# US 2013/0160125 A1 · Method and system for rapid signature search over encrypted content > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2013/0160125 A1 - Document ID: US20130160125A1 - Status: Published application - Kind: A1 - Application number: 13/325,884 - Filed: 2011-12-14 - Published: 2013-06-20 - Earliest claimed: 2011-12-14 - Assignees: McAfee, Inc. - Inventors: Nikolay Vladimirovich Likhachev; Alice Yali Chang - Web page: https://patentgrep.com/patent/US20130160125A1 ## CPC - G06F 21/564: {by virus signature recognition} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for detecting malware includes dividing data to be scanned for malware into at least a first data segment and a second data segment, dividing a signature corresponding to an indication of malware into at least a first signature segment and a second signature segment, performing a relationship function on the first signature segment and the second signature segment yielding a first result, performing the relationship function on the first data segment and the second data segment yielding a second result, comparing the first result and the second result, and, based on the comparison, determining that the data includes information corresponding to the signature. The relationship function characterizes the relationship between at least two information sets. ## Claims ### Claim 1 A method for detecting malware, comprising: dividing data of an electronic device to be scanned for malware into at least a first data segment and a second data segment; dividing a signature corresponding to an indication of malware into at least a first signature segment and a second signature segment; performing a relationship function on the first signature segment and the second signature segment, yielding a first result, the relationship function characterizing the relationship between at least two information sets; performing the relationship function on the first data segment and the second data segment, yielding a second result; comparing the first result and the second result; based on the comparison, determining that the data of the electronic device includes information corresponding to the signature. ### Claim 2 (depends on 1) The method of claim 1, wherein the relationship function includes a determination of the number of positive bits in each information set. ### Claim 3 (depends on 1) The method of claim 1, wherein the relationship function includes an element-by-element comparison of whether the elements in a first information set are equal to the corresponding element in a second information set. ### Claim 4 (depends on 1) The method of claim 1, further comprising determining that the data includes malware identified by the signature. ### Claim 5 (depends on 1) The method of claim 1, wherein comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold. ### Claim 6 (depends on 5) The method of claim 5, further comprising: selecting a third signature segment and a fourth signature segment; performing the relationship function on the third signature segment and the fourth signature segment, yielding a third result; and comparing the third result and the second result. ### Claim 7 (depends on 1) The method of claim 1, wherein comparing the first result and the second result includes determining whether the first result and the second result are equal. ### Claim 8 (depends on 1) The method of claim 1, wherein comparing the first result and the second result includes determining whether the first result and the second result contain one or more repeating patterns in common. ### Claim 9 (depends on 1) The method of claim 1, wherein comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold, and further comprising: selecting a third data segment and a fourth data segment; performing the relationship function on the third data segment and the fourth data segment, yielding a third result; and comparing the third result and the first result. ### Claim 10 (depends on 1) The method of claim 1 wherein comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold; and further comprising performing additional anti-malware processing on the data based on the determining whether the similarity exceeds the similarity threshold. ### Claim 11 An article of manufacture, comprising: a computer readable medium; and computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to: divide data to be scanned for malware into at least a first data segment and a second data segment; divide a signature corresponding to an indication of malware into at least a first signature segment and a second signature segment; perform a relationship function on the first signature segment and the second signature segment, yielding a first result, the relationship function characterizing the relationship between at least two information sets; perform the relationship function on the first data segment and the second data segment, yielding a second result; compare the first result and the second result; based on the comparison, determine that the data includes information corresponding to the signature. ### Claim 12 (depends on 10) The article of claim 10, wherein the relationship function includes a determination of the number of positive bits in each information set. ### Claim 13 (depends on 10) The article of claim 10, wherein the relationship function includes an element-by-element comparison of whether the elements in a first information set are equal to the corresponding element in a second information set. ### Claim 14 (depends on 10) The article of claim 10, wherein the processor is further caused to determine that the data includes malware identified by the signature. ### Claim 15 (depends on 10) The article of claim 10, wherein comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold. ### Claim 16 (depends on 15) The article of claim 15, wherein the processor is further caused to: select a third signature segment and a fourth signature segment; perform the relationship function on the third signature segment and the fourth signature segment, yielding a third result; and compare the third result and the second result. ### Claim 17 (depends on 10) The article of claim 10, wherein comparing the first result and the second result includes determining whether the first result and the second result are equal. ### Claim 18 (depends on 10) The article of claim 10, wherein comparing the first result and the second result includes determining whether the first result and the second result contain one or more repeating patterns in common. ### Claim 19 (depends on 10) The article of claim 10, wherein: comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold; and the processor is further caused to: select a third data segment and a fourth data segment; perform the relationship function on the third data segment and the fourth data segment, yielding a third result; and compare the third result and the first result. ### Claim 20 (depends on 10) The article of claim 10 wherein: comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold; and the processor is further caused to perform additional anti-malware processing on the data based on the determining whether the similarity exceeds the similarity threshold. ### Claim 21 A system for detecting malware, comprising: a processor; a computer readable medium; and an anti-malware application configured to protect an electronic device from malware, the anti-malware application including instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the anti-malware application to: divide data to be scanned for malware into at least a first data segment and a second data segment; divide a signature corresponding to an indication of malware into at least a first signature segment and a second signature segment; perform a relationship function on the first signature segment and the second signature segment, yielding a first result, the relationship function characterizing the relationship between at least two information sets; perform the relationship function on the first data segment and the second data segment, yielding a second result; compare the first result and the second result; based on the comparison, determine that the data includes information corresponding to the signature. ### Claim 22 (depends on 20) The system of claim 20, wherein the relationship function includes a determination of the number of positive bits in each information set. ### Claim 23 (depends on 20) The system of claim 20, wherein the relationship function includes an element-by-element comparison of whether the elements in a first information set are equal to the corresponding element in a second information set. ### Claim 24 (depends on 20) The system of claim 20, wherein the anti-malware application is further caused to determine that the data includes malware identified by the signature. ### Claim 25 (depends on 20) The system of claim 20, wherein comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold. ### Claim 26 (depends on 25) The article of claim 25, wherein the anti-malware application is further caused to: select a third signature segment and a fourth signature segment; perform the relationship function on the third signature segment and the fourth signature segment, yielding a third result; and compare the third result and the second result. ### Claim 27 (depends on 20) The system of claim 20, wherein comparing the first result and the second result includes determining whether the first result and the second result are equal. ### Claim 28 (depends on 20) The system of claim 20, wherein comparing the first result and the second result includes determining whether the first result and the second result contain one or more repeating patterns in common. ### Claim 29 (depends on 20) The system of claim 20, wherein: comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold; and the anti-malware application is further caused to: select a third data segment and a fourth data segment; perform the relationship function on the third data segment and the fourth data segment, yielding a third result; and compare the third result and the first result. ### Claim 30 (depends on 20) The system of claim 20 wherein: comparing the first result and the second result includes determining whether the similarity between the first result and the second result exceeds a similarity threshold; and the anti-malware application is further caused to perform additional anti-malware processing on the data based on the determining whether the similarity exceeds the similarity threshold.