Bryan Leslie Payne

US Patent:

20120240224, Sep 20, 2012

Filed:

Sep 14, 2011

Appl. No.:

13/232830

Inventors:

Bryan Douglas Payne - Atlanta GA, US
Brendan Dolan-Gavitt - Atlanta GA, US
Wenke Lee - Atlanta GA, US

Assignee:

Georgia Tech Research Corporation - Atlanta GA

International Classification:

G06F 21/00

US Classification:

726 21

Abstract:

Security systems and methods distinguish user-intended input hardware events from malicious input hardware events, thereby blocking resulting malicious output hardware events, such as, for example, outgoing network traffic. An exemplary security system can comprise an event-tracking unit, an authorization unit, and an enforcement unit. The event-tracking unit can capture a user-initiated hardware event. The authorization unit can analyze a user interface to determine whether the input hardware event should initiate outgoing hardware events and, if so, to create an authorization specific to the outgoing event initiated by the input event. This authorization can be stored in an authorization database. The enforcement unit can monitor outgoing hardware events and block the outgoing events for which no authorization matching the outgoing events are found in the authorization database.