Microsoft Technology Licensing, LLC

Ahmed S Hussain

Sterling M Reasor

Santanu Chakraborty

Catalin Daniel Sandu

Jason J Joyce

Alvin Loh

Jonathan Mark Keller

Ajith Kumar

Joseph Leo Faulhaber

Kanwaljit Marok

Nizan Manor

Methods, systems, and computer-readable media are disclosed for identifying telemetry data. A particular method scans a file and compares the file to at least one attribute to be used for telemetry collection. When the file is identified as a telemetry candidate, an offer to submit a sample of the file is sent to a server. A response to the offer is received from the server. If the response to the offer indicates an acceptance, a sample of the file is sent to the server.

Identification of telemetry data

An arrangement for dynamically identifying and intercepting potential software threats before they execute on a computer system is provided in which a file system filter driver (called a 'mini-filter') interfaces with an anti-malware service to selectively generate an alert event and allow the threat to run, in addition to generating an alert event and suspending the threat. The decision to suspend the threat or allow it to run is made through application of a cascading logic hierarchy that includes respective policy-defined actions, user-defined actions, and signature-defined actions. The mini-filter generates the alert event to the anti-malware service whenever a file is opened, or modified and closed. The service uses an engine to scan the file to identify potential threats which are handled though application of the logic hierarchy which provides for configurations defined in a lower tier of the hierarchy to be overridden by those contained in a higher tier.

Detection and dynamic alteration of execution of potential software threats

Growing community of inventors

Seattle, WA, United States of America

Ahmed S Hussain