Filtering malware related content
AssigneeSymantec Corporation
InventorsRobert Conrad, Christopher Peterson, Joseph H. Chen
Life of this patent
Estimating the term…
Abstract
A submission filtering component filters malware related content received for analysis. The submission filtering component determines an analysis priority rating for each source from which malware related content is received. An analysis priority ratings is based on various factors indicative of how likely the source is to transmit malware related content that is important to analyze. The malware filtering component transforms the received stream of malware related content into a subset to be analyzed, based on the analysis priority ratings associated with sources from which malware related content is received. A malware analysis component analyzes the subset of malware related content.
Claims10
A computer implemented method for filtering malware related content for analysis, the method comprising the steps of:
- receiving malware related content forwarded from a plurality of sources that have received malware related content, by a computer;
- determining analysis priority ratings associated with specific ones of the plurality of sources, by a computer, each determined analysis priority rating indicating a priority for analyzing malware related content received from an associated source;
- creating a subset of received malware related content to be analyzed, based on at least available analysis resources and analysis priority ratings associated with sources from which malware related content is received, by a computer;
- responsive to a determined analysis priority rating associated with a source, transmitting submission instructions to that source, by a computer, the submission instructions directing that source as to how much malware related content to submit;
- receiving malware related content from that source according to the submission instructions, by a computer;
- adding all malware related content received from that source according to the submission instructions to the subset of malware related content to be analyzed, by a computer;
- and
- analyzing the subset of received malware related content, by a computer.
At least one non-transitory computer readable storage medium containing a computer program product for filtering malware related content for analysis, the computer program product comprising:
- program code for receiving malware related content forwarded from a plurality of sources that have received malware related content, by a computer;
- program code for determining analysis priority ratings associated with specific ones of the plurality of sources, by a computer, each determined analysis priority rating indicating a priority for analyzing malware related content received from an associated source;
- program code for creating a subset of received malware related content to be analyzed, based on at least available analysis resources and analysis priority ratings associated with sources from which malware related content is received, by a computer;
- program code for, responsive to a determined analysis priority rating associated with a source, transmitting submission instructions to that source, the submission instructions directing that source as to how much malware related content to submit;
- program code for receiving malware related content from that source according to the submission instructions;
- program code for adding all malware related content received from that source according to the submission instructions to the subset of malware related content to be analyzed;
- and
- program code for analyzing the subset of received malware related content, by a computer.
Dependencies are inferred from the claim text.