US 10,503,900 B2Granted

Identifying malware based on content item identifiers

AssigneeDropbox, Inc.

InventorRay Zhang

Life of this patent

Estimating the term…

Loading patent…

Abstract

Disclosed are systems, methods, and non-transitory computer-readable storage media for identifying malware based on content item identifiers. For example, a system for detecting malware can be made more efficient by reducing the number of content items that are scanned or analyzed for malicious software code or computer instructions. The number of content items that need to be scanned can be reduced by identifying suspicious content items based on tokens (e.g., strings of characters) commonly used by malware in the identifiers of malware related content items and then analyzing the identified suspicious content items for malicious content (e.g., malicious software instructions) using the anti-malware software.

Claims19

Dependent claims

A method comprising:

receiving, by a computing device from a user device, a selection of a content item associated with a user account;
determining, by the computing device, an identifier for the selected content item, wherein the identifier is a name or pathname associated with the selected content item;
generating, by the computing device, one or more tokens based on the content item identifier;
determining, by the computing device, a one or more token scores each corresponding to a respective one of the one or more tokens,
generating, by the computing device, a content item score based on the token scores, wherein the content item score is calculated based on a maximum token score in the one or more token scores, and/or a summation of the one or more token scores;
determining, by the computing device, that the content item is suspected of being associated with malicious software based on the content item score;
and
in response to determining that the content item is suspected of being associated with malicious software based on the content item score:
preventing access to the content item,
causing a message to be presented on the user device indicating that the selected content item is unavailable, and
performing an anti-malware scan of a content of the content item.

8 more elements

A non-transitory computer-readable medium including one or more sequences of instructions that, when executed by one or more processors, causes the processors to perform operations comprising:

receiving, by a computing device from a user device, a selection of a content item associated with a user account;
determining, by the computing device, an identifier for the selected content item, wherein the identifier is a name or pathname associated with the selected content item;
generating, by the computing device, one or more tokens based on the content item identifier;
determining, by the computing device, a one or more token scores each corresponding to a respective one of the one or more tokens;
generating, by the computing device, a content item score based on the token scores, wherein the content item score is calculated based on a maximum token score in the one or more token scores, and/or a summation of the one or more token scores;
determining, by the computing device, that the content item is suspected of being associated with malicious software based on the token scores;
and
in response to determining that the content item is suspected of being associated with malicious software based on the content item score:
preventing access to the content item,
causing a message to be presented on the user device indicating that the selected content item is unavailable, and
performing an anti-malware scan of a content of the content item.

8 more elements

A system comprising:

one or more processors;
and
a non-transitory computer-readable medium including one or more sequences of instructions that, when executed by one or more processors, causes the processors to perform operations comprising:
receiving, by a computing device from a user device, a selection of a content item associated with a user account;
determining, by the computing device, an identifier for the selected content item, wherein the identifier is a name or pathname associated with the selected content item;
generating, by the computing device, one or more tokens based on the content item identifier;
determining, by the computing device, a one or more token scores each corresponding to a respective one of the one or more tokens;
generating, by the computing device, a content item score based on the token scores, wherein the content item score is calculated based on a maximum token score in the one or more token scores, and/or a summation of the one or more token scores;
determining, by the computing device, that the content item is suspected of being associated with malicious software based on the token scores;
and
in response to determining that the content item is suspected of being associated with malicious software:
preventing, by the computing device, access to the content item,
causing a message to be presented on the user device indicating that the selected content item is unavailable, and
performing an anti-malware scan of a content of the content item.

11 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/685,215Filed 24 Aug 2017
Published: US 2019/0065741 A128 Feb 2019
Granted: 10 Dec 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements
G06F 21/564
Static detection: by virus signature recognition
H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic
G06F
Computing and data processing

Family

US 2019/0065741 A1Pre-grant publication · published 28 Feb 2019
US 10,503,900 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key