US 8,572,743 B2 · Virus localization using cryptographic hashing

Abstract

Methods for using integrity checking techniques to identify and locate computer viruses are provided. A method for virus localization for each of three types of virus infections is provided, including the steps of computing a sequence of file blocks, calculating hashes for the sequences of file blocks from a host file and calculating hashes for the same or related sequences of file blocks from an infected file, and comparing the hashes from host file to the hashes from the infected file from the same or related sequences of file blocks such that when some of said first hashes and said second hashes do not match, a location of a virus is output. Methods for computing the sequence of file blocks depending on the type of virus infection, and for calculating the hashes using a collision resistant hash function, a digital signature scheme, a message authentication code, or a pseudo-random function.

Claims18

Dependent claims

A method for virus localization, the method comprising:

calculating first hashes for a first sequence of file blocks from at least a section of a host file;
calculating second hashes for a second sequence of file blocks from a modified host file, the second sequence corresponding to the first sequence;
comparing the first hashes and the second hashes to determine first matching data;
calculating third hashes for a third sequence of file blocks from a reverse of the at least a section of the host file;
calculating fourth hashes for a fourth sequence of file blocks from a reverse of the at least a section of the modified host file, the fourth sequence corresponding to the third sequence;
comparing the third hashes and the fourth hashes to determine second matching data;
and
outputting an estimated location of a virus relative to the modified host file based upon an intersection of the first and second matching data using a processor circuit.

5 more elements

A non-transitory tangible computer-readable medium storing instructions such that, if executed by a machine, will cause the machine to execute operations comprising:

calculating first hashes for a first sequences of file blocks from at least a section of a host file;
calculating second hashes for a second sequence of file blocks from a modified host file, the second sequence corresponding to the first sequence;
comparing the first hashes and the second hashes to determine first matching data;
calculating third hashes for a third sequence of file blocks from a reverse of the at least a section of the host file;
calculating fourth hashes for a fourth sequence of file blocks from a reverse of the at least a section of the modified host file;
comparing the third hashes and the fourth hashes to determine second matching data;
and
outputting an estimated location of a virus relative to the modified host file based upon based upon an intersection of the first and second matching data.

5 more elements

An apparatus configured to detect and locate a computer virus in a modified file, the apparatus comprising:

a memory configured to receive and store a modified file and a set of first and third hashes which correspond to a processing result of a host file;
at least one processing circuit of a computer device, the processing circuit in communication with the memory, the processing circuit configured to calculate second and fourth hashes for at least a section of the modified file using corresponding second and fourth sequences of file blocks as used to calculate the first and third hashes, the first hashes calculated for a first sequence of file blocks from at least a section of the host file and the third hashes calculated for a third sequence of file blocks from a reverse of the at least a section of the host file;
wherein the at least one processing circuit is configured to compare the first hashes and the second hashes to determine first matching data, compare the third hashes and the fourth hashes to determine second matching data, and to output an estimated location of a virus relative to the modified file based upon an intersection of the first and second matching data.

Dependencies are inferred from the claim text.

Virus localization using cryptographic hashing

Life of this patent

Virus localization using cryptographic hashing

Life of this patent

Abstract

Claims18