PATENT CLAIM ANALYSIS

Application Number: 16137218
Application Type: Utility
Filing Date: 2018-09
Publication Date: 2019-01
Patent Classification: ["726", "001000"]

Abstract:
A variety of techniques are disclosed for detection of advanced persistent threats and similar malware. In one aspect, the detection of certain network traffic at a gateway is used to trigger a query of an originating endpoint, which can use internal logs to identify a local process that is sourcing the network traffic. In another aspect, an endpoint is configured to periodically generate and transmit a secure heartbeat, so that an interruption of the heartbeat can be used to signal the possible presence of malware. In another aspect, other information such as local and global reputation information is used to provide context for more accurate malware detection.

Claim (Index 1):
A system comprising:\n an endpoint associated with an enterprise, the endpoint including a computing device comprising a memory and a processor, the endpoint executing a process from a file, and the endpoint configured to evaluate a local reputation of the file based at least in part on a certificate associated with a source of the file; a gateway associated with the enterprise and coupled in a communicating relationship with the endpoint, the gateway configured to detect the process executing from the file on the endpoint and to request a global reputation of the file from a remote resource, the gateway further configured to enforce a network policy of the enterprise by detecting network traffic from the endpoint in violation of the network policy and providing a violation notification to the remote resource in response to the network traffic; and a threat management facility associated with the enterprise and coupled in a communicating relationship with the gateway and the endpoint, the threat management facility configured to receive the request from the gateway and to determine a global reputation of the file, the threat management facility further configured to receive the local reputation from the endpoint and, in response to receipt of the violation notification, to respond by determining a remedial action for the file on the endpoint based upon the local reputation, the global reputation, and the violation notification from the gateway in response to the network traffic from the endpoint in violation of the network policy.

Metadata:
- Claim Count in Document: 50.0
- Percentile: 97.0
- Lexical Diversity: 1.73134
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['14263977', '15206988', '14263955', '15042916', '15970846']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2927247477029354
- 35 USC 102 Novelty (BERT): 0.50390163412591
- Combined Prediction Score: 0.3138424363452329
- Mean Citation Score: 227.62746600000003
- Max Citation Score: 289.7383
- Similarity Product: 236.3276308783173

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 0
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test