PATENT CLAIM ANALYSIS

Application Number: 16272830
Application Type: Utility
Filing Date: 2019-02
Publication Date: 2019-08
Patent Classification: ["726", "023000"]

Abstract:
The improved detection of malicious processes executing on a networked computing device is provided. An agent running on the networked computing device monitors the communications transmitted to devices outside of the network to determine whether the process is likely using a periodic beacon signal to communicate with an external control center associated with a potentially malicious party. The agent maintains a dictionary data structure of objects, identifiable by the process identifier and the remote device's address, to track a given process/destination group's communication history. The communication history is updated when new messages are identified for periodic patterns to be identified for the messages, which may be used to identify a process as potentially malicious.

Claim (Index 11):
A system for identifying potential malware in a network environment, comprising:\n a plurality of servers within the network environment, each server of the plurality of servers comprising a processor and a computer memory storage device including instructions, which when executed by the processor, are operable to provide a periodicity agent on a given server, wherein the periodicity agent is operable to: monitor outbound communications from processes running on the given server to remote destinations outside of the network environment; create a periodicity object for each process/destination tuple, wherein the periodicity object maintains a process/destination tuple, a last communication time, a last message start time, an average time range between messages, and a standard deviation of the average time range; in response to observing an outbound communication for a given process/destination tuple at a given time:\n update the last communication time maintained by an associated periodicity object to the given time; \n determine whether the outbound communication is a latest communication of an ongoing message or a first communication of a new message; \n in response to determining that the outbound communication is a first communication, calculate a difference between the last message start time and the given time and update the average time range and the standard deviation based on the difference; \n in response to updating the standard deviation to satisfy a suspicion condition, generate an alert.

Metadata:
- Claim Count in Document: 50.0
- Percentile: 99.0
- Lexical Diversity: 1.61842
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['15265670', '15265721', '15192034', '15339558', '13104804']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2090102240293389
- 35 USC 102 Novelty (BERT): 0.5052827249110723
- Combined Prediction Score: 0.2386374741175122
- Mean Citation Score: 144.229916
- Max Citation Score: 296.2112
- Similarity Product: 279.9223361492157

Labels:
- Claim Label 101: 0
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 0
- Label 101 Adjusted: 0

Dataset: test