The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.

The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.

Date of Patent:
Nov. 07, 2017

Filed:

Dec. 21, 2016
Applicant:

AO Kaspersky Lab, Moscow, RU;

Inventors:

Maxim Y. Golovkin, Moscow, RU;

Alexey M. Romanenko, Moscow, RU;

Alexey V. Monastyrsky, Moscow, RU;

Assignee:

AO Kaspersky Lab, Moscow, RU;

Attorneys:
Primary Examiner:
Int. Cl.
CPC ...
G06F 21/55 (2013.01); G06F 21/56 (2013.01);
U.S. Cl.
CPC ...
G06F 21/554 (2013.01); G06F 21/562 (2013.01); G06F 21/568 (2013.01); G06F 2221/034 (2013.01);
Abstract

Disclosed are system and method for protecting computers from unauthorized remote administration. One exemplary method comprises: intercepting events occurred in a computer system; determining parameters of each intercepted event for identifying each intercepted event as being relating to a first data transfer by an application in a computer network or a second data transfer to an application from a peripheral data input device of the computer system; determining two intercepted events as being dependent on each other; determining a rule defining a dependency of the parameters of the two intercepted events; determining a degree of similarity of the rule and a previously created rule; if the degree of similarity exceeding a selected threshold value, identifying at least one application based at least on the rule and the previously created rule; and analyzing the at least one application for detecting a remote administration application.


Find Patent Forward Citations

Loading…