System and method for detecting a potentially malicious executable file
OwnerDavid Vellainventor
Life of this patent
Estimating the term…
Abstract
A system and method for detecting a potentially malicious executable file is described. An executable file, for example attached to an electronic mail message or downloaded to a computer system, is trapped and disassembled to provide an analysable file. The analysable file is analysed to determine whether any program call is made by the executable file and whether any detected program call is potentially malicious by comparing the program call with a list of known potentially malicious program calls. If the program call is potentially malicious, the executable file is quarantined or deleted.
Claims33
A system for detecting a potentially malicious executable file, the system comprising:
- trapping means for trapping an executable file and disassembling the executable file to provide an analysable file;
- analysing means in communication with the trapping means for analysing the analysable file to determine whether a program call is made by the executable file and whether the program call is potentially malicious;
- a database of potentially malicious program calls and details of the functions of the program calls and quarantining means in communication with the analysing means for quarantining the executable file, with details retrieved from the database of the function of the program call made by the potentially malicious executable file, if the program call is potentially malicious, for determination whether the potentially malicious executable file should be released from quarantine or deleted.
A method for detecting a potentially malicious executable file, the method comprising the steps of:
- a) trapping an executable file;
- b) disassembling the executable file to provide an analysable file;
- c) analysing the analysable file to determine whether a program call is made by the executable file;
- d) determining whether the program call is potentially malicious;
- e) providing a database of potentially malicious program calls and their functions;
- f) if the program call is potentially malicious, quarantining the executable file with the function of the potentially malicious program call retrieved from the database;
- and
- g) determining at least partially from the function of the potentially malicious program call whether to delete or release from quarantine the potentially malicious executable file.
Dependencies are inferred from the claim text.