US 2019/0199740 A1 · Apparatus and Methods for Network-Based Line-Rate Detection of Unknown Malware

Abstract

A network-based line-rate method and apparatus for detecting and managing potential malware utilizing a black list of possible malware to scan content and detect potential malware content based upon characteristics that match the preliminary signature. The undetected content is then subjected to an inference-based processes and methods to determine whether the undetected content is safe for release. Typical to inference-based processes and method, the verdict is a numerical value within a predetermined range, out of which content is not safe. The network content released if the verdict is within safe range, otherwise, the apparatus provides various options of handling such presumably unsafe content; options including, soliciting user input whether to release, block, or subject the content to further offline behavioral analysis.

Claims19

Dependent claims

An apparatus for network-based, malware analysis comprising:

a signature scanner configured to scan incoming network-based content with signature-based scanning to identify known threat content;
an AI scanner configured to:
assign a risk value, using an AI scan, to the network content which has not been identified as a known threat in the signature-based scanning step;
identify content having been assigned a risk score below a safe threshold value as safe content;
and
identify content having been assigned a risk score above a threat threshold as threat content;
and
a controller configured, based on the scans:
to allow safe content;
and
to block threat content.

8 more elements

Dependencies are inferred from the claim text.

Apparatus and Methods for Network-Based Line-Rate Detection of Unknown Malware

Life of this patent

Apparatus and Methods for Network-Based Line-Rate Detection of Unknown Malware

Life of this patent

Abstract

Claims19