US 10,649,970 B1Granted

Methods and apparatus for detection of functionality

AssigneeInvincea, Inc.

InventorsJoshua Daniel Saxe, David Peter Mentis, Anthony Chungku Wong

Life of this patent

Estimating the term…

Loading patent…

Abstract

In some embodiments, a method includes receiving a plurality of descriptors via a network. Each descriptor includes at least one of a descriptor component or a keyword. The method further includes storing the plurality of descriptors in a database, and generating a database index of the plurality of descriptors based on at least one of the descriptor component or the keyword for each descriptor of the plurality of descriptors. The method further includes storing the database index in the database. The method further includes receiving a file component extracted from a file and identifying, based on the file component, a set of descriptors from the plurality of descriptors. The method further includes inferring, based on the set of descriptors, a measure of likelihood of a functionality associated with the file, and transmitting an indication of the measure to a user.

Claims31

Dependent claims

A method, comprising:

searching for natural language descriptors displayed on a plurality of web pages;
receiving, at the host device and in response to the searching, a plurality of natural language descriptors, each natural language descriptor from the plurality of natural language descriptors including information relating to a functionality associated with that natural language descriptor;
extracting at least one descriptor component and at least one natural language keyword from each natural language descriptor from the plurality of natural language descriptors, the at least one descriptor component and the at least one natural language keyword extracted from each natural language descriptor from the plurality of natural language descriptors are associated with that natural language descriptor;
storing the plurality of natural language descriptors in a database;
generating a database index of the plurality of natural language descriptors based on at least one of the descriptor component or the natural language keyword for each natural language descriptor from the plurality of natural language descriptors;
receiving a file component extracted from a potential malware file;
receiving, from a user, a natural language indication of potential behavior of the potential malware file;
identifying a set of natural language descriptors from the plurality of natural language descriptors based on (1) the file component, (2) the at least one descriptor component of each natural language descriptor from the set of natural language descriptors, (3) the at least one natural language keyword of each natural language descriptor from the set of natural language descriptors, and (4) the natural language indication of potential behavior of the potential malware file;
inferring, based on the set of natural language descriptors including both a first natural language descriptor having a descriptor component within the file component and a second natural language descriptor having a descriptor component within the file component, a measure of likelihood of the potential malware file being malicious;
and
transmitting an indication of the measure to a user so as to instruct the user to perform a predetermined malware remediation action.

8 more elements

A method, comprising:

receiving a plurality of file components extracted from a potential malware file;
receiving a natural language indication of a functionality of the potential malware file from a user;
identifying a set of first natural language descriptors associated with each file component from the plurality of file components based on a plurality of descriptor components associated with each natural language descriptor from the set of first natural language descriptors;
identifying, based on the natural language indication of the functionality and based on natural language descriptor keywords, a set of second natural language descriptors, each natural language descriptor from the set of second natural language descriptors being identified in response to searching each web page from a plurality of web pages for natural language descriptors displayed on that web page;
inferring, based on the set of second natural language descriptors including both (1) a first natural language descriptor from the set of first natural language descriptors and having a descriptor component within a file component from the plurality of file components and (2) a second natural language descriptor from the set of first natural language descriptors and having a descriptor component within a file component from the plurality of file components, a measure of likelihood of the potential malware file being malicious;
and
transmitting an indication of the measure to a user.

4 more elements

An apparatus, comprising:

a memory;
and
a processor operatively coupled to the memory and configured to execute processor readable instructions stored in the memory, the processor configured to extract a plurality of file components from a potential malware file;
the processor configured to:
receive the plurality of file components;
generate a group including two or more file components from the plurality of file components;
transmit an indication of the group to a user;
receive, from the user, an indication of a functionality of the potential malware file in response to the indication of the group;
identify a set of first natural language descriptors associated with each file component from the plurality of file components, based on descriptor components associated with each natural language descriptor from the set of first natural language descriptors;
identify based on the indication of the functionality, a set of second natural language descriptors, each natural language descriptor from the set of second natural language descriptors being identified in response to searching each web page from a plurality of web pages for natural language descriptors displayed on that web page;
infer, based on the set of second natural language descriptors including both (1) a first natural language descriptor from the set of first natural language descriptors and having a descriptor component within a file component from the plurality of file components and (2) a second natural language descriptor from the set of first natural language descriptors and having a descriptor component within a file component from the plurality of file components, a measure of likelihood of the potential malware file being malicious;
and
transmit an indication of the measure to a user.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/212,659Filed 14 Mar 2014 · us provisional application
Priority: 14 Mar 2013
Granted: 12 May 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification4 codes

G06F 16/2272
Indexing structures: management thereof
G06F 21/6227
To a system of files or objects, e.g. local or distributed file system or database: where protection concerns the structure of data, e.g. records,…
G06F 16/24558
Of query operations: binary matching operations
G06F
Computing and data processing