# US 2017/0255776 A1 · Discovery of malicious strings

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0255776 A1
- Document ID: US20170255776A1
- Status: Published application
- Kind: A1
- Application number: 15/601,534
- Filed: 2017-05-22
- Published: 2017-09-07
- Earliest claimed: 2014-12-23
- Assignees: McAfee, Inc.
- Applicants: McAfee, Inc.
- Inventors: Zheng Zhang; Craig D. Schmugar
- Web page: https://patentgrep.com/patent/US20170255776A1

## CPC

- G06F 21/564: {by virus signature recognition}
- G06F 21/567: {using dedicated hardware}
- H04L 63/14: {for detecting or protecting against malicious traffic}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Particular embodiments described herein provide for an electronic device that can be configured to determine a string sample of data, determine a hash of the string sample of data, automatically cluster the hash with other hashes from other string samples of data, and automatically create a signature hash string for the string sample of data.

## Claims

### Claim at position 1

-25. (canceled)

### Claim 26

At least one non-transitory computer-readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to:
determine a string of a data sample;
perform an Internet search for the string;
compare the results of the Internet search for the string with results of an Internet search for a known clean string;
cluster, based on a determination that the number of hits from the Internet search is not comparable to the number of hits from a known clean string search, the string with other strings having Internet search results that are not comparable to those of a known clean string; and
populate a dirty string database with the clustered strings.

### Claim 27 (depends on 26)

The at least one non-transitory computer-readable medium of claim 26, further comprising one or more instructions that when executed by the at least one processor, further cause the processor to:
determine a cluster of most commonly occurring strings in the dirty string database;
create a hash of each of the strings in the cluster of most commonly occurring strings; and
store the hash of each of the strings from the cluster of most commonly occurring strings in a blacklist hash string database.

### Claim 28 (depends on 27)

The at least one non-transitory computer-readable medium of claim 27, further comprising one or more instructions that when executed by the at least one processor, further cause the processor to:
cluster the hash of each of the strings in the cluster of most commonly occurring strings to create a string hash signature; and
communicate the string hash signature to an electronic device for use in the detection of the malware.

### Claim 29 (depends on 28)

The at least one non-transitory computer-readable medium of claim 28, further comprising one or more instructions that when executed by the at least one processor, further cause the processor to:
remove hashes of short strings from the cluster of hashes to create a second string hash signature; and
store the second string hash signature in the blacklist hash string database.

### Claim 30 (depends on 26)

The at least one non-transitory computer-readable medium of claim 26, further comprising one or more instructions that when executed by the at least one processor, further cause the processor to:
determine a hash of the string;
filter the hash of the string using a whitelist hash string database; and
classify the string as trusted if the hash of the string is found in the whitelist hash string database.

### Claim 31 (depends on 26)

The at least one non-transitory computer-readable medium of claim 26, wherein the data sample was received from an electronic device.

### Claim 32

An apparatus comprising:
memory; and
a hardware processor configured to:
determine a string of a data sample;
perform an Internet search for the string;
compare the results of the Internet search for the string with results of an Internet search for a known clean string;
cluster, based on a determination that the number of hits from the Internet search is not comparable to the number of hits from a known clean string search, the string with other strings having Internet search results that are not comparable to those of a known clean string; and
populate a dirty string database with the clustered strings.

### Claim 33 (depends on 32)

The apparatus of claim 32, wherein the hardware processor is further configured to:
determine a cluster of most commonly occurring strings in the dirty string database;
create a hash of each of the strings in the cluster of most commonly occurring strings; and
store the hash of each of the strings from the cluster of most commonly occurring strings in a blacklist hash string database.

### Claim 34 (depends on 33)

The apparatus of claim 33, wherein the hardware processor is further configured to:
cluster the hash of each of the strings in the cluster of most commonly occurring strings to create a string hash signature; and
communicate the string hash signature to an electronic device for use in the detection of the malware.

### Claim 35 (depends on 34)

The apparatus of claim 34, wherein the hardware processor is further configured to:
remove hashes of short strings from the cluster of hashes to create a second string hash signature; and
store the second string hash signature in the blacklist hash string database.

### Claim 36 (depends on 32)

The apparatus of claim 32, wherein the hardware processor is further configured to:
determine a hash of the string;
filter the hash of the string using a whitelist hash string database; and
classify the string as trusted if the hash of the string is found in the whitelist hash string database.

### Claim 37 (depends on 32)

The apparatus of claim 32, wherein the data sample was received from an electronic device.

### Claim 38

A method comprising:
determining a string of a data sample;
performing an Internet search for the string;
comparing the results of the Internet search for the string with results of an Internet search for a known clean string;
clustering, based on a determination that the number of hits from the Internet search is not comparable to the number of hits from a known clean string search, the string with other strings having Internet search results that are not comparable to those of a known clean string; and
populating a dirty string database with the clustered strings.

### Claim 39 (depends on 38)

The method of claim 38, further comprising:
determining a cluster of most commonly occurring strings in the dirty string database;
creating a hash of each of the strings in the cluster of most commonly occurring strings; and
storing the hash of each of the strings from the cluster of most commonly occurring strings in a blacklist hash string database.

### Claim 40 (depends on 39)

The method of claim 39, further comprising:
clustering the hash of each of the strings in the cluster of most commonly occurring strings to create a string hash signature; and
communicating the string hash signature to an electronic device for use in the detection of the malware.

### Claim 41 (depends on 40)

The method of claim 40, further comprising:
removing hashes of short strings from the cluster of hashes to create a second string hash signature; and
storing the second string hash signature in the blacklist hash string database.

### Claim 42 (depends on 38)

The method of claim 38, further comprising:
determining a hash of the string;
filtering the hash of the string using a whitelist hash string database; and
classifying the string as trusted if the hash of the string is found in the whitelist hash string database.

### Claim 43 (depends on 38)

The method of claim 38, wherein the data sample was received from an electronic device.

### Claim 44

A system for discovering malicious strings, the system comprising:
memory; and
a hardware processor configured for:
determining a string of a data sample;
performing an Internet search for the string;
comparing the results of the Internet search for the string with results of an Internet search for a known clean string;
clustering, based on a determination that the number of hits from the Internet search is not comparable to the number of hits from a known clean string search, the string with other strings having Internet search results that are not comparable to those of a known clean string; and
populating a dirty string database with the clustered strings.

### Claim 45 (depends on 44)

The system of claim 44, wherein the system is further configured for:
determining a cluster of most commonly occurring strings in the dirty string database;
creating a hash of each of the strings in the cluster of most commonly occurring strings; and
storing the hash of each of the strings from the cluster of most commonly occurring strings in a blacklist hash string database.

### Claim 46 (depends on 45)

The system of claim 45, wherein the system is further configured for:
clustering the hash of each of the strings in the cluster of most commonly occurring strings to create a string hash signature; and
communicating the string hash signature to an electronic device for use in the detection of the malware.

### Claim 47 (depends on 46)

The system of claim 46, wherein the system is further configured for:
removing hashes of short strings from the cluster of hashes to create a second string hash signature; and
storing the second string hash signature in the blacklist hash string database.

### Claim 48 (depends on 44)

The system of claim 44, wherein the system is further configured for:
determining a hash of the string;
filtering the hash of the string using a whitelist hash string database; and
classifying the string as trusted if the hash of the string is found in the whitelist hash string database.

### Claim 49 (depends on 44)

The system of claim 44, wherein the data sample was received from an electronic device.