Patent: detecting non-compliant software
A method for spotting unauthorized software on a device without false alarms when changes are approved. Granted in 2013, with a continuation in 2014.
Two colleagues and I patented a way to detect unauthorized software, such as malware, installed on a device.
How it works
On a regular schedule, the device checks a flag.
- Baseline state: it records a baseline of the software modules installed on the device.
- Check state: it builds a fresh list of those modules, compares it to the baseline, and raises an alert if anything is different.
The flag is set by the device’s authorization policy. That’s what lets approved software changes happen without setting off false alarms: during an approved change, the device simply takes a new baseline. Results of each comparison can be added to an activity log.
The record
- Filed August 20, 2009 and first published as US 2011/0047621 on February 24, 2011.
- Granted as US 8,443,448 on May 14, 2013.
- A continuation was published as US 2013/0247196 on September 19, 2013 and granted as US 8,898,791 on November 25, 2014.
Full text: US 8,443,448 · US 8,898,791