Providing a Network-Accessible Malware Analysis

• US 20130074185A1
• Filed: 09/15/2011
• Published: 03/21/2013
• Est. Priority Date: 09/15/2011
• Status: Active Grant

• Current Assignee: Forcepoint Federal Holdings LLC (Forcepoint LLC)
• Original Assignee: Raytheon Company (Rtx Corporation)
• Inventors: McDougal, Monty D., Ford, Bradley T., Sterns, William E.
• Granted Patent: US 9,003,532 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/561 Virus type analysis

Abstract

In certain embodiments, a computer-implemented method comprises receiving, via a computer network and from a first computer system, a first malware analysis request. The first malware analysis request comprises a file to be analyzed for malware by a malware analysis system. The method includes initiating a malware analysis by the malware analysis system of the first file for malware. The method includes communicating to the first computer system a response for the first file determined by the malware analysis system to the first computer system. The response comprises an indication of whether the first file comprises malware.

Claims

1. A computer-implemented method, comprising:

receiving, via a computer network and from a first computer system, a first malware analysis request, the first malware analysis request comprising a file to be analyzed for malware by a malware analysis system;

initiating a malware analysis by the malware analysis system of the first file for malware; and

communicating to the first computer system a response for the first file determined by the malware analysis system to the first computer system, the response comprising an indication of whether the first file comprises malware.

2. The computer-implemented method of claim 1, further comprising:

receiving, via the computer network and prior to receiving the first malware analysis request comprising the first file, a preliminary malware analysis request, the preliminary malware analysis request comprising file identification information for the first file;

determining that one or more of the following is true;

a malware analysis of the first file has not already been performed by the malware analysis system; and

a malware analysis of the first file currently is not being performed by the malware analysis system; and

notifying the first computer system to send the first file to the malware analysis system.

3. The computer-implemented method of claim 2, wherein the first malware analysis request is communicated by the first computer system in response to the notification for the first computer system to send the first file to the malware analysis system.

4. The computer-implemented method of claim 2, wherein the file identification information for the first file comprises a hash value computed by performing a hash of the first file.

5. The computer-implemented method of claim 1, further comprising:

receiving, via the computer network and from the first computer system, a second malware analysis request, the second malware analysis request comprising file identification information for a second file;

determining, using the file identification for the second file, that one or more of the following is true;

a malware analysis of the second file has already been performed by the malware analysis system; and

a malware analysis of the second file currently is being performed by the malware analysis system; and

notifying the first computer system not to send the second file to the malware analysis system.

6. The computer-implemented method of claim 1, wherein communicating the response for the first file comprising the indication of whether the first file comprises malware comprises communicating a message via the computer network to the first computer system, the message comprising a status.

7. The computer-implemented method of claim 1, further comprising:

receiving from the first computer system a callback request comprising an address for communicating with the first computer system; and

communicating to the first computer system the response for the first file comprising the indication of whether the first file comprises malware using the address for communicating with the first computer system.

8. The computer-implemented method of claim 1, further comprising:

receiving, via the computer network and subsequent to receiving the first malware analysis request comprising the first file, a second malware analysis request, the second malware analysis request being a status request and comprising file identification information for the first file; and

determining, in response to the second malware analysis request, whether the first file has been analyzed by the malware analysis system;

the communicating to the first computer system of the response for the first file being in response to a determination that the first file has been analyzed by the malware analysis system.

9. The computer-implemented method of claim 1, wherein initiating the malware analysis comprises communicating the first file to the malware analysis system for the malware analysis to be performed by the malware analysis system on the first file.

10. The computer-implemented method of claim 1, further comprising authenticating the first computer system prior to receiving the first malware analysis request.

11. A system, comprising:

one or more memory units; and

one or more processing units operable to;

receive, via a computer network and from a first computer system, a first malware analysis request, the first malware analysis request comprising a file to be analyzed for malware by a malware analysis system;

initiate a malware analysis by the malware analysis system of the first file for malware; and

communicate to the first computer system a response for the first file determined by the malware analysis system to the first computer system, the response comprising an indication of whether the first file comprises malware.

12. The system of claim 11, wherein the one or more processing units are further operable to:

receive, via the computer network and prior to receiving the first malware analysis request comprising the first file, a preliminary malware analysis request, the preliminary malware analysis request comprising file identification information for the first file;

determine that one or more of the following is true;

a malware analysis of the first file has not already been performed by the malware analysis system; and

a malware analysis of the first file currently is not being performed by the malware analysis system; and

notify the first computer system to send the first file to the malware analysis system.

13. The system of claim 12, wherein the first malware analysis request is communicated by the first computer system in response to the notification for the first computer system to send the first file to the malware analysis system.

14. The system of claim 12, wherein the file identification information for the first file comprises a hash value computed by performing a hash of the first file.

15. The system of claim 11, wherein the one or more processing units are further operable to:

receive, via the computer network and from the first computer system, a second malware analysis request, the second malware analysis request comprising file identification information for a second file;

determine, using the file identification for the second file, that one or more of the following is true;

a malware analysis of the second file has already been performed by the malware analysis system; and

a malware analysis of the second file currently is being performed by the malware analysis system; and

notify the first computer system not to send the second file to the malware analysis system.

16. The system method of claim 11, wherein communicating the response for the first file comprising the indication of whether the first file comprises malware comprises communicating a message via the computer network to the first computer system, the message comprising a status.

17. The system of claim 11, wherein the one or more processing units are further operable to:

receive from the first computer system a callback request comprising an address for communicating with the first computer system; and

communicate to the first computer system the response for the first file comprising the indication of whether the first file comprises malware using the address for communicating with the first computer system.

18. The system of claim 11, wherein the one or more processing units are further operable to:

receive, via the computer network and subsequent to receiving the first malware analysis request comprising the first file, a second malware analysis request, the second malware analysis request being a status request and comprising file identification information for the first file; and

determine, in response to the second malware analysis request, whether the first file has been analyzed by the malware analysis system;

the communicating to the first computer system of the response for the first file being in response to a determination that the first file has been analyzed by the malware analysis system.

19. The system of claim 11, wherein initiating the malware analysis comprises communicating the first file to the malware analysis system for the malware analysis to be performed by the malware analysis system on the first file.

20. The system of claim 11, wherein the one or more processing units are further operable to authenticate the first computer system prior to receiving the first malware analysis request.

21. Non-transitory computer-readable media comprising software, the software when executed by one or more processing units operable to perform operations comprising:

receiving, via a computer network and from a first computer system, a first malware analysis request, the first malware analysis request comprising a file to be analyzed for malware by a malware analysis system;

initiating a malware analysis by the malware analysis system of the first file for malware; and

communicating to the first computer system a response for the first file determined by the malware analysis system to the first computer system, the response comprising an indication of whether the first file comprises malwares.