METHOD AND SYSTEM FOR AUTOMATICALLY GENERATING VIRUS DESCRIPTIONS

• US 20130167236A1
• Filed: 11/30/2012
• Published: 06/27/2013
• Est. Priority Date: 12/15/2011
• Status: Abandoned Application

• Current Assignee: Avira Holding GmbH
• Original Assignee: Avira Holding GmbH
• Inventors: SICK, THORSTEN
• Application Number:
  US13/691,147
• Publication Number:
  US 20130167236A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

Systems and methods for automatically generating information describing malware are disclosed. In accordance with certain embodiments, a client computer may be provided with an antivirus program capable of finding malware and a server for receiving malware information sent from the antivirus program via a network. In accordance with one embodiment, the antivirus program may checked the client computer for malware and, in the event that malware is found, the antivirus program may acquire information about the malware such as the type of malware, the form of identification of the malware, whether the malware has already been executed, and/or whether it has been possible to remove the malware. This malware information may be transmitted from the client computer to the server in an automatic, structured manner. When received by the server, the malware information may be fed into a database on the server and subsequently displayed, for example, in an automatic, structured manner on a web page or via an interface of the antivirus program.

Claims

1. A method, comprising:

receiving via a network a message containing information describing one or more aspects of a malware detected on a remote computer by an antivirus program;

storing the received information about the malware in an entry in a database that is associated with the malware;

retrieving information about the malware from the database;

generating a description page describing the malware using the retrieved information and a template; and

sending the description page via the network to the remote computer for display at the remote computer.

2. The method of claim 1, wherein the antivirus program runs on the remote computer.

3. The method of claim 1, wherein the antivirus program is located at a location remote from the remote computer and analyzes the malware on the remote computer via the network.

4. The method of claim 1, wherein the malware is detected at the remote computer by the antivirus program through an analysis of a suspected malware before it is executed, an analysis of the malware upon execution on the client computer, and an analysis after the malware has infected the client computer.

5. The method of claim 1, wherein the malware is detected at the remote computer by the antivirus program through an analysis of the malware.

6. The method of claim 5, wherein the analysis by the antivirus program includes determining whether the suspected malware is associated with a blacklisted uniform resource locator.

7. The method of claim 5, wherein the analysis by the antivirus program includes a static file analysis of the malware.

8. The method of claim 5, wherein the analysis by the antivirus program includes a behavior analysis of the malware.

9. The method of claim 5, wherein the analysis by the antivirus program includes identifying and analyzing communications over the network occurring when the malware is executing.

10. The method of claim 5, wherein the analysis by the antivirus program includes cleaning the client computer to remove or isolate the malware.

11. The method of claim 1, wherein the antivirus program collects information about the malware, and the message containing information describing one or more aspects of the malware is generated from the collected information.

12. The method of claim 1, wherein the information contained in the message is in a structured, extensible format.

13. The method of claim 1, wherein the antivirus program queries a user of the client computer to authorize the information contained in the message.

14. The method of claim 1, wherein the antivirus program queries a user of the client computer to authorize sending the message.

15. The method of claim 1, further comprising confirming that the message is a valid message from the remote computer.

16. The method of claim 1, wherein the information about the malware stored in the database includes information from an antivirus expert describing the malware.

17. The method of claim 1, wherein the information about the malware stored in the database including information contained the message that has been approved by an antivirus expert.

18. The method of claim 1, the information about the malware stored in the database including information concerning multiple instances of the malware.

19. The method of claim 1, further comprising generating one or more reports containing information about the database and sending the report to an antivirus expert.

20. The method of claim 19, wherein the report is generated when an anomaly in the information about the malware is detected in the database.

21. The method of claim 19, wherein the report provides statistics relating to malware.

22. The method of claim 1, wherein the database includes a description database managed by an antivirus expert.

23. The method of claim 1, wherein the generated description page is in a structured, extensible format.

24. The method of claim 1, wherein the generated description page is in a JSON format.

25. The method of claim 1, wherein the generated description page is in a XML format.

26. The method of claim 1, wherein the description page is displayed at the remote computer using a browser.

27. A system, comprising:

a server having a component coupled to a network to permit the receiving, via the network, a message containing information describing one or more aspects of a malware detected on a remote computer by an antivirus program;

the server being capable of storing the received information about the malware in an entry in a database that is associated with the malware;

the server being capable of retrieving information about the malware from the database;

the server being capable of generating a description page describing the malware using the retrieved information and a template; and

the server having a communication interface being capable of sending the description page via the network to the remote computer for display at the remote computer.

28. A computer program product embodied on a computer readable storage medium for causing a computer to perform a method, comprising:

receiving via a network a message containing information describing one or more aspects of a malware detected on a remote computer by an antivirus program;

storing the received information about the malware in an entry in a database that is associated with the malware;

retrieving information about the malware from the database;

generating a description page describing the malware using the retrieved information and a template; and

sending the description page via the network to the remote computer for display at the remote computer.