Back to results
US 9,542,555 B2Granted
Malware detection system and method for compressed data on mobile platforms
AssigneePulse Secure, LLC
InventorsGeorge Tuvell, Deepak Venugopal
Life of this patent
Estimating the term…
Abstract
A system and method for detecting malware in compressed data. The system and method identifies a set of search strings extracted from compressed executables, each of which is infected with malware from a family of malware. The search strings detect the presence of the family of malware in other compressed executables, fragments of compressed executables, or data streams.
Claims11
A computing device for developing search strings for detecting malware in compressed data, the device comprising:
- a non-transitory memory having stored thereon a plurality of malware-infected executables infected with a family of malware, wherein each of the plurality of malware-infected executables comprises a respective compressed code portion;
- and
- a hardware-based processor configured to:
- extract a plurality of candidate strings from the compressed code portions of the plurality of malware-infected executables;
- identify at least one of the plurality of candidate strings that is present in each of the plurality of malware-infected executables as a search string common to the compressed code portions of the plurality of malware-infected executables;
- and
- store the search string common to the plurality of malware-infected executables to a mobile device to cause the mobile device to determine whether target applications including compressed code portions are infected with malware based at least in part on the search string.
4 more elements
A mobile device for detecting malware in compressed data, the mobile device comprising:
- a non-transitory memory configured to store a search string common to compressed code portions of a plurality of malware-infected executables, wherein each of the malware-infected executables is infected with a family of malware;
- and
- a hardware-based processor configured to:
- scan a compressed code portion of a target executable for the search string to detect whether the search string is present in the compressed code portion of the target executable, and
- determine that the target executable is infected with malware from the family of malware when the search string is detected in the compressed code portion of the target executable.
2 more elements
Dependencies are inferred from the claim text.