Systems and methods for detecting a prior compromise of a security status of a computer system

Patent metadata

Field	Value
Publication number	US-11449605-B2
Application number	US-202016846477-A
Country	US
Kind code	B2
Filing date	Apr 13, 2020
Priority date	Apr 13, 2020
Publication date	Sep 20, 2022
Grant date	Sep 20, 2022

Abstract

A computer-implemented method for detecting a security status of a computer system may include: in response to satisfaction of a predetermined trigger condition associated with an electronic application installed on a memory of the computer system, performing a security check process on the computer system; in response to the security check process determining that a security status of the computer system is currently compromised, performing a first security action; and in response to the security check process determining that the security status is formerly compromised, performing a second security action.

First claim

What is claimed is:

1. A computer-implemented method for detecting a security status of a computer system, comprising:
in response to satisfaction of a predetermined trigger condition associated with an electronic application installed on a memory of the computer system, performing a security check process on the computer system, wherein the security check process includes:
in response to determining that an indicator application is not present on the memory, determining whether an indicator directory is accessible in the memory by performing a search process on the memory to identify at least two indicator directories in the memory, wherein:
the at least two indicator directories includes “etc/apt” and “/private/var/lib/apt/”; and
the search process identifies that at least the indicator directories “/etc/apt” and “/private/var/lib/apt/” are accessible on the memory; and

in response to determining that at least the indicator directories “/etc/apt” and “/private/var/lib/apt/” are accessible on the memory, determining that the security status of the computer system is formerly compromised; and

in response to the security check process determining that the security status is formerly compromised, performing a security action.

2. The computer-implemented method of claim 1 , wherein the security action includes:
enabling access to a first portion of a functionality of the electronic application, and
preventing access to a second portion of the functionality of the electronic application.

3. The computer-implemented method of claim 2 , wherein the security action further includes transmitting a report message to a server system associated with the electronic application that includes information associated with the security status of the computer system.

4. The computer-implemented method of claim 1 , wherein the predetermined trigger condition includes one or more of:
receiving a launch application instruction associated with the electronic application;
determining that a timer has expired; or
receiving an application security check instruction from a server system associated with the electronic application.

5. A system for detecting a security status of a computer system, the system comprising:
a memory storing instructions and an electronic application; and
a processor operatively connected to the memory and configured to execute the instructions to perform acts, the acts including:
in response to satisfaction of a predetermined trigger condition associated with the electronic application installed on the memory of the computer system, performing a security check process on the computer system, wherein the security check process includes:
in response to determining that an indicator application is not present on the memory, determining whether an indicator directory is accessible in the memory by performing a search process on the memory to identify at least two indicator directories in the memory, wherein:
the at least two indicator directories includes “/etc/apt” and “/private/var/lib/apt/”; and
the search process identifies that at least the indicator directories “/etc/apt” and “/private/var/lib/apt/” are accessible on the memory; and

in response to determining that at least the indicator directories “/etc/apt” and “/private/var/lib/apt/” are accessible on the memory, determining that the security status of the computer system is formerly compromised; and

in response to the security check process determining that the security status is formerly compromised, performing a security action.

6. The system of claim 5 , wherein the security action includes:
enabling access to a first portion of a functionality of the electronic application, and
preventing access to a second portion of the functionality of the electronic application.

7. The system of claim 6 , wherein the security action further includes transmitting a report message to a server system associated with the electronic application that includes information associated with the security status of the computer system.

8. The system of claim 5 , wherein the predetermined trigger condition includes one or more of:
receiving a launch application instruction associated with the electronic application;
determining that a timer has expired; or
receiving an application security check instruction from a server system associated with the electronic application.

9. A non-transitory computer-readable medium comprising instructions that are executable by at least one processor of a computer system to perform operations for detecting a security status of the computer system, the operations including:
in response to satisfaction of a predetermined trigger condition associated with an electronic application installed on a memory of the computer system, performing a security check process on the computer system, the security check process including:
in response to determining that an indicator application is not present on the memory, determining whether an indicator directory is present on the memory of the computer system by performing a search process on the memory to identify at least two indicator directories in the memory, wherein:
the at least two indicator directories include “etc/apt” and “/private/var/lib/apt/”; and
the search process identifies that at least the indicator directories “/etc/apt” and “/private/var/lib/apt/” are accessible on the memory; and

in response to determining that at least the indicator directories “/etc/apt” and “/private/var/lib/apt/” are accessible on the memory, determining that the security status of the computer system is formerly compromised; and

in response to the security check process determining that the security status is formerly compromised, performing a security action.

Assignees

• Capital One Services Llc

Inventors

• Whitmore Jon

Classifications

• G06F16/148

  File search processing · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/629

  to features or functions of an application · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title