Patent ID: 11914711
Assignee: VERSA NETWORKS, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 8:
9. A system comprising:
a memory configured to store a precompiled template that includes executable code and a resource data section;
a processor operatively coupled to the memory and configured to run a virtual machine (VM) that is running an operating system, the VM configured to run a sample comprising a malware;
a monitoring subsystem running on the VM, the monitoring subsystem configured to generate event data based on a plurality of events occurring on the VM;
a classifier configured to detect the malware based on the plurality of events; and
a countermeasure compiler configured to generate a countermeasure data for a countermeasure to the malware from the event data,
wherein the countermeasure is an executable file produced by storing the countermeasure data in the resource data section,
wherein the executable code is configured to interpret the countermeasure data,
wherein executing the countermeasure on a computer executes the executable code and inoculates the computer from infection by the malware,
wherein the monitoring subsystem is configured to:
run within a kernel of the operating system,
monitor a first process not associated with the sample,
monitor a second process,
monitor a tripwire file,
monitor a system file, and
to monitor an operating system registry; and

wherein the classifier is configured to:
run within the kernel of the operating system,
detect the malware based on the sample modifying the tripwire file,
detect the malware based on the sample modifying the system file,
detect the malware based on the sample terminating the first process,
detect the malware based on a type of access to the second process requested by the sample,
detect the malware based on an identity of the second process accessed by the sample, and
detect the malware based on the sample modifying or deleting a registry entry that the sample did not create.