US 9,852,291 B2 · Computer system and signature verification server

Abstract

Disclosed are a computer system, a signature verification server, a method of supporting signature verification by a computer system, and a method of verifying signature. Embodiments of the present disclosure relates to a technology of misdiagnosis verification of signature used for a malicious code diagnosis, and more particularly to technologies which derive a result of performance of a malicious code diagnosis simulation on signature in a multi-user computer environment to use an actual client antivirus software and thus can overcome physical, spatial, and temporal limitations of conventional signature misdiagnosis verification by pre-distributing preliminary application signature in a state where misdiagnosis verification has not been completed to a plurality of user computers to reflect the preliminary application signature to a malicious code diagnosis on files stored in the plurality of user computers and performing misdiagnosis verification on the preliminary application signature based on information collected in connection with a result of the diagnosis.

Claims23

Dependent claims

A computer system connected to a signature verification server and configured to execute client antivirus software and perform a malicious code diagnosis without a completed signature verification on one or more files stored in the computer system, the signature verification server being configured to carry out a misdiagnosis verification and provide a verification result to the computer system, the computer system comprising:

a file storage unit configured to store the one or more files;
a malicious code diagnosis performer configured to perform the malicious code diagnosis on the one or more files by using a preliminary application signature in a state where misdiagnosis verification has not been completed;
and a verification related information provider configured to, when a particular file is diagnosed as a malicious code as a result of the malicious code diagnosis using the preliminary application signature, provide verification related information required for the misdiagnosis verification based on a diagnosed result to the signature verification server, wherein the verification related information includes at least one of information on places with which a diagnosis user corresponding to the computer system is associated and diagnosis time information, and wherein a verification performer of the signature verification server determines the malicious code diagnosis by the preliminary application signature as a misdiagnosis when at least one of a first condition in which a collected number of diagnoses of the particular file by the preliminary application signature is equal to or larger than a particular number, a second condition in which the malicious code has not been detected from the particular file for a particular reference time or longer, and a third condition in which the particular file exists in the computer system for a particular existence period or longer is satisfied based on the verification related information provided by the verification related information provider.

A signature verification server connected to one or more computer systems, each of the one or more computer systems configured to execute client antivirus software, the client antivirus software using the signature verification server to respectively perform misdiagnosis verification on one or more files stored in the one or more computer systems, comprising:

a verification related information collector configured to collect, from the one or more computer systems, verification related information according to a diagnosis result of a particular file diagnosed as malicious code in accordance with a preliminary application signature in a state where misdiagnosis verification has not been completed;
a verification performer configured to perform the misdiagnosis verification on the preliminary application signature based on the collected verification related information;
and a verification result provider configured to provide a verification result of the misdiagnosis verification to the one or more computer systems having the preliminary application signature, wherein the verification related information includes at least one of information on places with which a diagnosis user corresponding to the computer system is associated and diagnosis time information, and wherein the verification performer determines the malicious code diagnosis by the preliminary application signature as a misdiagnosis when at least one of a first condition in which a collected number of diagnoses of the particular file by the preliminary application signature is equal to or larger than a particular number, a second condition in which the malicious code has not been detected from the particular file for a particular reference time or longer, and a third condition in which the particular file exists in the computer system for a particular existence period or longer is satisfied based on the verification related information collected from the one or more computer systems.

A method of supporting signature verification by a computer system connected to a signature verification server and configured to execute client antivirus software and perform a malicious code diagnosis without a completed signature verification on one or more files stored in the computer system, the signature verification server being configured to carry out a misdiagnosis verification and provide a verification result to the computer system, the method comprising:

