Method and system for detection of malware that connect to network destinations through cloud scanning and web reputation

#The present invention relates generally to computer security and malware protection and, more particularly, to a method and system detecting malware that connect to network destinations outside of an infected machine, through cloud scanning and web reputation.

#Server side polymorphism is a difficult challenge when creating anti-virus techniques. In server side polymorphism, a malware server generates different permutations of the same binary. The permutated version is then downloaded by a client side malware deployed on an infected end point. The new permutations version is used for further propagation, as anti-virus software may not yet recognize the new permutated version. To make contact with the server to download the new mutated version, the client side malware must use an unsuspecting computer's network connection. A server may unsuspectingly host the permutated malware to be downloaded, as it may have been commandeered by a malware server.

#Other kinds of malware also need to “phone home” to a server as well. For example, downloaders may contact a server to download other binaries to initiate or continue attacks. Spyware, password stealers, and the like must contact a server to upload collected data. Some malware must contact a server in order to let an attacking process take control of the infected machine.

#For a more complete understanding of the present invention and its features and advantages, reference is now made to the following description, taken in conjunction with the accompanying drawings, in which:

#FIG. 1 is an illustration of an example system for defeating malware that communicate with network servers through connection scanning and web reputation;

#FIG. 2 is an illustration of some portions of the system of FIG. 1 for scanning an electronic device;

#FIG. 1 is an illustration of an example system 100 for defeating malware that communicate with network servers through connection scanning and web reputation. System 100 may comprise a monitor 102, an electronic device 104, and a reputation server 108. Monitor 102 may be configured to scan electronic device 104 for possible malware that communicate with network destinations 106 to carry out malicious activities. Monitor 102 may be configured to communicate with reputation server 108 to determine whether applications or network connections belonging to electronic device 104, or network destinations 106 connected through network 112 to electronic device 104, comprise malware or malicious activities associated with malware. Reputation server 108 may be configured to evaluate the network connections, and monitor 102 may be configured to receive the evaluation from reputation server 108.

#In one embodiment, monitor 102 may be configured to operate in a cloud computing scheme. Monitor 102 may comprise software that resides on network 110, and may be loaded and executed on a machine in network 110. Monitor may be communicatively coupled to electronic device 104 through network 110 or any other suitable network or communication scheme. Monitor may scan electronic device 104 without executing on electronic device 104. Monitor 102 may be communicatively coupled to reputation server 108 through network 110, network 114, or both. The reputation server 108 may comprise a server on network 114. In one embodiment, monitor 102 and reputation server 108 may reside on the same network. In one embodiment, monitor 102 and reputation server 108 may reside on the same hardware.

#In one embodiment, monitor 102 may reside on electronic device 104. Monitor 102 may be loaded and executed on electronic device 104. Monitor 102 may be communicatively coupled to reputation server 108 through network 114, or any other suitable network or communication scheme.