File analysis

• US 20040236884A1
• Filed: 06/03/2004
• Published: 11/25/2004
• Est. Priority Date: 07/28/2000
• Status: Abandoned Application

• Current Assignee: Clearswift Limited (Government of Switzerland)
• Original Assignee: Clearswift Limited (Government of Switzerland)
• Inventors: Beetz, Andreas
• Application Number:
  US10/343,048
• Publication Number:
  US 20040236884A1
• Time in Patent Office: Days
• US Class Current: 710/68
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of analysing the properties of an electronic file, especially to detect a packed executable file. A neural network is used to determine if a given file is a packed executable from analysis of byte distributions within the file without unpacking the fiel from its compressed form.

Claims

1. A method for determining the properties of an electronic file, said method comprising:

analysing byte distributions of the file contents; and

determining properties of the electronic file with respect to the analysis.

2. A method as claimed in claim 1, in which the analysing of byte distributions comprises a determining step in which the frequency of occurrence of the byte distributions of the file contents is determined.

3. A method as claimed in claims 1 or 2, in which the step of determining properties of the electronic file includes use of a neural network.

4. A method as claimed in claim 3, in which the neural network has been trained on sample packed executable files.

5. A method as claimed in claims 1-4, in which the step of determining is able to recognize compressed files.

6. A method as claimed in any preceding claim, in which, if the file is determined to be compressed, it is not unpacked from its compressed form.

7. A software product for determining the properties of an electronic file, said software containing code for:

analysing byte distributions of the file contents; and

determining properties of the electronic file with respect to the analysis.

8. A software product as claimed in claim 7, in which the analysing of byte distributions comprises a determining step in which the frequency of occurrence of the byte distributions of the file contents is determined.

9. A software product as claimed in claims 7 or 8, in which the step of determining properties of the electronic file includes use of a neural network.

10. A software product as claimed in claim 9, in which the neural network has been trained on sample packed executable files.

11. A software product as claimed in any of claims 7-10, in which the step of determining is able to recognize compressed files.

12. A software product as claimed in any of claims 7-11, in which the file if containing compressed data is not unpacked from its compressed form.

13. A software product as claimed in claim 9, wherein the neural network can be further trained on additional sample files.

14. A computer system capable of determining the properties of an electronic file, the computer system being enabled to:

analyse byte distributions of the file contents.

determine the file properties from the analysis.

15. A computer system as claimed in claim 14, in which the analysing of byte distributions comprises a determining step in which the frequency of occurrence of the byte distributions of the file contents is determined.

16. A computer system as claimed in claims 14 or 15, in which the step of determining properties of the electronic file includes use of a neural network.

17. A computer system as claimed in claim 16, in which neural network has been trained on sample packed executable files.

18. A computer system as claimed in claims 14-17, in which the step of determining is able to recognize compressed files.

19. A computer system as claimed in any of claims 14-18, in which the file if containing compressed data is not unpacked from its compressed form.

20. A computer system as claimed in claim 16, wherein the neural netwok can be further trained on additional sample files.