Method and apparatus for detecting malware via analysis of a screen capture
AssigneeMcaffe, LLC
InventorHardik Shah
Life of this patent
Estimating the term…
Abstract
Methods, apparatus, systems and articles of manufacture for detecting malware via analysis of a screen capture are disclosed. An example apparatus includes at least one memory, instructions, and processor circuitry to execute the instructions. The processor circuitry is to detect execution of a process, capture a portion of a screen buffer as a captured image, after the execution of the process is detected, analyze the captured image to determine an image similarity to a stored image in a database, the database to at least store malicious images, and perform a responsive action when the image similarity satisfies a similarity threshold.
Claims17
An apparatus comprising:
- at least one memory;
- instructions;
- and
- processor circuitry to execute the instructions to:
- determine whether an identifier of a detected process is included in a list of processes capable of executing a macro;
- capture, after the execution of the process is detected and the determination that the identifier of the process is included in the list of processes, a portion of a screen buffer as a captured image;
- analyze the captured image to determine an image similarity to a stored image in a database, the database to at least store images of malicious user interfaces;
- perform a responsive action to prevent a user from enabling the macro when the image similarity satisfies a first similarity threshold;
- perform character recognition to identify text in the captured image when the image similarity does not satisfy the first similarity threshold;
- analyze the identified text to determine a text similarity to text in the database, the database to at least store text corresponding to a malicious macro;
- and
- perform the responsive action when the text similarity satisfies a second similarity threshold.
At least one non-transitory computer readable medium comprising instructions that, when executed, cause at least one processor to at least:
- determine whether an identifier of a detected process is included in a list of processes capable of executing a macro;
- capture, after the execution of the process is detected and the determination that the identifier of the process is included in the list of processes, a portion of a screen buffer as a captured image;
- analyze the captured image to determine an image similarity to a stored image in a database, the database to at least store images of malicious user interfaces;
- perform a responsive action to prevent a user from enabling the macro when the image similarity satisfies a first similarity threshold;
- perform character recognition to identify text in the captured image when the image similarity does not satisfy the first similarity threshold;
- analyze the text identified in the captured image to determine a text similarity to stored text in the database, the database to at least store text corresponding to a malicious macro;
- and
- perform the responsive action when the text similarity satisfies a second similarity threshold.
A method comprising:
- detecting, by executing an instruction with at least one processor, execution of a process;
- determining, by executing an instruction with the at least one processor, whether an identifier of the process is included in a list of processes capable of executing a macro;
- capturing, by executing an instruction with the at least one processor after the execution of the process is detected and the determination that the identifier of the process is included in the list of processes, a portion of a screen buffer as a captured image;
- analyzing, by executing an instruction with the at least one processor, the captured image to determine an image similarity to a stored image in a database, the database to at least store images of malicious user interfaces;
- performing, by executing an instruction with the at least one processor, a responsive action to prevent a user from enabling the macro when the image similarity satisfies a first similarity threshold;
- performing character recognition to identify text in the captured image when the image similarity does not satisfy the first similarity threshold;
- analyzing the text identified in the captured image to determine a text similarity to stored text in the database, the database to at least store text corresponding to a malicious macro;
- and
- performing the responsive action when the text similarity satisfies a second similarity threshold.
Dependencies are inferred from the claim text.