Back to results
US 8,621,625 B1Granted
Methods and systems for detecting infected files
AssigneeSymantec Corporation
InventorsWalter Bogorad, Vadim Antonov
Life of this patent
Estimating the term…
Abstract
A computer-implemented method for detecting infected files may include identifying a set of known-clean files. The method may also include identifying a set of characteristics of an unchecked file. The method may further include determine that the unchecked file is related to a clean file in the set of known-clean files. The determination may be based on the set of characteristics of the unchecked file. The method may additionally include determining whether the unchecked file is functionally equivalent to the clean file. This determination may be based on the set of characteristics of the unchecked file. Various other methods, systems, and computer-readable media are also disclosed.
Claims17
A computer-implemented method for detecting infected files, the computer-implemented method comprising:
- identifying a set of characteristics of at least one invariant portion of an unchecked file;
- identifying a set of known-clean files;
- determining a distance between the set of characteristics of the invariant portion of the unchecked file and a set of characteristics of at least one corresponding invariant portion of a clean file in the set of known-clean files by:
- comparing the set of characteristics of the invariant portion of the unchecked file to the set of characteristics of the corresponding invariant portion of the clean file;
- determining how many characteristics included in the set of characteristics of the invariant portion of the unchecked file do not match the set of characteristics included in the set of characteristics of the corresponding invariant portion of the clean file;
- determining that the unchecked file is related to the clean file in the set of known-clean files based on the distance between the set of characteristics of the invariant portion of the unchecked file and the set of characteristics of the corresponding invariant portion of the clean file being below a threshold;
- determining whether the unchecked file is functionally equivalent to the clean file based on the distance between the set of characteristics of the invariant portion of the unchecked file and the set of characteristics of the corresponding invariant portion of the clean file.
4 more elements
A system comprising:
- a scanning module installed on a first computing subsystem and programmed to:
- identify an unchecked file;
- generate a set of characteristics of at least one invariant portion of the unchecked file, wherein the set of characteristics comprises information for conducting a comparative static analysis;
- transmit the set of characteristics to a second computing subsystem;
- an analysis module installed on the second computing subsystem and programmed to:
- identify a set of known-clean files;
- receive, from the first computing subsystem, the set of characteristics of the invariant portion of the unchecked file;
- determine, based on the set of characteristics of the invariant portion of the unchecked file, that the unchecked file is related to a clean file in the set of known-clean files by:
- finding the clean file in the set of known-clean files that comprises at least one corresponding invariant portion whose set of characteristics has a smallest distance from the set of characteristics of the invariant portion of the unchecked file, wherein the smallest distance indicates a smallest number of characteristics that do not match and the unchecked file comprises executable code;
- determining that the smallest distance is below a threshold;
- determine, based on the set of characteristics of the invariant portion of the unchecked file, whether the unchecked file is equivalent to the clean file;
- at least one hardware processor configured to execute the scanning module and the analysis module.
9 more elements
A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by a computing device, cause the computing device to:
- identify a set of characteristics of at least one invariant portion of an unchecked file;
- identify a set of known-clean files;
- determine a distance between the set of characteristics of the invariant portion of the unchecked file and a set of characteristics of at least one corresponding invariant portion of a clean file in the set of known-clean files by:
- comparing the set of characteristics of the invariant portion of the unchecked file to the set of characteristics of the corresponding invariant portion of the clean file;
- determining how many characteristics included in the set of characteristics of the invariant portion of the unchecked file do not match the set of characteristics included in the set of characteristics of the corresponding invariant portion of the clean file;
- determine that the unchecked file is related to the clean file in the set of known-clean files based on the distance between the set of characteristics of the invariant portion of the unchecked file and the set of characteristics of the corresponding invariant portion of the clean file being below a threshold;
- in response to determining that the unchecked file is related to the clean file, determine whether the unchecked file is functionally equivalent to the clean file based on the distance between the set of characteristics of the invariant portion of the unchecked file and the set of characteristics of the corresponding invariant portion of the clean file.
4 more elements
Dependencies are inferred from the claim text.