Method and apparatus for retroactively detecting malicious or otherwise undesirable software
AssigneeSourcefire, Inc.
InventorsOliver FRIEDRICHS, Alfred HUGER, Adam J. O'DONNELL, Zulfikar RAMZAN
Life of this patent
Estimating the term…
Abstract
A system for retroactively detecting malicious software on an end user system without performing expensive cross-referencing directly on the endpoint device. A client provides a server with information about files that are on it together with what it knows about these files. The server tracks this information and cross-references it against new intelligence it gathers on clean or malicious files. If a discrepancy is found (i.e., a file that had been called malicious, but that is actually benign or vice versa), the server informs the client, which in turn takes an appropriate action based on this information.
Claims21
A method for the retroactive detection and removal of undesirable software, comprising:
- periodically receiving, at a server in communication with a network, information relating to files on a client computing device, including information relating to whether one or more files have previously been classified as posing a threat or not;
- storing on said server said information relating to files on said client computing device, including said information relating to whether one or more files have previously been classified as posing a threat or not;
- periodically receiving at a server in communication with a network information useful in classifying files as posing a threat or not;
- cross-referencing said information relating to files on said client computing device with said information useful in classifying files as posing a threat or not to determine whether a previous classification of a file is inconsistent with a classification based on current information;
- if an inconsistent classification is found;
- communicating information concerning an updated classification to said client computing device or to an administrator responsible for said client computing device.
Non-transitory computer readable storage media containing computer readable instructions for:
- periodically receiving at a server in communication with a network information concerning files on a client computing device, including information concerning whether one or more files have been deemed benign or malicious;
- storing on said server said information concerning files on said client computing device;
- periodically receiving at a server in communication with a network information useful in the identification of malicious files;
- cross-referencing said information concerning files on said client computing device with said information useful in the identification of malicious files to determine whether one or more of said files on said client computing device are malicious;
- if one or more files on said client computing device are determined to be malicious;
- communicating information concerning said determination to said client computing device.
Dependencies are inferred from the claim text.