Adaptive and recursive filtering for sample submission
AssigneeMcAfee, Inc.
InventorIgor Muttik
Life of this patent
Estimating the term…
Loading patent…
AssigneeMcAfee, Inc.
InventorIgor Muttik
Estimating the term…
Disclosed are systems, apparatuses, computer readable media, and methods of using an adaptive (i.e., learning) client-server system to enhance the efficiency of sample submissions, e.g., the submission of samples of malware programs to a server dictionary. The server in such a system may accumulate a dictionary of known programs and/or portions of programs that have been submitted by many different client devices over time, representing all the various programs that they have encountered. If a portion of a particular file submission is already “available” to the server (i.e., it is a portion that the server has already analyzed and stored), it will be excluded from all future sample transmissions. The server will gradually accumulate a rich dictionary of common program portions, thus requesting transmission only of previously unseen portions. Such systems, apparatuses, computer readable media, and methods may therefore be used to reduce transmission times needed for future sample submissions.
1-25. (canceled)
A computer readable medium comprising computer executable instructions stored thereon to cause one or more processing units to:
A computer readable medium comprising computer executable instructions stored thereon to cause one or more processing units to:
The computer readable medium of claim 36, further comprising instructions to cause the one or more processing units to reconstruct the sample by merging the received portions and the portions already available to the dictionary.
The computer readable medium of claim 37, further comprising instructions to cause the one or more processing units to perform malware analysis on the sample.
A method of sample analysis, comprising:
An apparatus configured to perform sample analysis, comprising:
Dependencies are inferred from the claim text.