Systems and Methods for Malware Detection and Scanning

• US 20120174225A1
• Filed: 12/30/2010
• Published: 07/05/2012
• Est. Priority Date: 12/30/2010
• Status: Active Grant

• Current Assignee: VeriSign, Inc.
• Original Assignee: VeriSign, Inc.
• Inventors: Shyamsunder, Karthik, Tonn, Trevor, Thomas, Ralph, Sunkara, Srinivas, Holmes, Alexander, Krahulec, James
• Granted Patent: US 10,395,031 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Systems and methods are provided for malware scanning and detection. In one exemplary embodiment, the method includes a hub computing device that receives, from a controller computing device, a scan request, and identifies spoke computing devices for performing the scan request. The method performed by the hub computing device also includes sending to the identified spoke computing devices, the scan request, receiving, from the spoke computing devices, results associated with the scan request, and sending, to the controller computing device, the results associated with the scan request.

Claims

1. A computer-implemented method operating in a hub computing device for malware scanning and detection, the method comprising:

receiving, from a controller computing device, a scan request;

identifying, by the hub computing device, one or more spoke computing devices for performing the scan request;

sending, by the hub computing device to the identified spoke computing devices, the scan request;

receiving, from the spoke computing devices, results associated with the scan request; and

sending, to the controller computing device, the results associated with the scan request.

2. The computer-implemented method of claim 1, comprises:

sending, to the controller computing device, an acknowledgement message after receiving the scan request.

3. The computer-implemented method of claim 1, comprises:

sending, to the spoke computing devices, an acknowledgement message after receiving the results associated with the scan request.

4. The computer-implemented method of claim 1, wherein identifying the spoke computing devices for performing the scan request comprises:

identifying the spoke computing devices for performing the scan request based on a workload determination.

5. The computer-implemented method of claim 1, wherein the scan request includes a target universal resource locator (URL).

6. The computer-implemented method of claim 1, wherein the scan request is a malware scan request.

7. A hub computing apparatus for malware scanning and detection, the apparatus comprising:

at least one memory to store data and instructions; and

at least one processor configured to access memory and to execute instructions to;

receive, from a controller computing device, a scan request;

identify spoke computing devices for performing the scan request;

send, to the identified spoke computing devices, the scan request;

receive, from the spoke computing devices, results associated with the scan request; and

send, to the controller computing device, the results associated with the scan request.

8. The hub computing apparatus of claim 7, wherein the at least one processor is configured to:

send, to the controller computing device, an acknowledgement message after receiving the scan request.

9. The hub computing apparatus of claim 7, wherein the at least one processor is configured to:

send, to the spoke computing devices, an acknowledgement message after receiving the results associated with the scan request.

10. The hub computing apparatus of claim 7, wherein when the at least one processor is configured to identify the spoke computing devices for performing the scan request, the processor is further configured to:

identify the spoke computing devices for performing the scan request based on a workload determination.

11. The hub computing apparatus of claim 7, wherein the scan request includes a target universal resource locator (URL).

12. The hub computing apparatus of claim 7, wherein the scan request is a malware scan request.

13. A computer-implemented method operating in a spoke computing device for malware scanning and detection, the method comprising:

receiving, from a hub computing device, a scan request;

performing, by the spoke computing device, analysis according to the received scan request;

storing, in a database of the spoke computing device, results of the analysis; and

sending, to the hub computing device, the results of the analysis.

14. The computer-implemented method of claim 13, further including:

launching, via a virtual machine operating in the spoke computing device, a browser; and

navigating, via the browser, to a website identified by a universal resource locator (URL).

15. The computer-implemented method of claim 14, further including:

performing, via the virtual machine, the analysis according to the received scan request.

16. The computer-implemented method of claim 13, wherein the scan request includes a target universal resource locator (URL).

17. The computer-implemented method of claim 16, wherein performing the analysis according to the received scan request includes:

performing malware analysis of a website identified by the target URL included in the scan request.

18. The computer-implemented method of claim 13, wherein the scan request is a malware scan request.

19. A spoke computing apparatus for malware scanning and detection, the apparatus comprising:

at least one memory to store data and instructions; and

at least one processor configured to access memory and, when executing the instructions, to;

receive, from a hub computing device, a scan request;

perform analysis according to the received scan request;

store, in a database of the spoke computing apparatus, results of the analysis;

and

send, to the hub computing device, the results of the analysis.

20. The spoke computing apparatus of claim 19, wherein the at least one processor is configured to:

launch, via a virtual machine operating in the spoke computing apparatus, a browser; and

navigate, via the browser, to a website identified by a universal resource locator (URL).

21. The spoke computing apparatus of claim 20, wherein the at least one processor is configured to:

perform, via the virtual machine, the analysis according to the received scan request.

22. The spoke computing apparatus of claim 19, wherein the scan request includes a target universal resource locator (URL).

23. The spoke computing apparatus of claim 22, wherein when the at least one processor is configured to performing the analysis according to the received scan request, the at least one processor is configured to:

perform malware analysis of a website associated with the target URL included in the scan request.

24. The spoke computing apparatus of claim 19, wherein the scan request is a malware scan request.