System and method for detecting malicious code
AssigneeComputer Associates Think, Inc.
InventorsItshak Carmona, Taras Malivanchuk
Life of this patent
Estimating the term…
Abstract
A method of detecting malicious code in computer readable code includes performing an initial determination to determine whether a first portion of the computer readable code may potentially have malicious code and if it is determined that the computer readable code potentially has malicious code, performing another determination to determine whether a second portion not including the first portion of the computer readable code has malicious code.
Claims30
A method of detecting malicious code in computer readable code, comprising:
- performing an initial determination to determine whether a first portion of the computer readable code may potentially have malicious code;
- and
- if it is determined that the computer readable code potentially has malicious code, performing another determination to determine whether a second portion not including the first portion of the computer readable code has malicious code.
A method of detecting malicious code in computer readable code, comprising:
- determining a CRC of a first portion of the computer readable code;
- performing an initial determination to determine whether the CRC of the first portion of the computer readable code is present in a database of CRCs, each CRC including corresponding instructions for how to proceed if the determined CRC is present in the database of CRCs;
- and
- if it is determined that the CRC of the first portion of the computer readable code is present in the database of CRCs, performing the corresponding instructions.
11 A recording medium including executable code for detecting malicious code in computer readable code, comprising:
- code for performing an initial determination to determine whether a first portion of the computer readable code may potentially have malicious code;
- and
- code for, if it is determined that the computer readable code potentially has malicious code, performing another determination to determine whether a second portion not including the first portion of the computer readable code has malicious code.
A recording medium as recited in claim 11, wherein the another determination is more comprehensive than the initial determination.
A recording medium as recited in claim 11, wherein the initial determination determines a first CRC of the first portion of the computer readable code.
A recording medium including executable code for detecting malicious code in computer readable code, comprising:
- code for determining a CRC of a first portion of the computer readable code;
- code for performing an initial determination to determine whether the CRC of the first portion of the computer readable code is present in a database of CRCs, each CRC including corresponding instructions for how to proceed if the determined CRC is present in the database of CRCs;
- and
- code for, if it is determined that the CRC of the first portion of the computer readable code is present in the database of CRCs, performing the corresponding instructions.
A programmed computer apparatus including code for detecting malicious code in computer readable code, the apparatus capable of performing a method comprising:
- performing an initial determination to determine whether a first portion of the computer readable code may potentially have malicious code;
- and
- if it is determined that the computer readable code potentially has malicious code, performing another determination to determine whether a second portion not including the first portion of the computer readable code has malicious code.
A programmed computer apparatus including code for detecting malicious code in computer readable code, the apparatus capable of performing a method comprising:
- determining a CRC of a first portion of the computer readable code;
- performing an initial determination to determine whether the CRC of the first portion of the computer readable code is present in a database of CRCs, each CRC including corresponding instructions for how to proceed if the determined CRC is present in the database of CRCs;
- and
- if it is determined that the CRC of the first portion of the computer readable code is present in the database of CRCs, performing the corresponding instructions.
Dependencies are inferred from the claim text.