Automatic generation of policy-driven anti-malware signatures and mitigation of DoS (denial-of-service) attacks

A method for identifying malware in a network, comprising:

• receiving, from a user, one or more policies, the one or more policies include at least one of a policy for signature generation or a policy for filtering incoming payloads;
• generating a rule request based on information associated with an incoming payload on detection of an event that triggers signature generation, the rule request is employed to determine if a signature is to be generated for the incoming payloads after detection of the event and prior to generating the signature;
• comparing a rule request associated with an incoming payload with the one or more policies to determine whether a signature is to be generated for the incoming payload;
• triggering signature generation based at least in part on the rule request and the one or more specified policies, the generated signature employed to identify malware;
• attaching metadata to the generated signature, the metadata including a confidence metric associated with the generated signature, wherein the confidence metric for a particular signature indicates a likelihood that a payload triggering the particular signature is malware and the metadata facilitates identification and separation of a particular malware attack from other malware attacks;
• and
• sending the generated signature and its associated metadata to the user for approval of the generated signature based on the confidence metric.

A system that facilitates identification of malware, comprising:

• a policy defining component receiving, from a user, at least one policy, the at least one policy includes at least one of a policy for signature generation or a policy for filtering incoming payloads;
• a signature-determining rules component comparing a rule request associated with an incoming payload with the at least one policy to determine whether a signature is to be generated for the incoming payload after detecting an event that triggers a process of generating the signature and prior to generating the signature, the signature-determining rules component further attaching metadata to the generated signature, the metadata including a confidence metric associated with the general signature, wherein the confidence metric for a particular signature indicates a likelihood that a payload triggering the particular signature is malware and the metadata facilitates identification and separation of a particular malware attack from other malware attacks;
• a signature determining component triggering signature generation based at least in part on the rule request and the at least one specified policy, the generated signature employed to identify malware;
• and
• a signature verifying component sending the generated signature and its associated metadata to the user for approval of the generated signature based on the confidence metric.