Patent ID: 11914711
Assignee: VERSA NETWORKS, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A method comprising:
running a virtual machine (VM) that has an operating system configured with a monitoring subsystem, the monitoring subsystem configured to generate event data based on a plurality of events occurring on the virtual machine;
running a classifier configured to detect a malware based on the plurality of events;
running a sample on the virtual machine, the classifier detecting the malware in the sample;
running a countermeasure compiler that uses the event data to generate a countermeasure data for a countermeasure to the malware; and
producing the countermeasure by storing the countermeasure data in a resource data section of a precompiled template that includes executable code configured to interpret the countermeasure data,
wherein the countermeasure is an executable file, and
wherein executing the countermeasure on a computer executes the executable code to thereby inoculate the computer from infection by the malware or disinfect the computer by removing the malware from the computer,
wherein the monitoring subsystem is configured to:
run within a kernel of the operating system,
monitor a first process not associated with the sample,
monitor a second process,
monitor a tripwire file,
monitor a system file, and
to monitor an operating system registry; and

wherein the classifier is configured to:
run within the kernel of the operating system,
detect the malware based on the sample modifying the tripwire file,
detect the malware based on the sample modifying the system file,
detect the malware based on the sample terminating the first process,
detect the malware based on a type of access to the second process requested by the sample,
detect the malware based on an identity of the second process accessed by the sample, and
detect the malware based on the sample modifying or deleting a registry entry that the sample did not create.