Patent ID: 11868479
Assignee: ARIZONA BOARD OF REGENTS ON BEHALF OF THE UNIVERSITY OF ARIZONA
Field: Medical technology (Instruments)
Classification: CPC G  H  A | IPC A  G

Claim 5:
6. A system for detecting and mitigating malware in a device, said system comprising:
a) said device having one or more sensors or actuators, and a computer processor able to operate said sensors or actuators, wherein the device is able to be connected to a network or external computer system;
b) a first module implemented on the computer processor able to operate said one or more sensors or actuators in a base operational mode and operate said one or more sensors or actuators in one or more higher operational modes;
c) a second module implemented on the computer processor able to estimate a probability that a malware risk will effect a function performed by said one or more sensors or actuators in said one or more higher operational modes, wherein the second module is able to perform a static risk evaluation and, during operation of the device, a dynamic risk evaluation, wherein the risk evaluations are used to determine the calculated risk threshold, estimated probabilities, or both, and wherein performing a static risk evaluation, dynamic risk evaluation, or both, comprises assigning calculated security-health and security-data-sensitivity scores to each operation mode of the device;
d) a third module implemented on the computer processor able to model normal system behavior of the base operational mode and one or more higher operational modes of the device, compare current system operation to the modeled normal system behavior, and estimate a probability of the current system operation being affected by malware based on performance deviation between the current system operation and the modeled normal system behavior; and
e) a fourth module implemented on the computer processor able to analyze the estimated probabilities from the second and third modules and cause the first module to switch from the one or more higher operational modes to a higher operational mode having less functionality to the base operational mode when the estimated probabilities exceed a calculated risk threshold.