
code division multiple access (CDMA) network. The cellular communication devices, transducers, chips, calculators, sat
network may include mobile devices, cell sites, base stations, ellites, tablet PCs, electronic books, gadgets, electronic
repeaters, antennas, towers, and the like. The cell network 15 devices, devices having artificial intelligence, computing
may be a GSM, GPRS, 3G, EVDO, mesh, or other networks devices, networking equipments, servers, routers and the like.
types. Furthermore, the elements depicted in the flow chart and
The methods, programs codes, and instructions described block diagrams or any other logical component may be imple
herein and elsewhere may be implemented on or through mented on a machine capable of executing program instruc
mobile devices. The mobile devices may include navigation tions. Thus, while the foregoing drawings and descriptions set
devices, cell phones, mobile phones, mobile personal digital forth functional aspects of the disclosed systems, no particu
assistants, laptops, palmtops, netbooks, pagers, electronic lar arrangement of Software for implementing these func
books readers, music players and the like. These devices may tional aspects should be inferred from these descriptions
include, apart from other components, a storage medium Such unless explicitly stated or otherwise clear from the context.
as a flash memory, buffer, RAM, ROM and one or more 25 Similarly, it will be appreciated that the various steps identi
computing devices. The computing devices associated with fied and described above may be varied, and that the order of
mobile devices may be enabled to execute program codes, steps may be adapted to particular applications of the tech
methods, and instructions stored thereon. Alternatively, the niques disclosed herein. All Such variations and modifications
mobile devices may be configured to execute instructions in are intended to fall within the scope of this disclosure. As
collaboration with other devices. The mobile devices may 30 Such, the depiction and/or description of an order for various
communicate with base stations interfaced with servers and steps should not be understood to require a particular order of
configured to execute program codes. The mobile devices execution for those steps, unless required by a particular
may communicate on a peer to peer network, mesh network, application, or explicitly stated or otherwise clear from the
or other communications network. The program code may be COInteXt.
stored on the storage medium associated with the server and 35 The methods and/or processes described above, and steps
executed by a computing device embedded within the server. thereof, may be realized in hardware, Software or any com
The base station may include a computing device and a stor bination of hardware and software suitable for a particular
age medium. The storage device may store program codes application. The hardware may include a general purpose
and instructions executed by the computing devices associ computer and/or dedicated computing device or specific
ated with the base station. 40 computing device or particular aspect or component of a
The computer Software, program codes, and/or instruc specific computing device. The processes may be realized in
tions may be stored and/or accessed on machine readable one or more microprocessors, microcontrollers, embedded
media that may include: computer components, devices, and microcontrollers, programmable digital signal processors or
recording media that retain digital data used for computing other programmable device, along with internal and/or exter
for some interval of time; semiconductor storage known as 45 nal memory. The processes may also, or instead, be embodied
random access memory (RAM); mass storage typically for in an application specific integrated circuit, a programmable
more permanent storage, such as optical discs, forms of mag gate array, programmable array logic, or any other device or
netic storage like hard disks, tapes, drums, cards and other combination of devices that may be configured to process
types; processor registers, cache memory, Volatile memory, electronic signals. It will further be appreciated that one or
non-volatile memory; optical storage such as CD, DVD: 50 more of the processes may be realized as a computer execut
removable media such as flash memory (e.g. USB sticks or able code capable of being executed on a machine readable
keys), floppy disks, magnetic tape, paper tape, punch cards, medium.
standalone RAM disks, Zip drives, removable mass storage, The computer executable code may be created using a
off-line, and the like; other computer memory Such as structured programming language such as C, an object ori
dynamic memory, static memory, read/write storage, mutable 55 ented programming language Such as C++, or any other high
storage, read only, random access, sequential access, location level or low-level programming language (including assem
addressable, file addressable, content addressable, network bly languages, hardware description languages, and database
attached storage, storage area network, bar codes, magnetic programming languages and technologies) that may be
ink, and the like. stored, compiled or interpreted to run on one of the above
The methods and systems described herein may transform 60 devices, as well as heterogeneous combinations of proces
physical and/or or intangible items from one state to another. sors, processor architectures, or combinations of different
The methods and systems described herein may also trans hardware and Software, or any other machine capable of
form data representing physical and/or intangible items from executing program instructions.
one state to another. Thus, in one aspect, each method described above and
The elements described and depicted herein, including in 65 combinations thereof may be embodied in computer execut
flow charts and block diagrams throughout the figures, imply able code that, when executing on one or more computing
logical boundaries between the elements. However, accord devices, performs the steps thereof. In another aspect, the
 US 9,104,864 B2
27 28
methods may be embodied in Systems that perform the steps ciates each of a number of particular characteristics with
thereof, and may be distributed across devices in a number of one or more particular threats, and for each one of the
ways, or all of the functionality may be integrated into a one or more particular threats, further specifies how
dedicated, standalone device or other hardware. In another many particular characteristics are used to identify the
aspect, the means for performing the steps associated with the one of the one or more particular threats, thereby updat
processes described above may include any of the hardware ing the first database as threat characteristics are
and/or software described above. All such permutations and detected in change events; and
combinations are intended to fall within the scope of the identifying the threat when the number of relevant threat
present disclosure. characteristics appear in the second database.
While the invention has been disclosed in connection with 10 2. The computer program product of claim 1, wherein the
the preferred embodiments shown and described in detail, threat includes a malware threat to a computer facility.
various modifications and improvements thereon will 3. The computer program product of claim 1, wherein the
become readily apparent to those skilled in the art. Accord threat includes a violation of an enterprise security policy.
ingly, the spirit and scope of the present invention is not to be 4. The computer program product of claim 1, wherein the
limited by the foregoing examples, but is to be understood in 15 characteristic is a functionality of a computer program.
the broadest sense allowable by law. 5. The computer program product of claim 1, wherein one
All documents referenced herein are hereby incorporated of the threat characteristics is a property of a computer pro
by reference. gram.
What is claimed is: 6. The computer program product of claim 1, wherein one
1. A computer program product embodied in a non-transi of the threat characteristics is a portion of program code.
tory computer readable medium that, when executing on one 7. The computer program product of claim 1, wherein the
or more computers, performs the steps of computer run-time process includes at least one of an access
providing a first database that correlates a plurality of threat to a file, a process, a mutual exclusion object, and a registry
characteristics to a threat, wherein a presence of the key.
plurality of the threat characteristics confirms a presence 25 8. The computer program product of claim 1, wherein the
second database accumulates detected characteristics for
of the threat; each of a plurality of computer run-time processes.
detecting a change event in a computer run-time process;
testing the change event for a presence of one or more of the 9. The computer program product of claim 1, wherein the
plurality of threat characteristics upon detection of the first database correlates a different plurality of characteristics
change event; 30 to each one of a plurality of different threats.
storing a detection of one of the plurality of threat charac 10. The computer program product of claim 1, further
teristics in a second database that accumulates detected comprising code that performs the step of creating a new
threat characteristic for inclusion into the first database when
characteristics for the computer run-time process; the detected change event is identified as a new threat by a
scaling the plurality of threat characteristics in the first threat identification facility but is not currently in the first
database to a number of relevant threat characteristics 35
database.
based upon accumulated detected characteristics in the
second database using an inverted threat index that asso