Systems and methods for using file paths to identify potentially malicious computer files
AssigneeSymantec Corporation
InventorsRobert Conrad, David Kane
Life of this patent
Estimating the term…
Abstract
A computer-implemented method for using file paths to identify potentially malicious computer files may include: 1) identifying a file, 2) identifying a file path associated with the file, 3) determining, by applying a heuristic to the file, that at least a portion of the file path is likely to have been randomly generated, 4) determining, based at least in part on the determination that at least portion of the file path has likely been randomly generated, that the file is potentially malicious, and 5) performing a security operation on the file. Corresponding systems and computer-readable instructions embodied on computer-readable media are also disclosed.
Claims18
A computer-implemented method for using file paths to identify potentially malicious computer files the method comprising:
- identifying a file using a computing device comprising at least one processor;
- identifying, by the computing device, a file path associated with the file;
- determining, by the computing device and applying a heuristic that weights one or more alphanumeric characters within the file path based at least in part on the aggregate frequency of the alphanumeric characters, that at least a portion of the file path is likely to have been randomly generated by:
- determining the frequency of occurrence of each alphanumeric character within the file path;
- determining, based on an analysis of the frequency of occurrence of the weighted alphanumeric characters within the file path, that less-common alphanumeric characters are present within at least a portion of the file path at a similar frequency as more-common alphanumeric characters;
- determining the position of each alphanumeric character within the file path;
- determining, based on an analysis of the position of each alphanumeric character within the file path, that the distribution of alphanumeric characters within at least a portion of the file path is likely random;
- determining, by the computing device and based at least in part on the determination that at least a portion of the file path has likely been randomly generated, that the file is potentially malicious;
- performing, by the computing device, a security operation on the file upon determining that the file is potentially malicious.
A system for identifying potentially malicious computer files, the system comprising:
- an identification module programmed to:
- identify a file;
- identify a file path associated with the file;
- a heuristic-application module programmed to:
- determine, by applying a heuristic that weights one or more alphanumeric characters within the file path based at least in part on the aggregate frequency of the alphanumeric characters, that at least a portion of the file path is likely to have been randomly generated by:
- determining the frequency of occurrence of each alphanumeric character within the file path;
- determining, based on an analysis of the frequency of occurrence of the weighted alphanumeric characters within the file path, that less common alphanumeric characters are present within at least a portion of the file path at a similar frequency as more-common alphanumeric characters;
- determining the position of each alphanumeric character within the file path;
- determining, based on an analysis of the position of each alphanumeric character within the file path, that the distribution of alphanumeric characters within at least a portion of the file path is likely random;
- determine, based at least in part on the determination that at least portion of the file path has likely been randomly generated, that the file is potentially malicious;
- a security module programmed to perform a security operation on the file upon determining that the file is potentially malicious;
- a processor for executing the identification module, the heuristic-application module, and the security module.
A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that cause the computing device to:
- identify, when executed by at least one processor of a computing device, a file;
- identify, by the processor, a file path associated with the file;
- determine, by the processor and applying a heuristic that weights one or more alphanumeric characters within the file path based at least in part on the aggregate frequency of the alphanumeric characters, that at least a portion of the file path is likely to have been randomly generated by:
- determining the frequency of occurrence of each alphanumeric character within the file path;
- determining, based on an analysis of the frequency of occurrence of the weighted alphanumeric characters within the file path, that less-common alphanumeric characters are present within at least a portion of the file path at a similar frequency as more-common alphanumeric characters;
- determining the position of each alphanumeric character within the file path;
- determining, based on an analysis of the position of each alphanumeric character within the file path, that the distribution of alphanumeric characters within at least a portion of the file path is likely random;
- determine, by the processor and based at least in part on the determination that at least a portion of the file path has likely been randomly generated, that the file is potentially malicious;
- perform, by the processor a security operation on the file upon determining that the file is potentially malicious.
Dependencies are inferred from the claim text.