# US 10,372,912 B2 · System and method for disarming malicious code > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,912 B2 - Document ID: US10372912B2 - Status: Granted - Kind: B2 - Application number: 16/024,991 - Filed: 2018-07-02 - Published: 2018-11-15 - Granted: 2019-08-06 - Earliest claimed: 2017-01-05 - Assignees: Votiro Cybersec Ltd. - Applicants: Votiro Cybersec Ltd. - Inventors: Aviv Grafi; Itay Glick - Web page: https://patentgrep.com/patent/US10372912B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The disclosed embodiments include a method for disarming malicious code in a computer system having a processor. The method comprises accessing, by the computer system, input content, wherein the input content includes a plurality of data units having a value representing media content, and adjusting, by the processor, a data unit value of at least a portion of the data units, wherein the portion of the data units and an adjustment of the data unit value are determined so as to render any malicious code included in the plurality of data units inactive for its intended malicious purpose while not interfering with an intended use of the input content. ## Claims ### Claim 1 A method for disarming malicious code in a computer system having a processor, the method comprising: accessing, by the computer system, input content, wherein the input content includes a plurality of data units having a value; and automatically adjusting, by the processor if a signature-based malware detection algorithm does not detect malicious code in the input content, a data unit value of at least a portion of the data units to render any undetected malicious code included in the plurality of data units inactive for its intended malicious purpose while not interfering with an intended use of the input content, wherein a location of data units including any undetected malicious code is not known. ### Claim 2 (depends on 1) The method of claim 1, further comprising outputting a new content including each adjusted data unit value in place of a respective data unit value of the input content. ### Claim 3 (depends on 2) The method of claim 2, further comprising applying a malware detection algorithm to the new content, thereby confirming any malicious code included in the input content was rendered inactive for its intended malicious purpose. ### Claim 4 (depends on 3) The method of claim 3, wherein the malware detection algorithm applied to the new content includes a behavior-based malware detection algorithm. ### Claim 5 (depends on 1) The method of claim 1, wherein the portion of the data units is randomly or pseudo-randomly selected from the plurality of data units. ### Claim 6 (depends on 1) The method of claim 1, wherein at least one of the portion of data units and an adjustment of a data value is determined so as not to interfere with an intended use of the input content. ### Claim 7 (depends on 6) The method of claim 6, wherein the plurality of data units includes each data unit corresponding to media content of the input content, and wherein the portion of the data units is randomly selected from the plurality of data units, the portion including at least .1% of the plurality of data units but not more than 2% of the plurality of data units. ### Claim 8 (depends on 6) The method of claim 6, wherein at least one of the portion of data units and an adjustment of a data value is determined based on a type of the media content. ### Claim 9 (depends on 1) The method of claim 1, wherein the data unit value is variably adjusted by a binary value of one. ### Claim 10 (depends on 1) The method of claim 1, further comprising, determining, based on a characteristic associated with the input content, whether the input content is suspicious, wherein the adjusting is performed if the input content is suspicious. ### Claim 11 (depends on 1) The method of claim 1, wherein the computer system includes an edge computing device of a network for receiving the input content in an electronic communication received from outside the network. ### Claim 12 (depends on 11) The method of claim 11, further comprising: outputting a new content including each adjusted data unit value in place of a respective data unit value of the input content; and forwarding the new content to a computing device of an intended recipient of the input content. ### Claim 13 A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform operations for disarming malicious code in a computer system, the operations comprising: accessing input content, wherein the input content includes a plurality of data units having a value; and responsive to an applied malware detection algorithm not first detecting suspected malicious content or suspicious content in the input content, adjusting a data unit value of at least a portion of the data units to render any undetected malicious code included in the plurality of data units inactive for its intended malicious purpose while not interfering with an intended use of the input content, wherein a degree of the adjustment is variable among the portion of the data units. ### Claim 14 (depends on 13) The non-transitory computer-readable medium of claim 13, the operations further comprising outputting a new content including each adjusted data unit value in place of a respective data unit value of the input content. ### Claim 15 (depends on 14) The non-transitory computer-readable medium of claim 14, the operations further comprising applying a behavior-based malware detection algorithm to the new content, thereby confirming any malicious code included in the input content was rendered inactive for its intended malicious purpose. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, further comprising forwarding the new content to a computing device of an intended recipient of the input content. ### Claim 17 A system for disarming malicious code, the system comprising: means for accessing input content, wherein the input content includes a plurality of data units having a value; and responsive to an applied malware detection algorithm not first detecting suspected malicious content or suspicious content in the input content, means for adjusting a data unit value of at least a portion of the data units to render any undetected malicious code included in the plurality of data units inactive for its intended malicious purpose while not interfering with an intended use of the input content. ### Claim 18 (depends on 17) The system of claim 17, further comprising means for variably adjusting a data unit value of at least a portion of the data units. ### Claim 19 (depends on 17) The system of claim 17 further comprising means for outputting a new content including each adjusted data unit value in place of a respective data unit value of the input content. ### Claim 20 (depends on 19) The system of claim 19, wherein the system includes an edge computing device of a network for receiving the input content in an electronic communication received from outside the network, and means for forwarding the new content to a computing device of an intended recipient of the input content. ### Claim 21 (depends on 17) The system of claim 17, further comprising means for determining the portion of the data units based on a random or pseudo-random selection of data units from the plurality of data units.