Dynamic Cleaning for Malware Using Cloud Technology

• US 20130061325A1
• Filed: 09/07/2011
• Published: 03/07/2013
• Est. Priority Date: 09/07/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Singh, Prabhat Kumar, Prashanth, Palasamudram Ramagopal, Jyoti, Nitin
• Granted Patent: US 8,677,493 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method for providing malware cleaning includes detecting potential malware on a first device connected to a network. A request including information to allow a second device connected to the network to determine an appropriate cleaning response is sent from the first device to the second device over the network. Upon receiving the request, the second device attempts to identify an appropriate cleaning response and, if a response is identified, sends the cleaning response over the network to the first device. The cleaning response is usable by the first device to address the detected potential malware.

Claims

1. A method for providing malware cleaning, comprising:

detecting, utilizing a processor, potential malware on a first device connected to a network;

sending over the network, utilizing the processor, a request from the first device to a second device, the request including information to allow the second device to determine a cleaning response; and

receiving over the network, utilizing the processor, the cleaning response from the second device at the first device, the cleaning response usable by the first device to remove the detected potential malware.

2. The method of claim 1, further comprising the act of determining, utilizing the processor, that no appropriate cleaning procedures corresponding to the detected potential malware exist on the first device prior to sending the request from the first device to the second device.

3. The method of claim 2, wherein the act of determining that no appropriate cleaning procedures corresponding to the detected potential malware exist on the first device comprises:

determining that existing cleaning procedures are unacceptable.

4. The method of claim 1, wherein the cleaning response comprises instructions to execute cleaning routines stored on the first device.

5. The method of claim 1, wherein the cleaning response comprises cleaning routines to be executed by the first device.

6. The method of claim 1, wherein the cleaning response comprises a first set of cleaning routines to be executed by the first device and instructions to execute a second set of cleaning routines stored on the first device.

7. The method of claim 1, wherein the act of detecting potential malware on the first device includes performing a heuristic based analysis of a file of the first device.

8. The method of claim 1, wherein the request is a domain name system query.

9. The method of claim 1, wherein the information to allow the second device to determine the appropriate cleaning response is encrypted.

10. The method of claim 1, wherein the information to allow the second device to determine the appropriate cleaning response includes a hash of a file representing the potential malware.

11. The method of claim 1, wherein the request includes authentication information.

12. The method of claim 1, wherein the cleaning response comprises instructions for the first device to request a third device connected to the network to provide a further cleaning response.

13. The method of claim 12, further comprising receiving the further cleaning response from the third device at the first device over the network, the further cleaning response usable by the first device to remove the detected malware.

21. A computer program product stored on a non-transitory computer-readable medium, comprising:

computer code for performing the method of claim 1.

14. A system, comprising:

a client, comprising;

a storage device, and

a processor operatively coupled to the storage device, the processor adapted to execute program code stored in the storage device to detect potential malware and send a request containing information pertaining to the detected potential malware over a network; and

a server, comprising;

a storage device, and

a processor operatively coupled to the storage device, the processor adapted to execute program code stored in the storage device to receive the request from the client over the network, determine a cleaning response, and send the cleaning response to the client over the network, the cleaning response usable by the client to remove the detected potential malware.

15. The system of claim 14, wherein the request is a domain name system query.

16. The system of claim 14, wherein the act of determining the cleaning response comprises searching a data store of the server for information corresponding to the detected potential malware.

17. The system of claim 14, wherein the cleaning response includes instructions to execute cleaning routines stored on the client.

18. The system of claim 14, wherein the cleaning response is encrypted.

19. A method for providing malware cleaning, comprising:

receiving, utilizing a processor, a malware cleaning request from a first device over a network at a second device;

identifying, utilizing the processor, a malware definition portion of the malware cleaning request;

searching, utilizing the processor, a data store of the second device for information corresponding to the identified malware definition portion;

sending, utilizing the processor, a cleaning response from the second device to the first device over the network, the cleaning response determined from the information.

20. The method of claim 19, wherein the act of identifying a malware definition portion of the malware cleaning request comprises parsing the malware cleaning request.