PATENT CLAIM ANALYSIS

Application Number: 15903924
Application Type: Utility
Filing Date: 2018-02
Publication Date: 2018-07
Patent Classification: ["726", "023000"]

Abstract:
A variety of techniques are disclosed for detection of advanced persistent threats and similar malware. In one aspect, the detection of certain network traffic at a gateway is used to trigger a query of an originating endpoint, which can use internal logs to identify a local process that is sourcing the network traffic. In another aspect, an endpoint is configured to periodically generate and transmit a secure heartbeat, so that an interruption of the heartbeat can be used to signal the possible presence of malware. In another aspect, other information such as local and global reputation information is used to provide context for more accurate malware detection.

Claim (Index 37):
A system comprising:\n an endpoint in a first network, the endpoint configured to monitor software items executing on the endpoint and to create a heartbeat a security health status of the endpoint, the security health status based on the software items executing on the endpoint and the security health status indicating an uncompromised security health status when the endpoint is uncompromised; and a gateway between the endpoint in the first network and a second network separate from the first network, the gateway in communication with the endpoint over the first network, the gateway configured to receive the heartbeat from the endpoint and to receive and forward network traffic, other than the heartbeat, from the endpoint to a destination address in the second network, and to detect a change in the security health status included in the heartbeat, the gateway further configured to initiate remedial action directed to the endpoint based on a combination of the detected change of the security health status included in the heartbeat and detection of network traffic, other than the heartbeat, following detection of the change of the security health status, the remedial action including blocking network traffic from the endpoint.

Metadata:
- Claim Count in Document: 53.0
- Percentile: 88.0
- Lexical Diversity: 1.73134
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['14263966', '15206988', '15099542', '14263955', '14263977']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2799309165502012
- 35 USC 102 Novelty (BERT): 0.4763759136985626
- Combined Prediction Score: 0.2995754162650373
- Mean Citation Score: 190.952666
- Max Citation Score: 224.88129
- Similarity Product: 192.50981921991703

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 0
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test