Executable Download Tracking System

• US 20090113548A1
• Filed: 10/31/2007
• Published: 04/30/2009
• Est. Priority Date: 10/31/2007
• Status: Active Grant

• Current Assignee: Bank of America Corp., Hexcel Corporation
• Original Assignee: Bank of America Corp.
• Inventors: Gray, Robert, Morris, Anthony
• Granted Patent: US 8,959,624 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 2209/60 Digital content management, e.g. content distribution

Abstract

Systems and methods are disclosed for monitoring executable software applications on a computer network. Executable software applications and data files may be monitored by a risk monitoring system. The executable software application and data files may attempt to access a computer network and/or a computing device and a monitoring process may identify risks associated with the executable software application and/or data file. A suspicious characteristic of the executable software application may be identified during the monitoring process. The suspicious characteristic may be malware and may be neutralized before it causes damage to the computer network and/or computing device.

Claims

1. A method of monitoring computer-readable instructions, comprising:

identifying an executable portion of the computer-readable instructions received on a computer network from a source;

classifying the executable portion of the computer-readable instructions as a risk;

neutralizing the risk on the computer network; and

identifying the source of the risk.

2. The method of claim 1, where the source is an Internet Protocol address.

3. The method of claim 1, further comprising blocking the source of the risk from accessing the computer network.

4. The method of claim 1, where the neutralizing the risk includes analyzing the executable portion of the computer-readable instructions with anti-virus software.

5. The method of claim 1, where the risk is malware.

6. The method of claim 5, where the malware is at least one of a computer virus, a worm, a keylogger, and a Trojan.

7. The method of claim 1, further comprising generating a report that includes at least one risk.

8. The method of claim 6, where the report is stored in a data file.

9. The method of claim 6, where the report is updated at least once each week.

10. The method of claim 1, further comprising compiling the risk in a risk history data file.

11. The method of claim 6, where the risk is saved in a data store.

12. The method of claim 6, where the risk is identified as an urgent risk.

13. The method of claim 10, where the urgent risk causes the report to be updated.

14. The method of claim 1, where the neutralizing the risk occurs when the risk is identified.

15. The method of claim 1, where the neutralizing the risk occurs after the risk is identified.

16. A method of monitoring data files on a computer network, comprising:

receiving an executable software application on a first computer network from a second computer network;

identifying at least one suspicious characteristic of the executable software application;

determining whether the at least one suspicious characteristic of the executable software application is malware; and

preventing the malware from contaminating the first computer network by at least one deleting, quarantining, repairing, cleaning, blocking, rejecting, and neutralizing.

17. The method of claim 16, further comprising authenticating the executable software application based at least in part on analyzing the suspicious characteristic.

18. The method of claim 16, further comprising identifying a source of the malware.

19. The method of claim 18, where the malware is at least one of a computer virus, a worm, a keylogger, and a Trojan.

20. The method of claim 18, where the source is an Internet Protocol address.

21. The method of claim 16, where the determining whether the at least one suspicious characteristic of the executable software application is malware includes an analysis of the executable software application by at least one anti-virus software

22. The method of claim 21, where the analysis by the anti-virus software is at least partially performed on the computer network.

23. A risk monitoring system, comprising:

a computing device that contains computer readable instructions for authenticating an executable software application received on a computer network;

a receiver for receiving data associated with the executable software application;

a server comprising memory for storing the data in a data file; and

a processor for executing the computer-executable instructions to perform a method, comprising;

receiving an executable software application on a first computer network from a second computer network;

identifying at least one suspicious characteristic of the executable software application;

determining whether the at least one suspicious characteristic of the executable software application is malware; and

preventing the malware from contaminating the first computer network by at least one of filtering, blocking, rejecting, and neutralizing.