Malware infection prediction

Patent metadata

Field	Value
Publication number	US-11533333-B2
Application number	US-201915733663-A
Country	US
Kind code	B2
Filing date	Mar 19, 2019
Priority date	Mar 25, 2018
Publication date	Dec 20, 2022
Grant date	Dec 20, 2022

Abstract

A computer implemented method of protecting a target subnet, including a set of network connected devices in a hierarchy of subnets of a computer network, from malware attack. The method includes generating a dynamical system for each subnet in the network, each dynamical system modelling a rate of change of a number of network connected devices in the subnet that are: susceptible to infection by the malware; infected by the malware; protected against infection by the malware; and remediated of infection by the malware. The dynamical systems are based on rates of transmission of the malware between pairs of subnets; evaluating a measure of risk of infection of the target subnet at a predetermined point in time based on the dynamical system for the target subnet; and responsive to the measure of risk meeting a predetermined threshold, deploying malware protection measures to devices in the target subnet.

First claim

The invention claimed is:

1. A computer implemented method of protecting a target subnet in a hierarchy of subnets of a computer network from malware attack, the subnet including a set of network connected devices, the method comprising:
generating a dynamical system for each subnet in the computer network, each dynamical system modelling a rate of change of a subset of network connected devices in the subnet that are:
susceptible to infection by malware;
infected by the malware;
protected against infection by the malware; and
remediated of infection by the malware;
wherein each dynamical system is based on rates of transmission of the malware between pairs of subnets and models a number of network connected devices in the subset over a period of time;

evaluating a measure of risk of infection of the target subnet at a predetermined point in time based on the dynamical system for the target subnet; and
responsive to the measure of risk meeting a predetermined threshold, deploying malware protection measures to devices in the target subnet.

2. The method of claim 1 , wherein the predetermined point in time is determined based on a time required to deploy the malware protection measures to all susceptible devices in the subnet.

3. The method of claim 1 , wherein the malware protection measures include modifications to devices in the target subnet such that susceptible devices in the target subnet are rendered insusceptible to the malware.

4. The method of claim 1 , wherein the malware protection measures include remediation measures to devices infected by the malware in the target subnet.

5. A non-transitory computer-readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer system to perform the method as claimed in claim 1 .

6. A computer system comprising:
a processor and memory storing computer program code for protecting a target subnet in a hierarchy of subnets of a computer network from malware attack, the subnet including a set of network connected devices, by:
generating a dynamical system for each subnet in the computer network, each dynamical system modelling a rate of change of a subset of network connected devices in the subnet that are:
susceptible to infection by malware;
infected by the malware;
protected against infection by the malware; and
remediated of infection by the malware;

wherein each dynamical system is based on rates of transmission of the malware between pairs of subnets and models a number of network connected devices in the subset over a period of time;
evaluating a measure of risk of infection of the target subnet at a predetermined point in time based on the dynamical system for the target subnet; and
responsive to the measure of risk meeting a predetermined threshold, deploying malware protection measures to devices in the target subnet.

Assignees

• British Telecomm

Inventors

• Wang xiao-si
• Cui Zhan
• Herwono Ian

Classifications

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title