Identifying malware containing computer files using embedded text
AssigneeMcAfee, Inc.
InventorsRobert Edward Moore, Fraser Peter Howard, Lee Codel Lawson Tarbotton
Life of this patent
Estimating the term…
Abstract
A computer file may be scanned for suspicious words 18 occurring within suspicious contexts 20. Thus, messages embedded by malware authors within their malware may be detected. The detection of such embedded messages may be used to identify otherwise unknown items of malware or as a pre-filtering technique for controlling the use of further scanning techniques.
Claims30
A computer program product operable for controlling a computer to identify a computer file as potentially containing malware, said computer program product comprising:
- searching code operable to search within said computer file for text data containing one or more target words that match at least one of a word or a characteristic of a word within a predetermined word library;
- context identifying code operable to identify a context within said computer file of said one or more target words;
- and
- file identifying code operable if said context matches one or a predetermined set of contexts to identify said computer file as potentially containing malware.
A method of identifying a computer file as potentially containing malware, said method comprising the step of:
- searching within said computer file for text data containing one or more target words that match at least one of a word or a characteristic of a word within a predetermined word library;
- identifying a context within said computer file of said one or more target words;
- and
- if said context matches one or a predetermined set of contexts, then identifying said computer file as potentially containing malware.
Apparatus for identifying a computer file as potentially containing malware, said apparatus comprising:
- searching logic operable to search within said computer file for text data containing one or more target words that match at least one of a word or a characteristic of a word within a predetermined word library;
- context identifying logic operable to identify a context within said computer file of said one or more target words;
- and
- file identifying logic operable if said context matches one or a predetermined set of contexts to identify said computer file as potentially containing malware.
Dependencies are inferred from the claim text.