False alarm detection for malware scanning
AssigneeF-Secure Corporation
InventorJarno Niemela
Life of this patent
Estimating the term…
Abstract
A method of scanning files for malware on a computer system. The method includes receiving a file to be scanned in the system, and using at least one malware scanning engine to determine whether or not the file possesses properties that are indicative of malware. If it is determined that the file does possess properties that are indicative of malware, then at least one cleanliness scanning engine is used to determine whether or not the file possesses properties that are indicative of a clean file. If it is determined that the file possesses properties that are indicative of a clean file, then a false alarm is signalled.
Claims5
A method of providing a malware scanning service to a multiplicity of client computers, the method comprising at a backend server or set of servers performing the steps of:
- receiving files to be scanned and for each file
- using at least one malware scanning engine to determine whether or not the file possesses properties that are indicative of malware,
- if it is determined that the file does possess properties that are indicative of malware, then using at least one cleanliness scanning engine to determine, using one or more heuristics, whether or not the file possesses properties that are indicative of a clean file,
- if it is determined that the file possesses properties that are indicative of a clean file, then signaling a false alarm;
- for files for which false alarms are signaled, performing a further automatic and/or manual check to confirm whether or not the file is malware;
- and
- for each file that is confirmed as malware and for each file that possesses properties that are indicative of malware but does possess properties that are indicative of a clean file, generating a scanning signature and/or scanning rule and distributing this/these to the client computers.
A backend computer system for providing a malware scanning service to a multiplicity of client computers, the system comprising:
- an input for receiving files to be scanned;
- a first processor configured to use at least one malware scanning engine to determine whether or not at least one of the files possesses properties that are indicative of malware;
- a second processor configured to use at least one cleanliness scanning engine to determine, using one or more heuristics, whether or not at least one of the files possesses properties that are indicative of a clean file if it is determined that the file does possess properties that are indicative of malware, and to signal a false alarm if it is determined that the file possesses properties that are indicative of a clean file;
- a third processor configured, for files for which false alarms are signaled, to perform a further automatic and/or manual check to confirm whether or not the file is malware;
- a fourth processor configured, for each file that is confirmed as malware and for each file that possesses properties that are indicative of malware but does possess properties that are indicative of a clean file, to generate a scanning signature and/or scanning rule;
- and
- an output for distributing the scanning signature and/or scanning rule to the client computers.
Dependencies are inferred from the claim text.