Patent Issued for Keylogger detection systems and methods (USPTO 11899830): United Services Automobile Association

2024 FEB 01 (NewsRx) -- By a News Reporter-Staff News Editor at Insurance Daily News -- United Services Automobile Association (San Antonio, Texas, United States) has been issued patent number 11899830, according to news reporting originating out of Alexandria, Virginia, by NewsRx editors.

The patent’s inventors are Harris, David Joaquin (San Antonio, TX, US), Philbrick, Ashley Raine (San Antonio, TX, US), Russell, Ryan Thomas (The Colony, TX, US).

This patent was filed on December 19, 2022 and was published online on February 13, 2024.

From the background information supplied by the inventors, news correspondents obtained the following quote: “The present disclosure generally relates to computing device monitoring, and more particularly, security systems designed to monitor for unauthorized data sharing.

“Computing devices increasingly are connected to other devices, such as other computing devices, memories, servers, or the like, through wireless and/or wired communication networks. As popularity of computing devices has grown to become indispensable, an amount of sensitive data shared through the communication networks has increased. When an unauthorized entity accesses the sensitive data, a security breach may occur and result in a “data leak,” or a release of sensitive data as part of an unauthorized access of the sensitive data. Sensitive data may include social security numbers, personal identification numbers, financial information, credit or debit card information, banking information, login credentials for website portals, or the like. Different techniques may be used by an unauthorized party to access the sensitive data stored and/or transmitted by a computing device, such as key logging techniques, phishing methods, viruses, or the like. For example, key logging techniques may retrieve sensitive data through user inputs via an input device, such as a keyboard, of a computing device and keyloggers remain troublesome to detect when monitoring the computing device.”

Supplementing the background information on this patent, NewsRx reporters also obtained the inventors’ summary information for this patent: “Certain embodiments commensurate in scope with the originally claimed subject matter are summarized below. These embodiments are not intended to limit the scope of the claims, but rather these embodiments are intended only to provide a brief summary of possible forms of the invention. Indeed, the present disclosure may encompass a variety of forms that may be similar to or different from the embodiments set forth below.

“In an embodiment, a system may include an input device and a computing device including a keylogger detection system. The keylogger detection system may perform operations including detecting a keylogger based at least in part on an increase in power drawn by the input device, detecting the keylogger based at least in part on a driver of the input device, detecting the keylogger based at least in part on a duration of time that a signal generated by the input device takes to transmit to the computing device, or any combination thereof. In response to detecting the keylogger, the keylogger detection system may generate an alert that includes a notification associated with the detection of the keylogger.

“In another embodiment, a method may include detecting a keylogger based at least in part on an increase in power drawn by an input device, detecting the keylogger based at least in part on a driver of the input device, detecting the keylogger based at least in part on a duration of time that a signal generated by the input device takes to transmit to a computing device, or any combination thereof. The method may also include, in response to detecting the keylogger, generating an alert to indicate a presence of the keylogger.

“In yet another embodiment, a tangible, non-transitory computer-readable medium that stores instructions executable by a processor of an electronic device that, when executed by the processor, cause a computing device to perform operations including detecting a keylogger based at least in part on an increase in power drawn by an input device, detecting the keylogger based at least in part on a driver of the input device, detecting the keylogger based at least in part on a duration of time that a signal generated by the input device takes to transmit to the computing device, or any combination thereof. The operations may also include generating an alert including a notification associated with the detection of the keylogger in response to detecting the keylogger.”

The claims supplied by the inventors are:

“1. A system, comprising: an input device; and a computing device comprising a keylogger detection system, wherein the keylogger detection system comprises a processor configured to: detect a keylogger, by: identifying a first time that a first signal is generated by the input device as a first transmission time of a key press; sensing a first amount of power drawn in conjunction with the input device during the first transmission time as a baseline power draw; after a period of time, identifying a second time that a second signal is generated by the input device as a second transmission time of the key press; sensing a second amount of power drawn in conjunction with the input device during the second transmission time as a second power draw, wherein the second power draw is greater than the baseline power draw; determining an indication of a possible presence of the keylogger in response to determining an increase in transmission time based at least in part on a comparison between the first transmission time and the second transmission time; increasing a severity of the indication of the possible presence of the keylogger based at least in part on determining a change from the baseline power draw to the second power draw is greater than a threshold power draw change; and in response to the severity of the indication being greater than a threshold, generating an alert comprising an indication of the possible presence of the keylogger, wherein generating the alert comprises: providing an instruction to display a notification via an electronic display, generating an email, generating a maintenance request, or any combination thereof.

“2. The system of claim 1, comprising a supply terminal configured to provide the first amount of power drawn and the second amount of power drawn to the input device.

“3. The system of claim 2, wherein the processor is configured to detect the keylogger, based at least in part by: monitoring the supply terminal to measure the first amount of power drawn; and monitoring the supply terminal to measure the second amount of power drawn.

“4. The system of claim 2, comprising identifying the change by comparing a voltage of the supply terminal to a reference voltage, a ground voltage, or both.

“5. The system of claim 1, comprising sensing the baseline power draw and the second power draw as an amount of voltage, an amount of current, or both.

“6. The system of claim 1, wherein the processor is configured to detect the keylogger based at least in part by: receiving a driver parameter of a driver; accessing an expected driver parameter; increasing the severity of the indication based at least in part on determining that the driver parameter is different from the expected driver parameter; and detecting the keylogger based at least in part on determining that the driver parameter is different from the expected driver parameter.

