System and method for detecting a file embedded in an arbitrary location and determining the reputation of the file
AssigneeMcAfee, Inc.
InventorsDenys Lok Hang Ma, Vinay Mahadik, Swapnil Pathak
Life of this patent
Estimating the term…
Abstract
A method is provided in one example embodiment that includes identifying a file format identifier associated with a beginning of a file, parsing the file based on the file format identifier until an end of the file is identified, and calculating a hash from the beginning of the file to the end of the file. The method may also include sending the hash to a reputation system and taking a policy action based on the hash's reputation received from the reputation system.
Claims20
A method, comprising:
- identifying a file format identifier associated with a beginning of a file;
- parsing the file based on the file format identifier to identify an end of the file;
- and
- calculating a hash value from the beginning of the file to the end of the file.
Logic encoded in one or more non-transitory media that includes code for execution and when executed by one or more processors is operable to perform operations comprising:
- identifying a file format identifier associated with a beginning of a file;
- parsing the file based on the file format identifier to identify an end of the file;
- and
- calculating a hash value from the beginning of the file to the end of the file.
An apparatus, comprising:
- one or more processors operable to execute instructions associated with file detection module such that the apparatus is configured for:
- identifying a file format identifier associated with a beginning of a file;
- parsing the file based on the file format identifier to identify an end of the file;
- and
- calculating a hash value from the beginning of the file to the end of the file.
Dependencies are inferred from the claim text.