Back to results
US 11,768,937 B1Granted
Hash based flexible threat scanning engine
AssigneeAmazon Technologies, Inc.
InventorMircea Ciubotariu
Life of this patent
Estimating the term…
Abstract
Techniques for hash based flexible scanning are described. A method of hash based flexible scanning may include obtaining a sample from a sample source, determining a size of the sample, generating one or more hashes of one or more blocks of the sample based on the size of the sample, and determining whether the sample is associated with a known threat by comparing the one hashes of the one or more blocks to hashes in a threat database.
Claims13
A computer-implemented method comprising:
- obtaining a sample from a sample source;
- determining a size of the sample;
- determining, based on the size of the sample, that only particular blocks of the sample are to be hashed, wherein the particular blocks include one or more blocks from a beginning of the sample, including a first block, a second block, and a third block, and one or more blocks from an end of the sample, including a last block and a next-to-last block;
- generating hashes of the particular blocks of the sample based on the determining that only particular blocks of the sample are to be hashed;
- and
- determining whether the sample is associated with a known threat by comparing the hashes of the particular blocks to hashes in a threat database.
3 more elements
A system comprising:
- a first one or more electronic devices to implement a database service in a multi-tenant provider network;
- and
- a second one or more electronic devices to implement a threat scanning service in the multi-tenant provider network, the threat scanning service including instructions that upon execution by one or more processors cause the threat scanning service to:
- obtain a sample from a sample source;
- determine a size of the sample;
- determine, based on the size of the sample, that only particular blocks of the sample are to be hashed, wherein the particular blocks include one or more blocks from a beginning of the sample, including a first block, a second block, and a third block, and one or more blocks from an end of the sample, including a last block and a next-to-last block;
- generate hashes of the particular blocks of the sample based on the determining that only particular blocks of the sample are to be hashed;
- and
- determine whether the sample is associated with a known threat by comparing the hashes of the particular blocks to hashes in a threat database of the database service.
6 more elements
Dependencies are inferred from the claim text.