# US 10,482,247 B2 · Mitigation of malware

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,482,247 B2
- Document ID: US10482247B2
- Status: Granted
- Kind: B2
- Application number: 16/367,607
- Filed: 2019-03-28
- Published: 2019-07-25
- Granted: 2019-11-19
- Earliest claimed: 2014-06-27
- Assignees: McAfee, Inc.
- Applicants: McAfee, LLC
- Inventors: Christoph Alme; Slawa Hahn; Sebastian Thoene
- Web page: https://patentgrep.com/patent/US10482247B2

## CPC

- G06F 21/565: {by checking file integrity}
- G06F 21/562: {Static detection}
- G06F 21/563: {by source code analysis}
- G06F 21/564: {by virus signature recognition}
- G06F 2221/033: Test or assess software
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems and methods are provided in example embodiments for mitigating malicious calls. The system can be configured to determine a series of checksums for a file, compare the series of checksums to a checksum tree, where the checksum tree includes a plurality of nodes that each include a fuzzy checksum of known malware, and assign one or more classifications to the file, where each of the one or more classifications is based on each node of the checksum tree that matches a checksum in the series of checksums and includes whether the file includes malware or benign checksums.

## Claims

### Claim 1

At least one non-transitory, computer-readable medium including one or more instructions that, when executed by at least one processor, cause the at least one processor to perform a method comprising:
determining a first checksum at a first region or area of a first file;
comparing the first checksum to a root in a checksum tree, the root indicating a checksum at a point of a second file or a fuzzy checksum at the point of the second file;
determining a second checksum at a second region or area of the first file offset from the first region or area of the first file, if the first checksum matches the root;
comparing the second checksum to a descendant node of the root in the checksum tree, the descendant node indicating a checksum or fuzzy checksum, wherein the checksum or fuzzy checksum indicated by the descendant node is offset from the point of the second file;
assigning a classification to the first file, if the second checksum matches the descendant node, wherein the classification indicates malware or a benign file; and
assigning a percentage to the classification.

### Claim 2 (depends on 1)

The medium of claim 1, the method further comprising:
creating and sending a feature vector to classify the first file.

### Claim 3 (depends on 1)

The medium of claim 1, the method further comprising:
receiving file data related to new malware or a new benign file; and
creating and sending the checksum tree to analyze the first file.

### Claim 4 (depends on 1)

The medium of claim 1, the method further comprising:
comparing the second checksum to a sibling to the descendant node in the checksum tree, if the second checksum does not match the descendant node, the sibling to the descendant node indicating a checksum or fuzzy checksum.

### Claim 5 (depends on 1)

The medium of claim 1, wherein the second region or area is determined at an entry point of the first file, at a resources section of the first file, or a text section of the first file.

### Claim 6

An apparatus, comprising:
a memory; and
a processor configured
to determine a first checksum at a first region or area of a first file;
to compare the first checksum to a root in a checksum tree, the root indicating a checksum at a point of a second file or a fuzzy checksum at the point of the second file;
to determine a second checksum at a second region or area of the first file offset from the first region or area of the first file, if the first checksum matches the root;
to compare the second checksum to a descendant node of the root in the checksum tree, the descendant node indicating a checksum or fuzzy checksum, wherein the checksum or fuzzy checksum indicated by the descendant node is offset from the point of the second file;
to assign a classification to the first file, if the second checksum matches the descendant node, wherein the classification indicates malware or a benign file; and
to assign a percentage to the classification.

### Claim 7 (depends on 6)

The apparatus of claim 6, wherein the processor is configured to create and send a feature vector to classify the first file.

### Claim 8 (depends on 6)

The apparatus of claim 6, wherein the processor is configured to receive file data related to new malware or a new benign file, and to create and send the checksum tree to analyze the first file.

### Claim 9 (depends on 6)

The apparatus of claim 6, wherein the processor is configured to compare the second checksum to a sibling to the descendant node in the checksum tree, if the second checksum does not match the descendant node, the sibling to the descendant node indicating a checksum or fuzzy checksum.

### Claim 10 (depends on 6)

The apparatus of claim 6, wherein the second region or area is determined at an entry point of the first file, at a resources section of the first file, or a text section of the first file.

### Claim 11

A method, comprising:
determining a first checksum at a first region or area of a first file;
comparing the first checksum to a root in a checksum tree, the root indicating a checksum at a point of a second file or a fuzzy checksum at the point of the second file;
determining a second checksum at a second region or area of the first file offset from the first region or area of the first file, if the first checksum matches the root;
comparing the second checksum to a descendant node of the root in the checksum tree, the descendant node indicating a checksum or fuzzy checksum, wherein the checksum or fuzzy checksum indicated by the descendant node is offset from the point of the second file;
assigning a classification to the first file, if the second checksum matches the descendant node, wherein the classification indicates malware or a benign file; and
assigning a percentage to the classification.

### Claim 12 (depends on 11)

The method of claim 11, further comprising:
creating and sending a feature vector to classify the first file.

### Claim 13 (depends on 11)

The method of claim 11, further comprising:
receiving file data related to new malware or a new benign file; and
creating and sending the checksum tree to analyze the first file.

### Claim 14 (depends on 11)

The method of claim 11, further comprising:
comparing the second checksum to a sibling to the descendant node in the checksum tree, if the second checksum does not match the descendant node, the sibling to the descendant node indicating a checksum or fuzzy checksum.