US 11,916,933 B2
Malware detector
Angelos Stavrou, Springfield, VA (US); Sushil Jajodia, Oakton, VA (US); Anup K. Ghosh, Centreville, VA (US); Rhandi Martin, St. James (BB); and Charalampos Andrianakis, Crete (GR)
Assigned to George Mason Research Foundation, Inc., Fairfax, VA (US)
Filed by George Mason Research Foundation, Inc., Fairfax, VA (US)
Filed on May 4, 2022, as Appl. No. 17/736,507.
Application 17/736,507 is a continuation of application No. 16/295,498, filed on Mar. 7, 2019, granted, now 11,330,000.
Application 16/295,498 is a continuation of application No. 15/359,026, filed on Nov. 22, 2016, granted, now 10,243,975, issued on Mar. 26, 2019.
Application 15/359,026 is a continuation of application No. 14/482,793, filed on Sep. 10, 2014, granted, now 9,531,747, issued on Dec. 27, 2016.
Application 14/482,793 is a continuation of application No. 12/757,675, filed on Apr. 9, 2010, granted, now 8,935,773, issued on Jan. 13, 2015.
Claims priority of provisional application 61/168,053, filed on Apr. 9, 2009.
Prior Publication US 2022/0278998 A1, Sep. 1, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/00 (2022.01); H04L 9/40 (2022.01); G06F 21/56 (2013.01); H04L 67/02 (2022.01)
CPC H04L 63/1416 (2013.01) [G06F 21/566 (2013.01); H04L 63/0884 (2013.01); H04L 63/145 (2013.01); G06F 2221/2103 (2013.01); G06F 2221/2119 (2013.01); H04L 63/08 (2013.01); H04L 67/02 (2013.01)] 19 Claims
OG exemplary drawing
 
1. An apparatus, comprising:
a memory; and
a hardware processor communicatively coupled to the memory, the hardware processor configured to:
intercept a first communication from a first application executing at a first compute device, the first communication addressed to a first server;
intercept a second communication from a second application different from the first application and executing at a second compute device, the second communication addressed to a second server;
produce a first active content challenge for the first application based on the first communication, the hardware processor configured to send the first active content challenge to the first compute device;
produce a second active content challenge for the second application based on the second communication, the second active content challenge being different than the first active content challenge, the hardware processor configured to send the second active content challenge to the second compute device;
identify whether the first application is malicious based at least in part on whether the hardware processor receives a first automatic non-user-interactive application response from the first application within a first predetermined time period following sending the first active content challenge to the first compute device; and
identify whether the second application is malicious based at least in part on whether the hardware processor receives a second automatic non-user-interactive application response from the second application, different than the first automatic non-user-interactive application response, and within a second predetermined time period following sending the second active content challenge to the second compute device.