US 2012/0260342 A1 · Malware Target Recognition

Abstract

A method, apparatus and program product are provided to recognize malware in a computing environment having at least one computer. A sample is received. An automatic determination is made by the at least one computer to determine if the sample is malware using static analysis methods. If the static analysis methods determine the sample is malware, dynamic analysis methods are used by the at least one computer to automatically determine if the sample is malware. If the dynamic analysis methods determine the sample is malware, the sample is presented to a malware analyst to adjudicate the automatic determinations of the static and dynamic analyses. If the adjudication determines the sample is malware, a response action is initiated to recover from or mitigate a threat of the sample.

Claims20

Dependent claims

A method of recognizing malware in a computing environment having at least one computer, the method comprising:

receiving a sample;
automatically determining by the at least one computer if the sample is malware using static analysis methods;
in response to the static analysis methods determining the sample is malware, using dynamic analysis methods by the at least one computer to automatically determine if the sample is malware;
in response to the dynamic analysis methods determining the sample is malware, present the sample to a malware analyst to adjudicate the automatic determinations of the static and dynamic analyses;
and
in response to the adjudication determining the sample is malware, initiate a response action to recover from or mitigate a threat of the sample.

3 more elements

Dependencies are inferred from the claim text.

Malware Target Recognition

Life of this patent

Malware Target Recognition

Life of this patent

Abstract

Claims20