Method of aiding the detection of infection of a terminal by malware
AssigneeOrange
InventorsKarel Mittig, Fabien Bignon
Life of this patent
Estimating the term…
Abstract
A method for aiding detection of infection of a terminal by malware. The method includes: reception of a current request originating from the terminal asking for access to a resource of a network; detection that the resource requested is malevolent; when the current request includes a reference to an initial resource, verification that access to the initial resource has been requested from the terminal in at least one earlier request, the initial resource having been detected legitimate during processing of the earlier request; and wherein the current request being then considered to be an attempt to infect the terminal.
Claims9
A method for assisting detection of infection of a terminal by a malware program, comprising the following acts performed by a device on a data network:
- receiving over the network a current request, coming from the terminal, for access to a resource of the network,
- detecting that the resource requested is present in a database of malicious resources,
- when a header of the current request comprises also a reference to an initial resource, verifying that an access to the initial resource has been requested from the terminal in at least one prior request, said initial resource having been detected to be legitimate during processing of the prior request, said current request then being considered as an attempt to infect the terminal.
A device for assisting monitoring of network traffic, configured for assisting detection of infection of a terminal by a malware program, said device comprising:
- a processor;
- and
- a non-transitory computer-readable medium comprising instructions stored thereon, which when executed by the processor configure the device to perform acts comprising:
- receiving over the network a current request, coming from the terminal, for access to a resource of the network,
- detecting that the resource requested is present in a database of malicious resources,
- verifying, when a header of the current request also comprises a reference to an initial resource, that the access to the initial resource has been requested from the terminal in at least one prior request, said initial resource having been detected to be legitimate during processing of the prior request, said current request then being considered as an attempt to infect the terminal.
A non-transitory computer-readable medium comprising a computer program stored thereon, the program comprising portion of code for executing a method for assisting detection of infection of a terminal by a malware program, when the portion of code is executed by a processor of a device on a data network, wherein the method comprises the following acts performed by the device:
- receiving over the network a current request, coming from the terminal, for access to a resource of the network,
- detecting that the resource requested is present in a database of malicious resource,
- when a header of the current request also comprises a reference to an initial resource, verifying that an access to the initial resource has been requested from the terminal in at least one prior request, said initial resource having been detected to be legitimate during processing of the prior request, said current request then being considered as an attempt to infect the terminal.
Dependencies are inferred from the claim text.