Backward researching time stamped events to find an origin of pestware

• US 20070250928A1
• Filed: 04/20/2006
• Published: 10/25/2007
• Est. Priority Date: 04/20/2006
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Webroot Inc. (Open Text Corporation)
• Inventors: Boney, Matthew
• Granted Patent: US 8,181,244 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

A system and method for identifying an origin of suspected pestware activity on a computer is described. One embodiment includes establishing a time of interest relating to a suspicion of pestware on the computer, identifying, based upon the time of interest, indicia of pestware and accessing at least a portion of a recorded history of sources that the computer received files from so as to identify, based at least in part upon the identified indicia of pestware, a reference to an identity of a source that is suspected of originating pestware.

Claims

1. A method for identifying an origin of suspected pestware activity on a computer comprising:

establishing a time of interest relating to a suspicion of pestware on the computer;

identifying, based upon the time of interest, indicia of pestware;

accessing at least a portion of a recorded history of sources that the computer received files from so as to identify, based at least in part upon the identified indicia of pestware, a reference to an identity of a source that is suspected of originating pestware.

2. The method of claim 1, wherein the identifying includes:

accessing at least one log of historical events on the computer;

locating at least one event in the at least one log that corresponds to the time of interest; and

determining that the at least one event is associated with the indicia of pestware.

3. The method of claim 2, wherein the determining that the at least one event is associated with the indicia of pestware includes following references in the at least one log to a suspected pestware object.

4. The method of claim 3, wherein following the references includes following at least one reference in an activity log from the event to a suspected pestware process.

5. The method of claim 4, wherein the activity log is generated from a kernel-mode driver.

6. The method of claim 2, wherein the at least one log includes at least one log selected from the group consisting of an activity log, a browser history, browser cache, browser settings, operating system settings, an event log, a debugging log, a firewall log, file information and monitoring software logs.

7. The method of claim 1, wherein the time of interest is established from a user input.

8. The method of claim 5, wherein the user input is in response to an alert provided to the user.

9. The method of claim 1, wherein the time of interest is established from a time stamp of a substantially instant moment in time.

10. The method of claim 1, including:

reporting the identity of the source to a pestware research entity so as to enable the pestware research entity to research whether the source is a source of pestware.

11. The method of claim 1, wherein the source is identified by an identifier selected from the group consisting of an I.P. address, a URL, an email client and a program name.

19. The system of claim 1, wherein the timestamp module configured to generate the time of interest as a time interval.

20. The system of claim 1, wherein the timestamp module is configured to generate the time of interest as a point in time.

12. A system for identifying a source of suspected pestware on a computer including:

a timestamp module configured to generate a time of interest in response to a suspicion of pestware on the computer;

a research portion configured to access at least one log on the computer that relates the time of interest to at least one source of potential pestware activity on the computer; and

a reporting portion configured to generate a report that identifies the at least one source of potential pestware activity.

13. The system of claim 12, wherein the at least one log includes information that relates the time of interest to an event, and wherein the at least one log includes information that relates the event to a suspected pestware object, and wherein the at least one log includes information that relates the suspected pestware object to the at least one source of potential pestware activity.

14. The system of claim 13, including:

a heuristics module configured to evaluate whether the event is a suspected pestware-related event before the research portion accesses information in the at least one log that relates the event to the suspected pestware object.

15. The system of claim 14, wherein the heuristics module determines that the at least one event is suspected to be pestware-related by analyzing other events in connection with the event, wherein the other events are also related to the time of interest.

16. The system of claim 12, wherein the at least one log includes at least one log selected from the group consisting of an activity log, a browser history, browser cache, browser settings, operating system settings, an event log, a debugging log, a firewall log, file information and monitoring software logs.

17. The system of claim 12, wherein the timestamp module configured to generate a time of interest in response to user input, which indicates the suspicion of pestware on the computer.

18. The system of claim 17, wherein the user input is in response to an alert provided to the user.

21. The system of claim 12, including a kernel-mode driver adapted to monitor activity on the computer and to generate an activity log that is included within the at least one log.

22. The system of claim 12, wherein the at least one source of potential pestware activity is identified by an identifier selected from the group consisting of an I.P. address, a URL, an email client and a program name.

23. The system of claim 12, wherein the at least one log includes at least one log selected from the group consisting of an activity log, a browser history, browser cache, browser settings, operating system settings, an event log, a debugging log, a firewall log, file information and monitoring software logs.