US 11,895,147 B2
System and method for suspending a computing device suspected of being infected by a malicious code using a kill switch button
Adam B. Richman, Charlotte, NC (US); William Thomas Stranathan, Charlotte, NC (US); Anusha Ravulapati, Aurora, IL (US); Kenneth Aaron Kaye, Highlands Ranch, CO (US); Nikhil Harish Sanil, Charlotte, NC (US); Alice Yali Chang, Alexandria, VA (US); and Brady Prentice Merkel, Jacksonville Beach, FL (US)
Assigned to Bank of America Corporation, Charlotte, NC (US)
Filed by Bank of America Corporation, Charlotte, NC (US)
Filed on Nov. 29, 2022, as Appl. No. 18/059,882.
Application 18/059,882 is a continuation of application No. 17/141,307, filed on Jan. 5, 2021, granted, now 11,588,848.
Prior Publication US 2023/0087631 A1, Mar. 23, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/00 (2013.01); H04L 9/40 (2022.01); G06F 21/56 (2013.01); G06F 21/52 (2013.01)
CPC H04L 63/145 (2013.01) [G06F 21/52 (2013.01); G06F 21/56 (2013.01); G06F 2221/033 (2013.01); G06F 2221/2143 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A system for suspending a computing device suspected of being infected by a malicious code, comprising:
a memory operable to store a software instruction that is executed to initiate a suspension procedure, wherein:
the suspension procedure is initiated when a computing device is suspected of being infected by a malicious code, and
when the malicious code is executed, the computing device becomes vulnerable to security threats comprising an unauthorized access to the memory;
a processor, operably coupled with the memory, configured to:
receive, from a user, a triggering signal to initiate the suspension procedure;
capture one or more states of one or more instructions that are being executed by the processor, wherein the one or more instructions comprise the malicious code;
store the captured one or more states in the memory;
suppress the one or more instructions comprising the malicious code;
send one or more notification signals to one or more servers managing a user account associated with the user currently logged in at the computing device, indicating that the computing device is suspected of having been infected by the malicious code;
in response to sending the one or more notification signals to the one or more servers, the user account is suspended;
terminate network connections of the computing device such that the computing device is disconnected from other devices;
erase a particular portion of the memory in which boot up instructions are stored without which the computing device cannot be restarted, wherein the particular portion includes an address to a boot cycle operation;
determine a source of the malicious code from the stored captured one or more states in the memory; and
initiate security threat investigations using the determined source of the malicious code.