Detecting malware using patterns
AssigneeRaytheon Company
InventorsMatthew Richard, Monty D. McDougal
Life of this patent
Estimating the term…
Abstract
In certain embodiments, a method includes receiving a first file. The method also includes accessing at least one storage module comprising a first malware pattern, a second malware pattern, and a third malware pattern. The second malware pattern is a first permutation of the first malware pattern. The third malware pattern is a second permutation of the second malware pattern and is different than the second malware pattern. The method includes comparing, by at least one processor, the first file to the third malware pattern. In addition, the method includes determining, by the at least one processor, that the first file comprises malware in response to comparing the file to the third malware pattern.
Claims21
A method comprising:
- receiving a first file;
- accessing at least one storage module comprising a first malware pattern, a second malware pattern, and a third malware pattern, the second malware pattern being a first permutation of the first malware pattern, the third malware pattern being a second permutation of the second malware pattern and different than the second malware pattern, wherein one or more of the first permutation and the second permutation comprises a bit rotation;
- comparing, by at least one processor, the first file to the third malware pattern;
- and
- determining, by the at least one processor, that the first file comprises malware in response to comparing the file to the third malware pattern.
A system comprising:
- at least one storage module storing a first malware pattern, a second malware pattern, and a third malware pattern, the second malware pattern being a first permutation of the first malware pattern, the third malware pattern being a second permutation of the second malware pattern and being different than the second malware pattern, wherein one or more of the first permutation and the second permutation comprises a bit rotation;
- and
- one or more processors configured to:
- receive a first file;
- compare the first file to the third malware pattern;
- and
- determine that the first file comprises malware in response to comparing the file to the third malware pattern.
At least one non-transitory computer-readable medium comprising instructions that, when executed by one or more processors, are configured to:
- receive a first file;
- access at least one storage module storing a first malware pattern, a second malware pattern, and a third malware pattern, the second malware pattern being a first permutation of the first malware pattern, the third malware pattern being a second permutation of the second malware pattern and different than the second malware pattern, wherein one or more of the first permutation and the second permutation comprises a bit rotation;
- compare the first file to the third malware pattern;
- and
- determine that the first file comprises malware in response to comparing the file to the third malware pattern.
Dependencies are inferred from the claim text.