storing the one or more files in a storage unit of the computer system;
performing the malicious code diagnosis on the one or more files by using a preliminary application signature in a state where misdiagnosis verification has not been completed;
and when a particular file is diagnosed as a malicious code as a result of the malicious code diagnosis using the preliminary application signature, providing verification related information required for the misdiagnosis verification based on a diagnosed result to the signature verification server, wherein the verification related information includes at least one of information on places with which a diagnosis user corresponding to the computer system is associated and diagnosis time information, and wherein the performing of the misdiagnosis verification by the signature verification server comprises determining the malicious code diagnosis by the preliminary application signature as a misdiagnosis when at least one of a first condition in which a collected number of diagnoses of the particular file by the preliminary application signature is equal to or larger than a particular number, a second condition in which the malicious code has not been detected from the particular file for a particular reference time or longer, and a third condition in which the particular file exists in the computer system for a particular existence period or longer is satisfied based on the verification related information.

A method of verifying signature by a signature verification server, the method comprising:

collecting, from one or more computer systems, verification related information according to a diagnosis result of a particular file diagnosed as malicious code according to preliminary application signature in a state where misdiagnosis verification has not been completed;
performing the misdiagnosis verification on the preliminary application signature based on the collected verification related information;
and providing a verification result of the misdiagnosis verification to the one or more computer systems having the preliminary application signature, wherein the verification related information includes at least one of information on places with which a diagnosis user corresponding to the computer system is associated and diagnosis time information, and wherein the performing of the misdiagnosis verification comprises determining the malicious code diagnosis by the preliminary application signature as a misdiagnosis when at least one of a first condition in which a collected number of diagnoses of the particular file by the preliminary application signature is equal to or larger than a particular number, a second condition in which the malicious code has not been detected from the particular file for a particular reference time or longer, and a third condition in which the particular file exists in the computer system for a particular existence period or longer is satisfied based on the verification related information collected from the one or more computer systems.

A non-transitory computer-readable recording medium recording a program including instructions for performing, by a computer system connected to a signature verification server and configured to execute client antivirus software and perform a malicious code diagnosis without a completed signature verification on one or more files stored in the computer system, the signature verification server being configured to carry out a misdiagnosis verification and provide a verification result to the computer system, the steps of:

storing the one or more files in a storage unit of the computer system;
performing the malicious code diagnosis on the one or more files by using a preliminary application signature in a state where misdiagnosis verification has not been completed;
and when a particular file is diagnosed as a malicious code as a result of the malicious code diagnosis using the preliminary application signature, providing verification related information required for the misdiagnosis verification based on a diagnosed result to the signature verification server, wherein the verification related information includes at least one of information on places with which a diagnosis user corresponding to the computer system is associated and diagnosis time information, and wherein the performing of the misdiagnosis verification by the signature verification server comprises determining the malicious code diagnosis by the preliminary application signature as a misdiagnosis when at least one of a first condition in which a collected number of diagnoses of the particular file by the preliminary application signature is equal to or larger than a particular number, a second condition in which the malicious code has not been detected from the particular file for a particular reference time or longer, and a third condition in which the particular file exists in the computer system for a particular existence period or longer is satisfied based on the verification related information.

collecting, from one or more computer systems, verification related information according to a diagnosis result of a particular file diagnosed as malicious code according to preliminary application signature in a state where misdiagnosis verification has not been completed;
performing the misdiagnosis verification on the preliminary application signature based on the collected verification related information;
and providing a verification result of the misdiagnosis verification to the one or more computer systems having the preliminary application signature, wherein the verification related information includes at least one of information on places with which a diagnosis user corresponding to the computer system is associated and diagnosis time information, and wherein the performing of the misdiagnosis verification comprises determining the malicious diagnosis by the preliminary application signature as a misdiagnosis when at least one of a first condition in which a collected number of diagnoses of the particular file by the preliminary application signature is equal to or larger than a particular number, a second condition in which the malicious code has not been detected from the particular file for a particular reference time or longer, and a third condition in which the particular file exists in the computer system for a particular existence period or longer is satisfied based on the verification related information collected from the one or more computer systems.

Dependencies are inferred from the claim text.

Computer system and signature verification server

Life of this patent

Computer system and signature verification server

Life of this patent

Abstract

Claims23