Malware scanning of compressed computer files

• US 7,107,617 B2
• Filed: 10/15/2001
• Issued: 09/12/2006
• Est. Priority Date: 10/15/2001
• Status: Active Grant

• Current Assignee: Fence Works Incorporated, McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Hursey, Nell John, McEwan, William Alexander
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US09/975,986
• Publication Number:
  US 20030074573A1
• Time in Patent Office: 1,793 Days
• Field of Search: 713200-201, 713/177, 713/181, 713187-188, 709223-225, 709/229, 726 22- 26
• US Class Current: 726/22
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

A malware scanner (8) operates to scan compressed computer files (16) by compressing the malware signatures (17) using the same compression algorithm as used for the compressed computer file and then comparing the compressed malware signatures (18) with the compressed computer file directly.

Claims

1. A computer program product embodied on a computer readable medium for controlling a computer to scan a compressed computer file for malware, said compressed computer file being compressed using a compression algorithm, said computer program product comprising:

comparison code operable to compare a plurality of compressed malware signatures compressed using said compression algorithm with said compressed computer file to identify malware within said compressed computer file;

detection code operable to detect from a compressed computer file to be scanned what compression algorithm has been used to compress said compressed computer file; and

compression code operable to compress a plurality of uncompressed malware signatures using said detected compression algorithm to generate said plurality of compressed malware signatures.

2. A computer program product as claimed in claim 1, wherein said detection code reads compression algorithm specifying data from said compressed computer file.

3. A computer program product as claimed in claim 2, wherein said compression algorithm uses Huffman coding and said compression algorithm specifying data includes a Huffman coding table used to compressed said compressed computer file.

4. A computer program product as claimed in claim 1, wherein said comparison code uses a Boyer Moore algorithm or an algorithm based upon structuring the signatures in a tree.

5. A computer program product as claimed in claim 1, wherein said malware includes at least one of computer viruses, Trojans, worms, banned files and e-mails containing banned content.

6. A method of scanning a compressed computer file for malware, said compressed computer file being compressed using a compression algorithm, said method comprising the step of:

comparing a plurality of compressed malware signatures compressed using said compression algorithm with said compressed computer file to identify malware within said compressed computer file;

detecting from a compressed computer file to be scanned what compression algorithm has been used to compress said compressed computer file; and

compressing a plurality of uncompressed malware signatures using said detected compression algorithm to generate said plurality of compressed malware signatures.

7. A method as claimed in claim 6, wherein said step of detecting reads compression algorithm specifying data from said compressed computer file.

8. A method as claimed in claim 7, wherein said compression algorithm uses Huffman coding and said compression algorithm specifying data includes a Huffman coding table used to compressed said compressed computer file.

9. A method as claimed in claim 6, wherein said step of comparing uses a Boyer Moore algorithm or an algorithm based upon structuring the signatures in a tree.

10. A method as claimed in claim 6, wherein said malware includes at least one of computer viruses, Trojans, worms, banned files and e-mails containing banned content.

11. Apparatus for scanning a compressed computer file for malware, said compressed computer file being compressed using a compression algorithm, said apparatus comprising:

comparison logic operable to compare a plurality of compressed malware signatures compressed using said compression algorithm with said compressed computer file to identify malware within said compressed computer file;

detection logic operable to detect from a compressed computer file to be scanned what compression algorithm has been used to compress said compressed computer file; and

compression logic operable to compress a plurality of uncompressed malware signatures using said detected compression algorithm to generate said plurality of compressed malware signatures.

12. Apparatus as claimed in claim 11, wherein said detection logic reads compression algorithm specifying data from said compressed computer file.

13. Apparatus as claimed in claim 12, wherein said compression algorithm uses Huffman coding and said compression algorithm specifying data includes a Huffman coding table used to compressed said compressed computer file.

14. Apparatus as claimed in claim 11, wherein said comparison code uses a Bayer Moore algorithm or an algorithm based upon structuring the signatures in a tree.

15. Apparatus as claimed in claim 11, wherein said malware includes at least one of computer viruses, Trojans, worms, banned flies and e-mails containing banned content.