“7. The system of claim 6, wherein the processor is configured to detect the keylogger based at least in part by: comparing the driver parameter to a list of parameters determined at an earlier time to correspond to the keylogger; and increasing the severity of the indication in response to determining that the list of parameters comprises the driver parameter.

“8. A method for operating a keylogger detection system of a computing device comprising: identifying, via a processor, a first time that a first signal is generated by an input device as a first transmission time of a key press; sensing, via the processor, a first amount of power drawn in conjunction with the input device during the first transmission time as a baseline power draw; after a period of time, identifying, via the processor, a second time that a second signal is generated by the input device as a second transmission time of the key press, wherein the second transmission time is greater than the first transmission time; sensing, via the processor, a second amount of power drawn in conjunction with the input device during the second transmission time as a second power draw, wherein the second power draw is greater than the baseline power draw; determining, via the processor, an indication of a possible presence of a keylogger based at least in part on the second transmission time being greater than the first transmission time; increasing, via the processor, a severity of the indication of the possible presence of the keylogger based at least in part on the second power draw being greater than the baseline power draw; and in response the severity of the indication being greater than a threshold, generating, via the processor, an alert comprising an indication of the possible presence of the keylogger, wherein generating the alert comprises: providing an instruction to display a notification via an electronic display, generating an email, generating a maintenance request, or any combination thereof.

“9. The method of claim 8, comprising: monitoring, via the processor, a supply terminal to measure the first amount of power drawn; and monitoring, via the processor, the supply terminal to measure the second amount of power drawn.

“10. The method of claim 8, comprising identifying, via the processor, a change between the second power draw and the baseline power draw by comparing a voltage of a supply terminal to a reference voltage, a ground voltage, or both.

“11. The method of claim 8, comprising sensing, via the processor, the baseline power draw and the second power draw as an amount of voltage, an amount of current, or both.

“12. The method of claim 8, comprising: receiving, via the processor, a driver parameter of a driver; accessing, via the processor, an expected driver parameter; increasing, via the processor, the severity of the indication of the possible presence of the keylogger based at least in part on determining that the driver parameter is different from the expected driver parameter; and detecting, via the processor, the keylogger based at least in part on determining that the driver parameter is different from the expected driver parameter.

“13. The method of claim 8, comprising: receiving, via the processor, the second signal generated by the input device at the second time and a time of input into the input device from the input device; determining, via the processor, a duration of time based at least in part on a difference between the time of input and the second time; accessing, via the processor, historical transmission times associated with previous signals received from the input device; and increasing, via the processor, the severity of the indication of the possible presence of the keylogger based at least in part on determining that the duration of time is a threshold amount longer than one or more historical transmission times.

“14. A tangible, non-transitory computer-readable medium configured to store instructions executable by a processor of an electronic device that, when executed by the processor, cause a computing device to perform operations comprising: identifying a first time that a first signal is generated by an input device as a first transmission time of a key press; sensing a first amount of power drawn in conjunction with the input device during the first transmission time as a baseline power draw; after a period of time, identifying a second time that a second signal is generated by the input device as a second transmission time of the key press, wherein the second transmission time is greater than the first transmission time; sensing a second amount of power drawn in conjunction with the input device during the second transmission time as a second power draw, wherein the second power draw is greater than the baseline power draw; determining an indication of a possible presence of a keylogger based at least in part on the second transmission time being greater than the first transmission time; increasing a severity of the indication of the possible presence of the keylogger based at least in part on the second power draw being greater than the baseline power draw; and in response to the likelihood the severity of the indication being greater than a threshold, generating an alert comprising an indication of the possible presence of the keylogger, wherein generating the alert comprises: providing an instruction to display a notification via an electronic display, generating an email, generating a maintenance request, or any combination thereof.

“15. The non-transitory computer-readable medium of claim 14, the operations comprising: monitoring a supply terminal to measure the first amount of power drawn; and monitoring the supply terminal to measure the second amount of power drawn.

“16. The non-transitory computer-readable medium of claim 14, the operations comprising: sensing the baseline power draw and the second power draw as an amount of voltage, an amount of current, or both.

“17. The non-transitory computer-readable medium of claim 14, the operations comprising: sensing a first processing load at least in part on processing times of the processor; comparing the first processing load to a second processing load, wherein the second processing load is indicative of performance of the processing times of processor over time; and detecting the keylogger based at least in part on determining that the first processing load is a threshold amount greater than the second processing load.

“18. The non-transitory computer-readable medium of claim 14, the operations comprising: receiving a driver parameter of a driver; accessing an expected driver parameter; increasing the severity of the indication of the possible presence of the keylogger based at least in part on determining that the driver parameter is different from the expected driver parameter; and detecting the keylogger based at least in part upon determining that the driver parameter is different from the expected driver parameter.”

There are additional claims. Please visit full patent to read further.

For the URL and additional information on this patent, see: Harris, David Joaquin. Keylogger detection systems and methods. U.S. Patent Number 11899830, filed December 19, 2022, and published online on February 13, 2024. Patent URL (for desktop use only): https://ppubs.uspto.gov/pubwebapp/external.html?q=(11899830)&db=USPAT&type=ids

(Our reports deliver fact-based news of research and discoveries from around the world.)