US 8,302,194 B2 · Using file prevalence to inform aggressiveness of behavioral heuristics

Abstract

The prevalence rate of a file to be subject to behavior based heuristics analysis is determined, and the aggressiveness level to use in the analysis is adjusted, responsive to the prevalence rate. The aggressiveness is set to higher levels for lower prevalence files and to lower levels for higher prevalence files. Behavior based heuristics analysis is applied to the file, using the set aggressiveness level. In addition to setting the aggressiveness level, the heuristic analysis can also comprise dynamically weighing lower prevalence files as being more likely to be malicious and higher prevalence files as being less likely. Based on the applied behavior based heuristics analysis, it is determined whether or not the file comprises malware. If it is determined that the file comprises malware, appropriate steps can be taken, such as blocking, deleting, quarantining and/or disinfecting the file.

Claims18

Dependent claims

A computer implemented method for adjusting an aggressiveness level to use in behavior based heuristics malware detection, based on target file prevalence rates, the method comprising the steps of:

determining, by a computer, a prevalence rate of a file subject to behavior based heuristics analysis to determine whether the file comprises malware, wherein the prevalence rate reflects a level of distribution of the file;
adjusting, by a computer, the aggressiveness level to use in the behavior based heuristics analysis of the file, responsive to the determined prevalence rate of the file, comprising setting the aggressiveness level to a higher level for lower prevalence files and to a lower level for higher prevalence files;
applying, by a computer, behavior based heuristics analysis to the file, using the aggressiveness level;
and
determining, by a computer, whether the file comprises malware, based on the applied behavior based heuristics analysis.

2 more elements

At least one non-transitory computer readable storage medium storing a computer program product for adjusting an aggressiveness level to use in behavior based heuristics malware detection, based on target file prevalence rates, the computer program product comprising:

program code for determining a prevalence rate of a file subject to behavior based heuristics analysis to determine whether the file comprises malware, wherein the prevalence rate reflects a level of distribution of the file;
program code for adjusting the aggressiveness level to use in the behavior based heuristics analysis of the file, responsive to the determined prevalence rate of the file, comprising setting the aggressiveness level to a higher level for lower prevalence files and to a lower level for higher prevalence files;
program code for applying behavior based heuristics analysis to the file, using the aggressiveness level;
and
program code for determining whether the file comprises malware, based on the applied behavior based heuristics analysis.

2 more elements

Dependencies are inferred from the claim text.

Using file prevalence to inform aggressiveness of behavioral heuristics

Life of this patent

Using file prevalence to inform aggressiveness of behavioral heuristics

Life of this patent

Abstract

Claims18