Patent SG-11201804327T-A (SG)
Title: Dual memory introspection for securing multiple network endpoints
Inventor: LUTAS DAN-HOREA
IPC: G06F21/56
Filed: 2016-12-19
Abstract: Title: DUAL MEMORY INTROSPECTION FOR SECURING MULTIPLE NETWORK ENDPOINTS (57) : Described systems and methods enable protecting multiple client systems (e.g., a corporate network) from computer security threats such as malicious software and intrusion. In some embodiments, each protected client operates a live introspection engine and an on-demand introspection engine. The live introspection engine detects the occurrence of certain events within a pro - tected virtual machine exposed on the respective client system, and communicates the occurrence to a remote security server. In turn, the server may request a forensic analysis of the event from the client system, by indicating a forensic tool to be executed by the cli - ent. Forensic tools may be stored in a central repository accessible to the client. In response to receiving the analysis request, the on- demand introspection engine may retrieve and execute the forensic tool, and communicate a result of the forensic analysis to the se - curity server. The server may use the information to determine whether the respective client is under attack by malicious software or an intruder. l2d Client database Client system 11 12b Client system Security server Communication network 14 15 Client system Central tool repository FIG. 1 12c (12) INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property Organization International Bureau 111111111111110 III OE III OE III II III 11111111111111111111 11111111I RIII 11111111 (10) International Publication Number WO 2017/103254 Al WIPO I PCT (43) International Publication Date 22 June 2017 (22.06.2017) (81) Designated States (unless otherwise indicated, for every kind of national protection available): AE, AG, AL, AM, AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, BZ, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IR, IS, JP, KE, KG, KR KN, KP, KR, KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, ZW. (84) Designated States (unless otherwise indicated, for every kind of regional protection available): ARIPO (BW, GH, GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, SM, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, GW, KM, ML, MR, NE, SN, TD, TG). Published: PCT/EP2016/081697 (51) International Patent Classification: GOOF 21/56 (2013.01) (21) International Application Number: (22) International Filing Date: 19 December 2016 (19.12.2016) English English (25) Filing Language: (26) Publication Language: (30) Priority Data: 62/269,952 19 December 2015 (19.12.2015) US (71) Applicant: BITDEFENDER IPR MANAGEMENT LTD [CY/CY]; Kreontos 12, Nicosia, 1076 (CY). (72) Inventors: LUTAS, Dan-Horea; Str. Horea nr. 89-95, ap. 29, Judetul Cluj, 400202 Cluj-Napoca (RO). LUKACS, Sandor; Bld. Cetatea Fetei bl. B et. 3, Judetul Cluj, 407280 Sat Floresti, Com. Floresti (RO). TICLE, Daniel- ioan; Str. Salinelor nr. 21, Judetul Cluj, 401106 Turda (RO). CIOCAS, Radu-Ioan; Str. Alverna nr. 39-41 ap. 21, Judetul Cluj, 400469 Cluj-Napoca (RO). ANICHITEI, Ionel-Cristinel; Sat Ortoaia nr. 138, Judetul Suceava, 727203 Comuna Doma-Arini (RO). (74) Agent: TULUCA, Doina; Bd. Lacul Tei 56, bl. 19, sc. B, ap. 52, sector 2, 020392 Bucuresti (RO). with international search report (Art 21(3)) W O 20 17 / 103 25 4 Al