PATENT CLAIM ANALYSIS

Application Number: 16250006
Application Type: Utility
Filing Date: 2019-01
Publication Date: 2019-05
Patent Classification: ["726", "023000"]

Abstract:
Processor(s) for detecting malicious software. A hardware virtual machine monitor (HVMM) operates under a host OS. Container(s) initialized with network application template(s) operate under a guest OS VM. A detection module operates under the guest OS VM includes a trigger detection module, a logging module and a container command module. The trigger detection module monitors activity on container(s) for a trigger event. The logging module writes activity report(s) in response to trigger event(s). The container command module issues command(s) in response to trigger event(s). The command(s) include a container start, stop and revert commands. A virtual machine control console operates under the host OS and starts/stops the HVMM. A container control module operates under the guest OSVM and controls container(s) in response to the command(s). The server communication module sends activity report(s) to a central collection network appliance that maintains a repository of activities for infected devices.

Claim (Index 35):
A method, comprising:\n initiating a first virtual environment within which to execute a first application, the first virtual environment isolating the first application from a second application executing within a second virtual environment, the first virtual environment and the second virtual environment providing a first level of virtualization within a second level of virtualization; monitoring behavior of the first application within the first virtual environment; and detecting, based on the monitoring, an unauthorized activity of the first application, the unauthorized activity including at least one of an unauthorized change to a non-modifiable section of the first virtual environment, a registry write, a start of a new process, corruption to an existing process, a web site visited, a redirected Uniform Resource Locator (URL), an infection detail, an event timeline, a network connection, a file system write, or a configuration change.

Metadata:
- Claim Count in Document: 59.0
- Percentile: 99.0
- Lexical Diversity: 2.71233
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['14808681', '12558841', '15841913', '15459563', '12059454']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2936975374463303
- 35 USC 102 Novelty (BERT): 0.561206403149755
- Combined Prediction Score: 0.3204484240166728
- Mean Citation Score: 386.554632
- Max Citation Score: 452.76294
- Similarity Product: 341.3376257950187

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 0
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test