British Telecommunications Public Limited Company

Xiao-Si Wang

Ian Herwono

Zhan Cui

Ali Sajjad

Jessica Welding

Conor Hocking

Bogdan Blaga

Christopher Nugent

Stephanie Kiss

Pushpinder Chouhan

A malware protection method to protect at least a subset of a set of computer systems from a malware includes accessing a model of the set of computer systems, the model identifying interacting pairs of the computer systems in the set based on interactions corresponding to previous communication occurring between the computer systems in the pair; simulating, over a plurality of time periods, a propagation of the malware originating from a predetermined source computer system in the model, the simulation being based on a number of interactions per time period between each interacting pair of computer systems in the set, and a rate of transmission of the malware per interaction; and, responsive to the simulating, identifying one or more computer systems or interacting pairs of computer systems to deploy a malware protection measure thereto so as to inhibit a propagation of the malware through the set of computer systems.

Malware propagation forecasting

A computer implemented malware protection method to protect at least a subset of computer systems in a population of network-connected computer systems, including determining a distribution of predicted final infection size, each predicted final infection size being determined by a forecasting simulation of malware propagation from an originating system in the population; determining a plurality of ranges of final infection size from the distribution; determining weighted associations between clusters of computer systems and ranges of final infection size based on measures of numbers of originating computer systems in each cluster associated with each range of final infection size; and deploying protective measures for one or more clusters of computer systems responsive to the weighted associations.

Malware protection based on final infection size

A computer implemented malware protection method to mitigate malware spread within a set of communicating computer systems from an infected computer system is disclosed.

Identifying computer systems for malware infection mitigation

A computer implemented method of protecting a target subnet, including a set of network connected devices in a hierarchy of subnets of a computer network, from malware attack. The method includes generating a dynamical system for each subnet in the network, each dynamical system modelling a rate of change of a number of network connected devices in the subnet that are: susceptible to infection by the malware; infected by the malware; protected against infection by the malware; and remediated of infection by the malware. The dynamical systems are based on rates of transmission of the malware between pairs of subnets; evaluating a measure of risk of infection of the target subnet at a predetermined point in time based on the dynamical system for the target subnet; and responsive to the measure of risk meeting a predetermined threshold, deploying malware protection measures to devices in the target subnet.

Malware infection prediction

A computer implemented method of protecting a portion of a computer network from malware attack, the computer network including a network connected devices organized into hierarchical subnets modelled by a tree data structure in which each subnet is represented as a node in the tree, each node having a connection to parent node save for a root node, the method including performing protective actions on devices in subnets associated with a first subset of nodes to provide protection against the malware, prioritizing devices in the subnets associated with a second subset of nodes so as to provide a barrier of subnets protected against the malware to impede the propagation of the malware to devices in subnets associated with each of the first subset of nodes.

Growing community of inventors

London, United Kingdom

Xiao-Si Wang