PATENT CLAIM ANALYSIS

Application Number: 16272830
Application Type: Utility
Filing Date: 2019-02
Publication Date: 2019-08
Patent Classification: ["726", "023000"]

Abstract:
The improved detection of malicious processes executing on a networked computing device is provided. An agent running on the networked computing device monitors the communications transmitted to devices outside of the network to determine whether the process is likely using a periodic beacon signal to communicate with an external control center associated with a potentially malicious party. The agent maintains a dictionary data structure of objects, identifiable by the process identifier and the remote device's address, to track a given process/destination group's communication history. The communication history is updated when new messages are identified for periodic patterns to be identified for the messages, which may be used to identify a process as potentially malicious.

Claim (Index 17):
A computer-readable storage device including instructions that when executed by a processor on a server are operable to provide a periodicity agent performing steps comprising:\n maintaining a dictionary of periodicity objects, wherein a periodicity object of the dictionary of periodicity objects maintains:\n a tuple comprising a process identifier and a destination address, the tuple identifying the periodicity object; \n a last packet time, identifying a time at which a most recent packet has been observed for the tuple; \n a previous message start time, identifying a time at which a most recent message observed for the tuple originated; \n an average inter-message time, maintaining a running calculation for a mean time between observing originations of successive messages for the tuple; and \n a standard deviation, maintaining a running calculation for variance between the originations of successive messages and the average inter-message time; \n detecting a communication from a process running on the server, wherein the communication is addressed to a device that is not part of a network environment to which the server belongs and is observed at a given time; identifying a message tuple for the communication; determining, based on the message tuple, whether the dictionary includes a matching periodicity object; in response to determining that the dictionary does not include the matching periodicity object, creating the matching periodicity object in the dictionary; in response to determining that the dictionary includes the matching periodicity object: determining whether the communication is an initial packet for a new message or a most-recent packet for an ongoing message; in response to determining that the communication is the most-recent packet, updating the last transmission time maintained by the matching periodicity object to the given time; in response to determining that the communication is the initial packet:\n calculating a time difference between the given time and the previous message start time and updating the previous message start time to the given time; \n updating the average inter-message time maintained by the matching periodicity object based on the time difference; \n updating the standard deviation maintained by the matching periodicity object based on the time difference; \n in response to updating the standard deviation, determining whether the standard deviation satisfies a suspicion condition; and \n in response to determining that the standard deviation satisfies the suspicion condition, generating an alert.

Metadata:
- Claim Count in Document: 50.0
- Percentile: 99.0
- Lexical Diversity: 1.61842
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['15265670', '15265721', '15192034', '15339558', '13104804']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2090031231012754
- 35 USC 102 Novelty (BERT): 0.5053508546041454
- Combined Prediction Score: 0.2386378962515624
- Mean Citation Score: 144.229916
- Max Citation Score: 296.2112
- Similarity Product: 279.5792002754212

Labels:
- Claim Label 101: 0
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 0
- Label 101 Adjusted: 0

Dataset: test