Back to results
US 8,474,039 B2Granted
System and method for proactive detection and repair of malware memory infection via a remote memory reputation system
AssigneeMcAfee, Inc.
InventorAhmed Said Sallam
Life of this patent
Estimating the term…
Abstract
A method for detecting malware memory infections includes the steps of scanning a memory on an electronic device, determining a suspicious entry present in the memory, accessing information about the suspicious entry in a reputation system, and evaluating whether the suspicious entry indicates a malware memory infection. The memory includes memory known to be modified by malware. The suspicious entry is not recognized as a safe entry. The reputation system is configured to store information on suspicious entries. The evaluation is based upon historical data regarding the suspicious entry.
Claims33
A method for detecting malware memory infections, comprising the steps of:
- scanning a memory on an electronic device, the memory comprising memory vulnerable to memory modifications caused by malware;
- determining a suspicious entry present in the memory, the suspicious entry not recognized as a safe entry, the suspicious entry comprising a modification to an existing entry in memory;
- accessing information about the suspicious entry from a reputation system, the reputation system configured to store information on suspicious entries;
- and
- evaluating whether the suspicious entry indicates a malware memory infection, wherein the evaluation is based upon historical data regarding the suspicious entry, comprising:
- comparing the distribution pattern of the suspicious entry against a known distribution pattern, the known distribution pattern indicating a safe memory modification or indicating a malware memory infection;
- comparing a determined quantity of devices for which the suspicious entry has been reported against an upper threshold;
- comparing the time range of the determined quantity of devices against a lower threshold;
- and
- determining that the suspicious entry does not indicate a malware memory infection if the determined quantity of devices exceeds the upper threshold and the time range of the determined quantity of devices is less than the lower threshold.
7 more elements
A method for detecting malware memory infections, comprising the steps of:
- scanning a memory on an electronic device, the memory comprising memory vulnerable to memory modifications caused by malware;
- determining a suspicious entry present in the memory, the suspicious entry not recognized as a safe entry, the suspicious entry comprising a modification to an existing entry in memory;
- accessing information about the suspicious entry from a reputation system, the reputation system configured to store information on suspicious entries;
- and
- evaluating whether the suspicious entry indicates a malware memory infection, wherein the evaluation is based upon historical data regarding the suspicious entry, comprising:
- comparing the distribution pattern of the suspicious entry against a known distribution pattern, the known distribution pattern indicating a safe memory modification or indicating a malware memory infection;
- comparing a determined quantity of devices for which the suspicious entry has been reported against a lower threshold;
- comparing the time range of the determined quantity of devices against an upper threshold;
- and
- determining that the suspicious entry indicates a malware memory infection if the determined quantity of devices is less than the lower threshold and the time range of the determined quantity of devices exceeds the upper threshold.
7 more elements
An article of manufacture, comprising:
- a non-transitory computer readable medium;
- and
- computer-executable instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
- scan a memory on an electronic device, the memory comprising memory vulnerable to memory modifications caused by malware;
- determine a suspicious entry present in the memory, the suspicious entry not recognized as a safe entry, the suspicious entry comprising a modification to an existing entry in memory;
- access information about the suspicious entry from a reputation system, the reputation system configured to store information on suspicious entries;
- and
- evaluate whether the suspicious entry indicates a malware memory infection, wherein the evaluation is based upon historical data regarding the suspicious entry, comprising:
- comparing the distribution pattern of the suspicious entry against a known distribution pattern, the known distribution pattern indicating a safe memory modification, or indicating a malware memory infection;
- comparing a determined quantity of devices for which the suspicious entry has been reported against an upper threshold;
- comparing the time range of the determined quantity of devices against a lower threshold;
- and
- determining that the suspicious entry does not indicate a malware memory infection if the determined quantity of devices exceeds the upper threshold and the time range of the determined quantity of devices is less than the lower threshold.
10 more elements
An article of manufacture, comprising:
- a non-transitory computer readable medium;
- and
- computer-executable instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
- scan a memory on an electronic device, the memory comprising memory vulnerable to memory modifications caused by malware;
- determine a suspicious entry present in the memory, the suspicious entry not recognized as a safe entry, the suspicious entry comprising a modification to an existing entry in memory;
- access information about the suspicious entry from a reputation system, the reputation system configured to store information on suspicious entries;
- and
- evaluate whether the suspicious entry indicates a malware memory infection, wherein the evaluation is based upon historical data regarding the suspicious entry, comprising:
- comparing the distribution pattern of the suspicious entry against a known distribution pattern, the known distribution pattern indicating a safe memory modification, or indicating a malware memory infection;
- comparing a determined quantity of devices for which the suspicious entry has been reported against a lower threshold;
- comparing the time range of the determined quantity of devices against an upper threshold;
- and
- determining that the suspicious entry indicates a malware memory infection if the determined quantity of devices is less than the lower threshold and the time range of the determined quantity of devices exceeds the upper threshold.
10 more elements
A system detecting malware memory infections, comprising:
- a monitor, the monitor configured to:
- scan a memory on an electronic device, the memory comprising memory vulnerable to memory modifications caused by malware
- determine a suspicious entry present in the memory, the suspicious entry not recognized as a safe entry, the suspicious entry comprising a modification to an existing entry in memory;
- and
- send information about the suspicious entry to a reputation system configured to access information about the suspicious entry in a reputation database configured to store information on suspicious entries;
- and
- determine, based on information from the reputation system, whether the suspicious entry indicates a malware memory infection based upon historical data regarding the suspicious entry, comprising:
- comparing the distribution pattern of the suspicious entry against a known distribution pattern, the known distribution pattern indicating a safe memory modification, or indicating a malware memory infection;
- comparing a determined quantity of devices for which the suspicious entry has been reported against an upper threshold;
- comparing the time range of the determined quantity of devices against a lower threshold;
- and
- determining that the suspicious entry does not indicate a malware memory infection if the determined quantity of devices exceeds the upper threshold and the time range of the determined quantity of devices is less than the lower threshold.
9 more elements
A system detecting malware memory infections, comprising:
- a monitor, the monitor configured to:
- scan a memory on an electronic device, the memory comprising memory vulnerable to memory modifications caused by malware
- determine a suspicious entry present in the memory, the suspicious entry not recognized as a safe entry, the suspicious entry comprising a modification to an existing entry in memory;
- and
- send information about the suspicious entry to a reputation system configured to access information about the suspicious entry in a reputation database configured to store information on suspicious entries;
- and
- determine, based on information from the reputation system, whether the suspicious entry indicates a malware memory infection based upon historical data regarding the suspicious entry, comprising:
- comparing the distribution pattern of the suspicious entry against a known distribution pattern, the known distribution pattern indicating a safe memory modification, or indicating a malware memory infection;
- comparing a determined quantity of devices for which the suspicious entry has been reported against a lower threshold;
- comparing the time range of the determined quantity of devices against an upper threshold;
- and
- determining that the suspicious entry indicates a malware memory infection if the determined quantity of devices is less than the lower threshold and the time range of the determined quantity of devices exceeds the upper threshold.
9 more elements
Dependencies are inferred from the claim text.