US2007169191A1PendingUtilityA1

Method and system for detecting a keylogger that encrypts data captured on a computer

Individually held — no corporate assignee on recordPriority: Jan 18, 2006Filed: Jul 25, 2006Published: Jul 19, 2007

Est. expiryJan 18, 2026(expired)· nominal 20-yr term from priority

Inventors:Michael R. Greene Matt Parker

G06F 2221/031G06F 21/568G06F 21/552G06F 2221/2107G06F 21/566G06F 21/83

PatentIndex Score

Cited by

References

Claims

Abstract

A method and system for detecting a keylogger that encrypts data captured on a computer. One illustrative embodiment acquires a first sample of a portion of a memory of a computer, the portion of the memory being associated with a running process on the computer; inputs to the computer, in a manner that mimics keyboard input, a first data pattern consisting of at least one occurrence of each of a first set of distinct sub-patterns; acquires a second sample of the portion of the memory; compares the first and second samples of the portion of the memory to identify at least one data segment in which the second sample has changed relative to the first sample; and flags the running process as a potential keylogger when the at least one data segment contains a second data pattern matching the overall sub-pattern structure of the first data pattern despite the particular sub-patterns making up the first and second data patterns being different.

Claims

exact text as granted — not AI-modified

1 . A method for detecting a keylogger that encrypts data captured on a computer, the method comprising: 
 acquiring a first sample of a portion of a memory of the computer, the portion of the memory being associated with a running process on the computer;    inputting to the computer, in a manner that mimics keyboard input, a first data pattern consisting of at least one occurrence of each of a first set of distinct sub-patterns;    acquiring a second sample of the portion of the memory;    comparing the first and second samples of the portion of the memory to identify at least one data segment in which the second sample has changed relative to the first sample; and    flagging the running process as a potential keylogger when: 
 the at least one data segment contains a second data pattern consisting of at least one occurrence of each of a second set of distinct sub-patterns,  
 each sub-pattern in the second set of distinct sub-patterns occurs the same number of times in the second data pattern as a corresponding unique sub-pattern in the first set of distinct sub-patterns occurs in the first data pattern, and  
 the sub-patterns in the second data pattern occur in the same order as the corresponding unique sub-patterns occur in the first data pattern.  
   
   
   
       2 . The method of  claim 1 , wherein the method is performed a plurality of times for a particular running process.  
   
   
       3 . The method of  claim 1 , further comprising: 
 notifying a user that the running process is a potential keylogger when the running process has been flagged as a potential keylogger.    
   
   
       4 . The method of  claim 1 , further comprising: 
 automatically removing the running process from the computer when the running process has been flagged as a potential keylogger.    
   
   
       5 . The method of  claim 1 , further comprising: 
 removing the running process from the computer in response to user input when the running process has been flagged as a potential keylogger.    
   
   
       6 . The method of  claim 1 , wherein the memory is random-access memory.  
   
   
       7 . The method of  claim 1 , wherein the memory is a non-volatile memory.  
   
   
       8 . The method of  claim 1 , wherein the first and second sets of distinct sub-patterns are disjoint.  
   
   
       9 . A system for detecting a keylogger that encrypts data captured on a computer, the system comprising: 
 a data acquisition module configured to acquire first and second samples of a portion of a memory of the computer, the portion of the memory being associated with a running process on the computer;    a data injection module configured to input to the computer, at a time between acquisition of the first and second samples and in a manner mimicking keyboard input, a first data pattern consisting of at least one occurrence of each of a first set of distinct sub-patterns; and    an analysis module configured to: 
 compare the first and second samples of the portion of the memory to identify at least one data segment in which the second sample has changed relative to the first sample; and  
 flag the running process as a potential keylogger when: 
 the at least one data segment contains a second data pattern consisting of at least one occurrence of each of a second set of distinct sub-patterns,  
 each sub-pattern in the second set of distinct sub-patterns occurs the same number of times in the second data pattern as a corresponding unique sub-pattern in the first set of distinct sub-patterns occurs in the first data pattern, and  
 the sub-patterns in the second data pattern occur in the same order as the corresponding unique sub-patterns occur in the first data pattern.  
 
   
   
   
       10 . The system of  claim 9 , wherein the analysis module is further configured to notify a user that the running process is a potential keylogger when the analysis module has flagged the running process as a potential a keylogger.  
   
   
       11 . The system of  claim 9 , wherein the analysis module is further configured to remove the running process from the computer automatically when the analysis module has flagged the running process as a potential keylogger.  
   
   
       12 . The system of  claim 9 , wherein the analysis module is further configured to remove the running process from the computer in response to user input when the analysis module has flagged the running process as a potential keylogger.  
   
   
       13 . The system of  claim 9 , wherein the memory is random access memory.  
   
   
       14 . The system of  claim 9 , wherein the memory is a non-volatile memory.  
   
   
       15 . The system of  claim 9 , wherein the first and second sets of distinct sub-patterns are disjoint.  
   
   
       16 . A system for detecting a keylogger that encrypts data captured on a computer, the system comprising: 
 means for acquiring first and second samples of a portion of a memory of the computer, the portion of the memory being associated with a running process on the computer;    means for inputting to the computer, at a time between acquisition of the first and second samples and in a manner mimicking keyboard input, a first data pattern consisting of at least one occurrence of each of a first set of distinct sub-patterns;    means for comparing the first and second samples of the portion of the memory to identify at least one data segment in which the second sample has changed relative to the first sample; and    means for flagging the running process as a potential keylogger when: 
 the at least one data segment contains a second data pattern consisting of at least one occurrence of each of a second set of distinct sub-patterns,  
 each sub-pattern in the second set of distinct sub-patterns occurs the same number of times in the second data pattern as a corresponding unique sub-pattern in the first set of distinct sub-patterns occurs in the first data pattern, and  
 the sub-patterns in the second data pattern occur in the same order as the corresponding unique sub-patterns occur in the first data pattern.  
   
   
   
       17 . A computer-readable storage medium containing program instructions executable by a processor to detect a keylogger that encrypts data captured on a computer, the program instructions comprising: 
 a first instruction segment configured to acquire first and second samples of a portion of a memory of the computer, the portion of the memory being associated with a running process on the computer;    a second instruction segment configured to input to the computer, at a time between acquisition of the first and second samples and in a manner mimicking keyboard input, a first data pattern consisting of at least one occurrence of each of a first set of distinct sub-patterns; and    a third instruction segment configured to: 
 compare the first and second samples of the portion of the memory to identify at least one data segment in which the second sample has changed relative to the first sample; and  
 flag the running process as a potential keylogger when: 
 the at least one data segment contains a second data pattern consisting of at least one occurrence of each of a second set of distinct sub-patterns,  
 each sub-pattern in the second set of distinct sub-patterns occurs the same number of times in the second data pattern as a corresponding unique sub-pattern in the first set of distinct sub-patterns occurs in the first data pattern, and  
 the sub-patterns in the second data pattern occur in the same order as the corresponding unique sub-patterns occur in the first data pattern.

Join the waitlist — get patent alerts

Track US2007169191A1 — get alerts on status changes and closely related new filings.

We store only your email — no account needed. See our privacy policy.