Cloud-based malware detection
AssigneeZscaler, Inc.
InventorsKailash Kailash, Robert L. Voit, Jose Raphel
Life of this patent
Estimating the term…
Abstract
Systems, methods and apparatus for malware detection to detect and stop the distribution of malware and other undesirable content before such content reaches computing systems. A Malware Detection Service (MDS) including a processor and memory storing computer program instructions that when executed cause the processor to receive one of content or a signature of a file, responsive to receiving a signature of a file, determine a status of the file as trusted, untrusted, or unknown for malware based on the signature, responsive to receiving content of a file, generate a signature of the file and scan the content to identify the status of the content as trusted or untrusted.
Claims17
A Malware Detection Service (MDS) comprising:
- a hardware processor;
- and
- memory storing computer program instructions that when executed cause the hardware processor to:
- receive one of content or a signature of a file;
- responsive to receiving a signature of a file, wherein the signature is adjusted in a predetermined manner to prevent the signature matching known trusted files, determine a status of the file as trusted, untrusted, or unknown for malware based on the signature;
- and
- responsive to receiving content of a file, generate a signature of the file and scan the content to identify the status of the content as trusted or untrusted.
A cloud-based malware detection method implemented by a Malware Detection Service (MDS) executed on a server located on an external network from a computer, the cloud-based malware detection method comprising:
- receiving one of content or a signature of a file;
- responsive to receiving a signature of a file, wherein the signature is adjusted in a predetermined manner to prevent the signature matching known trusted files, determining a status of the file as trusted, untrusted, or unknown for malware based on the signature;
- and
- responsive to receiving content of a file, generating a signature of the file, and scanning the content to identify the status of the content as trusted or untrusted.
A non-transitory computer-readable storage medium having computer readable code stored thereon for programming a processor to perform steps of:
- receiving one of content or a signature of a file;
- responsive to receiving a signature of a file, wherein the signature is adjusted in a predetermined manner to prevent the signature matching known trusted files, determining a status of the file as trusted, untrusted, or unknown for malware based on the signature;
- and
- responsive to receiving content of a file, generating a signature of the file, and scanning the content to identify the status of the content as trusted or untrusted.
Dependencies are inferred from the claim text.