Paul Lopez Rivera

US Patent:

20180357413, Dec 13, 2018

Filed:

May 31, 2018

Appl. No.:

15/995088

Inventors:

Paul A. Rivera - San Antonio TX, US

International Classification:

G06F 21/54
G06F 21/56
G06F 21/57

Abstract:

Methods and systems for defending a computing system against malware are disclosed, including (a) determining which mode an active defense system (ADS) is enabled; (b) if passive mode, then log API calls; determining whether an exploit has executed on the computing system; if exploit has not executed, then continue logging API calls; and if exploit has executed, then using the ADS to analyze the log to determine API chain which resulted in the exploit and creating a new active defense API chain rule; and (c) if active mode, then monitoring process's API calls; determining whether the process's API calls match one of known active defense API chain rules; if API calls do not match, then continue monitoring the process's API calls; and if API calls do match, then using the ADS to deny the process's API call and/or kill the process. Other embodiments are described and claimed.

US Patent:

20150019850, Jan 15, 2015

Filed:

Jul 15, 2014

Appl. No.:

14/332359

Inventors:

Paul A. Rivera - San Antonio TX, US

Assignee:

DEF-LOGIX, INC. - San Antonio TX

International Classification:

G06F 21/57

US Classification:

713 1

Abstract:

Methods and systems for firmware based system security, integrity, and restoration are disclosed, including (a) determining in a pre-boot environment which mode a security and policy enforcement platform (“platform”) should be loaded into firmware of a computing system; (b) if the determination made in step (a) is that it is the first time for the platform to be loaded, then loading the platform into a setup mode; (c) if the determination made in step (a), above, is that a valid certificate from the platform is on a file system accessible in the firmware of the computing system, then loading the platform into a configuration mode; and (d) if the determination made in step (a), above, is that the platform is set to an active/active-test mode, then loading the platform into the active/active-test mode. Other embodiments are described and claimed.