Patent ID: 11909761
Assignee: FORTINET, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 22:
23. A system for malware recovery, the system comprising:
a processing resource associated with a sandbox service; and
a non-transitory computer medium embodying accessible by the processing resource, wherein the non-transitory computer readable medium includes a set of instructions, which when executed by one or more processing resources associated with a sandbox service, causes the one or more processing resources to perform a method comprising:
receiving a file containing malware via a communication network from an endpoint device and contextual information associated with the file, wherein the endpoint device has been infected by the malware;
capturing information regarding a first series of actions performed by the malware, wherein the capturing is done based at least in part upon receiving the file and the contextual information;
generating a remediation script specifying a second series of actions that are configured to restore the endpoint device to a pre-infected state representing a state of the endpoint device prior to being infected by the malware, wherein the generating is based at least in part on the first series of actions;
transferring the remediation script to an endpoint agent executing on the endpoint device via the communication network; and causing the endpoint device to execute the remediation script.