Systems and methods for creating customized confidence bands for use in malware detection
AssigneeSymantec Corporation
InventorsJoseph Chen, Jamie Jooyoung Park
Life of this patent
Estimating the term…
Abstract
A computer-implemented method for creating customized confidence bands for use in malware detection may include 1) identifying a portal for receiving executable content, 2) identifying metadata relating to the portal, 3) analyzing the metadata to determine what risk executable content received via the portal poses, and then 4) creating, based on the analysis, a confidence band to apply during at least one disposition of executable content received via the portal. Various other methods, systems, and computer-readable media are also disclosed.
Claims20
A computer-implemented method for creating customized confidence bands for use in malware detection, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
- identifying a portal for receiving executable content;
- identifying metadata relating to the portal;
- analyzing the metadata to determine what risk executable content received via the portal poses;
- creating, based on the analysis, a confidence band to apply during at least one disposition of executable content received via the portal;
- adjusting a sub-band of the confidence band based on an indication of how susceptible the portal is to malware.
A system for creating customized confidence bands for use in malware detection, the system comprising:
- an identification module programmed to:
- identify a portal for receiving executable content;
- identify metadata relating to the portal;
- an analysis module programmed to analyze the metadata to determine what risk executable content received via the portal poses;
- a creation module programmed to:
- create, based on the analysis, a confidence band to apply during at least one disposition of executable content received via the portal;
- adjust a sub-band of the confidence band based on an indication of how susceptible the portal is to malware;
- at least one processor configured to execute the identification module, the analysis module, and the creation module.
A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
- identify a portal for receiving executable content;
- identify metadata relating to the portal;
- analyze the metadata to determine what risk executable content received via the portal poses;
- create, based on the analysis, a confidence band to apply during at least one disposition of executable content received via the portal;
- adjust a sub-band of the confidence band based on an indication of how susceptible the portal is to malware.
Dependencies are inferred from the claim text.