PATENT CLAIM ANALYSIS

Application Number: 16272830
Application Type: Utility
Filing Date: 2019-02
Publication Date: 2019-08
Patent Classification: ["726", "023000"]

Abstract:
The improved detection of malicious processes executing on a networked computing device is provided. An agent running on the networked computing device monitors the communications transmitted to devices outside of the network to determine whether the process is likely using a periodic beacon signal to communicate with an external control center associated with a potentially malicious party. The agent maintains a dictionary data structure of objects, identifiable by the process identifier and the remote device's address, to track a given process/destination group's communication history. The communication history is updated when new messages are identified for periodic patterns to be identified for the messages, which may be used to identify a process as potentially malicious.

Claim (Index 1):
A method for identifying potential malware in a network environment, comprising:\n detecting, on a server within the network environment, a communication from a process running on the server, wherein the communication is addressed to a remote device that is not part of the network environment; determining a tuple comprising a process identifier for the process and an address for the remote device; determining whether a periodicity object including the tuple currently exists; in response to determining that the periodicity object currently exists, determining whether the communication is part of an ongoing message or is part of a new message; in response to determining that the communication is part of the ongoing message, updating a last transmission time maintained by the periodicity object; in response to determining that the communication is part of the new message:\n calculating a time variance for the new message; \n updating a message counter maintained by the periodicity object; \n updating an average time variance maintained by the periodicity object based on the average time variance, the time variance, and the message counter; \n updating a standard deviation maintained by the periodicity object based on the average time variance, the time variance, the standard deviation, and the message counter; \n in response to updating the standard deviation, determining whether the standard deviation satisfies a suspicion condition; and \n in response to determining that the standard deviation satisfies the suspicion condition, generating an alert.

Metadata:
- Claim Count in Document: 50.0
- Percentile: 99.0
- Lexical Diversity: 1.61842
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['15265670', '15265721', '15192034', '15339558', '13104804']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2090126658077128
- 35 USC 102 Novelty (BERT): 0.5052595352012853
- Combined Prediction Score: 0.2386373527470701
- Mean Citation Score: 144.229916
- Max Citation Score: 296.2112
- Similarity Product: 280.03909238967896

Labels:
- Claim Label 101: 0
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 0
- Label 101 Adjusted: 0

Dataset: test