SYSTEM, METHOD, AND APPARATUS FOR PROVIDING NETWORK SECURITY

• US 20140215621A1
• Filed: 01/24/2014
• Published: 07/31/2014
• Est. Priority Date: 01/25/2013
• Status: Active Grant

• Current Assignee: Remtcs Inc.
• Original Assignee: Remtcs Inc.
• Inventors: Xaypanya, Tommy, Malinowski, Richard E.
• Granted Patent: US 9,332,028 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Methods, systems, and apparatuses for proactively protecting a computing network are disclosed. A proactive security mechanism is disclosed, among other things, with the ability to monitor a protected domain in real-time and safely identify inoculation procedures for responding to threats introduced to the protected domain via malware. The proactive security mechanism includes an Artificial Neural Network Interface (ANNI) configured to execute at least some features of the proactive security mechanism.

Claims

1. A method, comprising:

proactively monitoring activity of a networked computing device in real-time;

in response to monitoring the activity of the networked computing device, determining that potential malware has been received at the networked computing device; and

in response to determining that potential malware has been received at the networked computing device, placing the potential malware into an isolation hypervisor for analysis.

2. The method of claim 1, wherein the isolation hypervisor comprises a virtual machine that enables the potential malware to be safely booted within a virtual environment such that it can be decompiled for forensics.

3. The method of claim 2, further comprising:

decompiling the potential malware within the isolation hypervisor;

determining that the potential malware corresponds to actual malware;

determining a signature unique to the actual malware; and

storing the signature unique to the actual malware such that the signature unique to the actual malware is available for analysis at all computing devices connected to a protected domain.

4. The method of claim 3, further comprising:

tracing a route path of the actual malware; and

determining a source of the actual malware.

5. The method of claim 1, wherein proactively monitoring activity of the networked computing device in real-time comprise analyzing at least one of the following:

user behavior at the networked computing device;

contents of one or more packets received at the networked computing device;

contents of one or more packet fragments received at the networked computing device;

contents of one or more packet headers received at the networked computing device; and

routines being executed by the networked computing device.

6. The method of claim 1, wherein the analysis occurs at least partially during system interrupts.

7. The method of claim 1, wherein an Analytical Neural Network Interface (ANNI) is used to at least one of monitor activity at the networked computing device, determine that the potential malware has been received at the networked computing device, and place the potential malware into the isolate hypervisor.

8. The method of claim 7, wherein the ANNI is used to analyze the potential malware in the isolation hypervisor.

9. The method of claim 7, wherein the ANNI is executed in at least one of a CPU, GPU, and APU.

10. The method of claim 1, further comprising:

deploying sensors at one or more facilities outside of a protected domain;

analyzing, via the deployed sensors, at least one of behavioral and hacking trends; and

based on the analysis at the deployed sensors, creating one or more countermeasures for execution within the protected domain in response to the at least one of behavioral and hacking trends.

11. A non-transitory computer-readable medium comprising processor-executable instructions that, when executed by a processor, perform a method, the method comprising:

proactively monitoring activity of a networked computing device in real-time;

in response to monitoring the activity of the networked computing device, determining that potential malware has been received at the networked computing device; and

in response to determining that potential malware has been received at the networked computing device, placing the potential malware into an isolation hypervisor for analysis.