Devices, systems, and methods for detecting proximity-based mobile malware propagation
First Claim
Patent Images
1. A device comprising:
- a processor; and
a memory that stores a malware and an agent logic that, when executed by the processor, causes the processor to perform operations comprisingdiscovering a plurality of devices in a proximity,compiling a list of discovered devices in the proximity,creating a trigger by the agent logic, wherein the trigger, when selected, causes the agent logic to connect to an agent server on a network, and wherein the agent server collects malware signatures,inserting the trigger into the list of discovered devices, wherein the trigger appears to the malware to be one of the list of discovered devices,receiving, from the malware, a request to connect to the trigger, andin response to receiving the request to connect to the trigger, connecting to the agent server and reporting malware activity to the agent server.
1 Assignment
0 Petitions
Accused Products
Abstract
Devices, systems, and methods are disclosed. An agent resides in a mobile communication device. The agent detects Proximity-based Mobile Malware Propagation. The agent injects one or more trigger network connections in the candidate connection list. These connections appear as legitimate networks and devices, but instead trigger connection to an agent server on a service provider'"'"'s network. By attempting to connect through the trigger network connection, the malware reveals itself. The system helps collect the malware signature within a short period of time after the malware outbreak in local areas, though such attacks typically bypass network based security inspection in the network.
-
Citations
20 Claims
-
1. A device comprising:
-
a processor; and a memory that stores a malware and an agent logic that, when executed by the processor, causes the processor to perform operations comprising discovering a plurality of devices in a proximity, compiling a list of discovered devices in the proximity, creating a trigger by the agent logic, wherein the trigger, when selected, causes the agent logic to connect to an agent server on a network, and wherein the agent server collects malware signatures, inserting the trigger into the list of discovered devices, wherein the trigger appears to the malware to be one of the list of discovered devices, receiving, from the malware, a request to connect to the trigger, and in response to receiving the request to connect to the trigger, connecting to the agent server and reporting malware activity to the agent server. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A system comprising:
a mobile communication device in communication with an agent server, wherein the mobile communication device stores a malware and an agent logic that, when executed by the mobile communication device, causes the mobile communication device to perform operations comprising discovering a plurality of devices in a proximity of the mobile communication device, compiling a list of discovered devices in the proximity, creating a trigger that, when selected, causes the agent logic to connect to the agent server, inserting the trigger into the list of discovered devices, wherein the trigger appears to the malware to be one of the list of discovered devices, receiving a request to connect to the trigger, and in response to receiving the request to connect to the trigger, connecting to the agent server and reporting malware activity to the agent server. - View Dependent Claims (11, 12, 13, 14, 15)
-
16. A method comprising:
-
discovering, by a mobile communications device that executes an agent logic and stores a mobile malware, a plurality of devices in a proximity of the mobile communications device; compiling, by the mobile communications device, a list of discovered devices in the proximity; creating, by the mobile communications device, a trigger that, when selected, causes the agent logic to connect to an agent server that collects malware signatures; inserting, by the mobile communications device, the trigger into the list of discovered devices; receiving, by the agent logic, a request to connect to the trigger; and in response to receiving the request to connect to the trigger, connecting, by the mobile communications device, to the agent server and reporting malware activity to the agent server. - View Dependent Claims (17, 18, 19, 20)
-
Specification
-
- Resources
Litigation Campaign Assessment
Thank you for your request. You will receive a custom alert email when the Litigation Campaign Assessment is available.
×
-
Current AssigneeAT&T Intellectual Property I LP (AT&T, Inc.)
-
Original AssigneeAT&T Intellectual Property I LP (AT&T, Inc.)
-
InventorsWang, Wei, Xu, Gang, de los Reyes, Gustavo
-
Primary Examiner(s)Siddiqi, Mohammad A
-
Application NumberUS14/311,433Publication NumberTime in Patent Office484 DaysField of Search726 22- 25, 455/67.11, 455/411, 455/522, 713/1US Class Current1/1CPC Class CodesG06F 21/00 Security arrangements for p...G06F 21/564 by virus signature recognitionG06F 2221/034 Test or assess a computer o...G06F 2221/2111 Location-sensitive, e.g. ge...H04L 63/1416 Event detection, e.g. attac...H04L 63/145 the attack involving the pr...
