US 2015/0101049 A1Published application

Complex Scoring for Malware Detection

AssigneeBitdefender IPR Management Ltd.

InventorsSandor LUKACS, Raul V. TOSA, Paul BOCA, Gheorghe HAJMASAN, Andrei V. LUTAS

Life of this patent

Estimating the term…

Loading patent…

Abstract

Described systems and methods allow protecting a computer system from malware such as viruses, Trojans, and spyware. For each of a plurality of executable entities (such as processes and threads executing on the computer system), a scoring engine records a plurality of evaluation scores, each score determined according to a distinct evaluation criterion. Every time an entity satisfies an evaluation criterion (e.g, performs an action), the respective score of the entity is updated. Updating a score of an entity may trigger score updates of entities related to the respective entity, even when the related entities are terminated, i.e., no longer active. Related entities include, among others, a parent of the respective entity, and/or an entity injecting code into the respective entity. The scoring engine determines whether an entity is malicious according to the plurality of evaluation scores of the respective entity.

Claims22

Dependent claims

A host system comprising at least one processor configured to execute an entity management module, an entity evaluator, and a scoring engine, wherein:

the entity management module is configured to manage a collection of evaluated software entities, wherein managing the collection comprises:
identifying a set of descendant entities of a first entity of the collection;
determining whether the first entity is terminated;
in response, when the first entity is terminated, determining whether all members of the set of descendant entities are terminated;
and
in response, when all members of the set of descendant entities are terminated, removing the first entity from the collection;
the entity evaluator is configured to:
evaluate the first entity according to an evaluation criterion;
and
in response, when the first entity satisfies the evaluation criterion, transmit an evaluation indicator to the scoring engine;
and
the scoring engine is configured to:
record a first score determined for the first entity and a second score determined for a second entity of the collection, the first and second scores determined according to the evaluation criterion;
in response to recording the first and second scores, and in response to receiving the evaluation indicator, update the second score according to the evaluation indicator;
and
in response, determine whether the second entity is malicious according to the updated second score.

13 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/046,728Filed 4 Oct 2013
Published: 9 Apr 2015
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…
G06F 9/45558
Hypervisors; Virtual machine monitors: hypervisor-specific management and integration aspects
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
H04L 63/14
Network architectures or network communication protocols for network security: for detecting or protecting against malicious traffic