Back to results
US 11,386,205 B2Granted
Detection of malicious polyglot files
AssigneeMcAfee, Inc.
InventorsGerman Lancioni, Carl D. Woodward
Life of this patent
Estimating the term…
Abstract
Particular embodiments described herein provide for an electronic device that can be configured to identify a file, determine a polyglotness score for the file, where the polyglotness score is an indicator of whether or not the file is a polyglot file, and analyze the file for the presence of malware if the polyglotness score satisfies threshold.
Claims20
A method comprising:
- identifying a file;
- determining a likelihood that the file is a polyglot file, wherein the determination includes analyzing the file using at least two of:
- a format specification analysis of the file, a data structure decomposition of the file, a program language estimation to determine a program language that was used to write at least part of the file, and a sandboxed test of at least a portion of the file;
- determining a polyglotness score for the file, wherein the polyglotness score corresponds to the likelihood that the file is a polyglot file;
- and analyzing the file for a presence of mal are when the polyglotness score satisfies a threshold.
2 more elements
At least one non-transitory machine-readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to:
- identify a file;
- determine a likelihood that the file is a polyglot file, wherein the determination includes analyzing the file using at least two of:
- a format specification analysis of the file, a data structure decomposition of the file, a program language estimation to determine a program language that was used to write at least part of the file, and a sandboxed test of at least a portion of the file;
- determine a polyglotness score for the file, wherein the polyglotness score is an indicator of whether or not the file is a polyglot file;
- and analyze the file for a presence of ma ware when the polyglotness score satisfies a threshold.
2 more elements
An apparatus comprising:
- at least one processor;
- memory;
- and a security engine configured to cause the at least one processor to:
- identify a file;
- determine a likelihood that the file is a polyglot file, wherein the determination includes analyzing the file using at least two of:
- a format specification analysis of the file, a data structure decomposition of the file, a program language estimation to determine a program language that was used to write at least part of the file, and a sandboxed test of at least a portion of the file;
- determine a polyglotness score for the file, wherein the polyglotness score corresponds to the likelihood that the file is a polyglot file;
- and analyze Me file for a presence of malware when the polyglotness score satisfies threshold.
5 more elements
Dependencies are inferred from the claim text.