Censys, Inc.

University of Michigan

Oceanit Laboratories, Inc.

J Alex Halderman

Paul A Parkanzky

Jeff Cody

David Adrian

David Siu

Max Froehlich

Steven Sprecher

Ky Ho

Wen Plotnick

Various embodiments of apparatuses and methods for a continuous scanning engine with automatic protocol detection are described. In some embodiments, the continuous scanning engine comprises one or more discovery components and one or more protocol detection components. The discovery components, in some embodiments, send initial packets to a plurality of ports of a plurality of network addresses of a network, receive responses to a least some of the initial packets, asynchronously match the received responses to the sent initial packets, and determine that some ports at some network addresses require further analysis. The protocol inspection components, in some embodiments, attempt to communicate with the ports at the network addresses using a plurality of communication protocols, determine that an attempted communication protocols results in a successful communication, and provides the port, the network address, and the attempted communication protocol that resulted in the successful communication to a database.

Continuous scanning engine with automatic protocol detection

Disclosed herein are devices, systems, and methods for detecting, mitigating, and protecting against malicious actions and/or malicious computer software, including malware and ransomware. Specifically, disclosed embodiments mitigate the threat of ransomware across a wide range of devices including, for example, servers, storage systems, computers, and portable storage devices. At least one embodiment stealthily detects malicious actions by interposing when a file is opened for writing, creating a temporary checkpoint, comparing existing data in the file to what will be written to determine if it is destructive, and, if the behavior is malicious and/or destructive, preserving the checkpoint. At least a further embodiment can be implemented on, and/or ported in, a portable storage device (e.g., a USB device).

Devices, systems, and methods for ransomware protection and mitigation

Various embodiments of a scanning engine are described. In some embodiments, the scanning engine comprises discovery components associated with different Internet providers and/or protocol detection components associated with the different Internet providers. When a first discovery component associated with a first Internet provider does not receive a response from a port at an Internet address, then a second discovery component associated with a second Internet provider sends packets to that port at that Internet address to attempt to elicit a response. When a first protocol inspection component associated with a first Internet provider is not able to communicate with a port at an Internet address, then it provides information that can be obtained by a second protocol inspection component associated with a second Internet provider. That second protocol inspection component attempts to communicate with the port at the Internet address through the second Internet provider using various communication protocols.

Scanning engine with multiple perspectives

Growing community of inventors

Ann Arbor, MI, United States of America

J Alex Halderman