Patent SG-11201903491X-A (SG)
Title: Dynamic reputation indicator for optimizing computer security operations
Inventor: HAJMASAN GHEORGHE-FLORIN
IPC: H04L29/06
Filed: 2017-10-26
Abstract: INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property ::::` , 111111111111111111111111111 01111101 0 11H011110111111011101 1011111101111 0111111 Organization International Bureau (10) International Publication Number 03 (43) International Publication Date ......°' WO 2018/077996 Al 03 May 2018 (03.05.2018) WIP0 I PCT (51) International Patent Classification: sc.I, et. IV, ap. 17, Judetul Cluj, 400607 Cluj-Napoca (RO). GOOF 21/56 (2013.01) H04L 29/06 (2006.01) PORTASE, Radu-Marian; Str. Dragos Voda nr. 85A, (21) International Application Number: Judet Maramures, 435700 Viseu de Sus (RO). PCT/EP2017/077390 (74) Agent: TULUCA, Doina; Bd. Lacul Tei 56, bl. 19, sc. B, ap. 52, sector 2, 020392 BUCURESTI (RO). (22) International Filing Date: 26 October 2017 (26.10.2017) (81) Designated States (unless otherwise indicated, for every (25) Filing Language: English kind of national protection available): AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, (26) Publication Language: English CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, (30) Priority Data: DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, 15/336,387 27 October 2016 (27.10.2016) US HR, HU, ID, IL, IN, IR, IS, JO, JP, KE, KG, KH, KN, KP, KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, (71) Applicant: BITDEFENDER IPR MANAGEMENT MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, LTD [CY/CY]; Kreontos 12, Nicosia, 1076 (CY). OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, (72) Inventors: HAJMASAN, Gheorghe-Florin; Sat Lunca TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. Muresului nr. 351, Judet Alba, 547037 Corn. Lunca Mure- sului (RO). MONDOC, Alexandra; Piata Marasti nr. 3 (54) Title: DYNAMIC REPUTATION INDICATOR FOR OPTIMIZING COMPUTER SECURITY OPERATIONS ------, Central reputation server 16a • .., , _ --- g 12a —\ 14a 20 Isolated Ni 11 environment 1 • ...._. ....., Central ............ ...--' reputation ....,.. -^\"\" database %....... ../ Network Ni 0 Ni Isolated environment 10b / 12h .. 10C 00 411 C D OOL_, 10a Client Client system system 1-1 FIG. 1 ..11 (57) : Described systems and methods allow protecting a computer A reputation manager executes on the computer system concurrently with 01 c : N dynamic reputation indicator to each executable entity seen as a unique combination IN and a set of loaded libraries). The reputation indicator indicates a probability IN of benign entities may increase in time. When an entity performs certain 0 —. reputation of the respective entity may drop. The anti-malware engine uses GC entity for malice, the protocol varying according to the entity's reputation. 1-1 © a more relaxed protocol than unknown or untrusted entities. system actions an entity-specific Entities system an anti-malware engine. The reputation manager associates a e Client that from which may be indicative of malicious activity, the trusted 5 malware such as viruses, worms, and spyware. of individual components (e.g., a main executable the respective entity is malicious. The reputation protocol to scan and/or monitor each target to be non-malicious may be analyzed using ei C [Continued on next page] WO 2018/077996 Al IMEDIMOM0101011MERIONIEMEHOHMOVOIMIE (84) Designated States (unless otherwise indicated, for every kind of regional protection available): ARIPO (BW, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). Published: — with international search report (Art. 21(3))