Dynamic quarantining for malware detection
AssigneeMcAfee, Inc.
InventorsMichael G. Bishop, Raoul J. Tiddy, Igor Muttik, Alexander J. Hinchliffe, Christopher C. Williams
Life of this patent
Estimating the term…
Abstract
A method includes detecting a portion of data on an electronic device, determining a first representation of the malware status of the data, quarantining the data for a period of time, estimating whether the data is associated with malware by comparing the first and second representation, and, based on the estimation, releasing the data from quarantine. The first representation indicates that the malware status of the data is not certain to be safe and the malware status of the data is not certain to be malicious.
Claims20
A method for preventing malware attacks, comprising:
- on an electronic device, analyzing a portion of data;
- determining a first representation of the malware status of the data, including:
- determining that the malware status of the data is not certain to be safe;
- and
- determining that the malware status of the data is not certain to be malicious;
- quarantining the data for a period of time based on the determination of the first representation of the malware status of the data;
- determining a second representation of the malware status of the same data after the period of time;
- estimating whether the data is associated with malware by comparing the first and second representation;
- and
- based on the estimation of whether the data is associated with malware, releasing the data from quarantine.
At least one non-transitory machine readable storage medium, comprising computer-executable instructions carried on the non-transitory machine readable storage medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
- analyze a portion of data;
- determine a first representation of the malware status of the data, including:
- determining that the malware status of the data is not certain to be safe;
- and
- determining that the malware status of the data is not certain to be malicious;
- quarantine the data for a period of time;
- determine a second representation of the malware status of the same data after the period of time;
- estimate whether the data is associated with malware by comparing the first and second representation;
- and
- based on the estimation of whether the data is associated with malware, release the data from quarantine.
A system for preventing malware attacks, comprising:
- a device including a portion of data;
- a processor coupled to a computer readable medium;
- and
- computer-executable instructions carried on the computer readable medium, the instructions readable by the processor, the instructions, when read and executed, for causing the processor to:
- analyze the data;
- determine a first representation of the malware status of the data, including:
- determining that the malware status of the data is not certain to be safe;
- and
- determining that the malware status of the data is not certain to be malicious;
- quarantine the data for a period of time;
- determine a second representation of the malware status of the same data after the period of time;
- estimate whether the data is associated with malware by comparing the first and second representation;
- and
- based on the estimation of whether the data is associated with malware, release the data from quarantine.
Dependencies are inferred from the claim text.