US 8,769,691 B1 · Network traffic reduction

Abstract

A server access log includes data records each describing a previous query regarding a suspect computer file of a client computer. Each record includes the CRC code for the suspect computer file, the result of the malware analysis performed on the backend server and other attributes and values. The log is analyzed to retrieve relevant attributes and values from each record. Key attributes and values are generated such as region and continuous query. All CRC codes are grouped according to attribute values. Each group is analyzed to determine the network traffic associated with downloading the entire group to all user computers and the network traffic associated with not downloading the group but responding to future malware queries regarding CRC codes in the group. CRC codes are removed from each group if necessary. CRC code-result pairs for each group are downloaded to all user computers as a pre-fetch cache.

Claims24

Dependent claims

A method of forming a cache for use in malware detection, said method comprising:

retrieving a plurality of hash value-result pairs from an access log database, each hash value uniquely identifying a computer file suspected of being malware and wherein the result of each of said pairs depends upon its corresponding hash value and wherein the result of each of said pairs indicates whether or not its corresponding hash value does identify malware;
for each of said hash value-result pairs, retrieving at least one other attribute and its value from a data record associated with said each hash value-result pair;
grouping a subset of said hash value-result pairs into a single group wherein the value of said at least one other attribute is the same for all of said hash value-result pairs in said single group;
identifying a plurality of user computers each having a characteristic that matches with said same value of all of said hash value-result pairs in said single group;
and
downloading said single group of hash value-result pairs to each of said user computers to be used as said cache.

3 more elements

A method of forming a cache for use in malware detection, said method comprising:

analyzing an access log database of data records, each data record describing a previously submitted malware query from a user computer;
from each of said data records, retrieving a hash value-result pair identifying said previously submitted malware query;
for each of said data records, generating a key attribute and a key attribute value based upon a value and an attribute of each of said data records, each of said key attribute values being associated with one of said hash value-result pairs;
forming a group of said hash value-result pairs wherein said key attribute value associated with each of said hash value-result pairs in said group is the same;
identifying a plurality of target user computers each having a characteristic that matches with said key attribute value of all of said hash value-result pairs in said group;
and
downloading said group of hash value-result pairs to each of said target user computers to be used as said cache.

4 more elements

A method of forming a cache for use in malware detection on a plurality of user computers, said method comprising:

retrieving a plurality of hash value-result pairs from a database, wherein each hash value uniquely identifies a computer file suspected of being malware and wherein the result of each of said pairs depends upon its corresponding hash value and wherein the result of each of said pairs indicates whether or not its corresponding hash value does identify malware;
grouping a subset of said hash value-result pairs into a single group based upon the value of an attribute that all of said hash value-result pairs of said subset have in common;
determining a network traffic volume associated with downloading said single group to each of said user computers;
determining a forecast network traffic volume associated with not downloading said single group to each of said user computers and instead responding to queries one-by-one from said user computers regarding said hash values in said single group;
and
flagging said single group as being a cache suitable for downloading to each of said user computers when said network traffic volume is less than said forecast network traffic volume.

3 more elements

Dependencies are inferred from the claim text.

Network traffic reduction

Life of this patent

Network traffic reduction

Life of this patent

Abstract

Claims24