Patent Document ID: 8549641
Application ID: 12553658
Patent Status: 1

Claim One:
1. A method for remotely auditing a security posture of a client machine at a centralized server, the method comprising: receiving, by the centralized server, a security report from the client machine, wherein the security report comprises entries associated with a plurality of security events, wherein a respective entry of the security report indicates a particular security event to be executed on the client machine, and wherein a respective entry of the security report is generated and encrypted using an entry-specific signing key that is erased after the respective entry is encrypted and before the security event takes effect at the client machine, thereby preventing entries of the security report from being corrupted by a security attack; detecting a pattern among entries in one or more reports received from one or more client machines, wherein the pattern indicates a probable security attack, and wherein detecting the pattern involves: obtaining a fixed public key for a respective report, wherein the fixed public key provides a decryption key corresponding to a plurality of entry-specific signing keys each used to encrypt an entry of the respective report; decrypting entries of the respective report using the corresponding fixed public key; determining characteristics of the security event and the client machine configuration from the one or more security reports that were recorded before the security event takes effect; and analyzing the determined characteristics to identify the detected pattern; and classifying the security posture of the client machine based on the detected pattern.