Known files database for malware elimination

• US 8,528,089 B2
• Filed: 12/19/2006
• Issued: 09/03/2013
• Est. Priority Date: 12/19/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Gryaznov, Dmitry
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Ambaye, Samuel
• Application Number:
  US11/641,043
• Publication Number:
  US 20080147612A1
• Time in Patent Office: 2,450 Days
• Field of Search: 726/24, 713/165
• US Class Current: 726/24
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

A method, system, and computer program product for identifying files that are found during a malware scan, thus enabling them to be excluded from further analysis. A method for handling a potential malware file comprises the steps of scanning a plurality of files to identify at least one file as potential malware, querying a database to determine whether the at least one file is known, and handling the at least one file based on whether the at least one file is known.

Claims

1. A method, comprising:

scanning a plurality of files to identify at least one file as potential malware;

generating information identifying the at least one file, wherein the generated information comprises a secure hash of the at least one file that is generated using a cryptographic hash function;

querying a database to determine whether the at least one scanned file identified as potential malware is already known to be free from potential malware or known to be representative of malware, wherein the secure hash is evaluated in order to determine its status as being legitimate or representative of malware, wherein the database includes at least one entry representing a file known to legitimate and at least one entry representing a file known to be representative of malware, wherein each entry of the database represents either a file known to be legitimate or a file known to be representative of malware, and wherein each entry further includes information indicating whether the representation of the file is legitimate or representative of malware;

excluding the at least one file from further analysis if the at least one file is known; and

performing further analysis on the at least one file if the at least one file is not known.

2. The method of claim 1, wherein the querying step comprises the steps of:

querying the database to obtain information indicating whether the at least one file is known.

3. The method of claim 2, wherein the step of querying the database to obtain information indicating whether the at least one file is known comprises the steps of:

transmitting a query including the generated information identifying the at least one file to a remote database; and

receiving from the remote database the information indicating whether the at least one file is known.

4. The method of claim 1, wherein the at least one cryptographic hash function comprises at least one of MD5, MD4, SHA1, SHA256, and CRC32.

5. The method of claim 2, wherein the step of querying the database to obtain information indicating whether at least one file is known comprises the step of:

querying a local database to obtain the information indicating whether the at least one file is known.

6. A system comprising:

a processor operable to execute computer program instructions;

a memory coupled to the processor and operable to store computer program instructions executable by the processor such that the system is configured for;

scanning a plurality of files to identify at least one file as potential malware;

generating information identifying the at least one file, wherein the generated information comprises a secure hash of the at least one file that is generated using a cryptographic hash function;

querying a database to determine whether the at least one scanned file identified as potential malware is already known to be free from potential malware or known to be representative of malware, wherein the secure hash is evaluated in order to determine its status as being legitimate or representative of malware, wherein the database includes at least one entry representing a file known to legitimate and at least one entry representing a file known to be representative of malware, wherein each entry of the database represents either a file known to be legitimate or a file known to be representative of malware, and wherein each entry further includes information indicating whether the representation of the file is legitimate or representative of malware;

excluding the at least one file from further analysis if the at least one file is known; and

performing further analysis on the at least one file if the at least one file is not known.

7. The system of claim 6, wherein the querying step comprises the steps of:

querying the database to obtain information indicating whether the at least one file is known.

8. The system of claim 7, wherein the step of querying the database to obtain information indicating whether the at least one file is known comprises the steps of:

transmitting a query including the generated information identifying the at least one file to a remote database; and

receiving from the remote database the information indicating whether the at least one file is known.

9. The system of claim 6, wherein the at least one cryptographic hash function comprises at least one of MD5, MD4, SHA1, SHA256, and CRC32.

10. The system of claim 7, wherein the step of querying the database to obtain information indicating whether the at least one file is known comprises the step of:

querying a local database to obtain the information indicating whether the at least one file is known.

11. A computer program product comprising:

a non-transitory computer readable storage medium;

computer program instructions, recorded on the computer readable storage medium, executable by a processor, for performing;

scanning a plurality of files to identify at least one file as potential malware;

generating information identifying the at least one file, wherein the generated information comprises a secure hash of the at least one file that is generated using a cryptographic hash function;

querying a database to determine whether the at least one scanned file identified as potential malware is already known to be free from potential malware or known to be representative of malware, wherein the secure hash is evaluated in order to determine its status as being legitimate or representative of malware, wherein the database includes at least one entry representing a file known to legitimate and at least one entry representing a file known to be representative of malware, wherein each entry of the database represents either a file known to be legitimate or a file known to be representative of malware, and wherein each entry further includes information indicating whether the representation of the file is legitimate or representative of malware;

excluding the at least one file from further analysis if the at least one file is known; and

performing further analysis on the at least one file if the at least one file is not known.

12. The computer program product of claim 11, wherein the querying step comprises the steps of:

querying the database to obtain information indicating whether the at least one file is known.

13. The computer program product of claim 12, wherein the step of querying the database to obtain information indicating whether the at least one file is known comprises the steps of:

transmitting a query including the generated information identifying the at least one file to a remote database; and

receiving from the remote database the information indicating whether the at least one file is known.

14. The computer program product of claim 11, wherein the at least one cryptographic hash function comprises at least one of MD5, MD4, SHA1, SHA256, and CRC32.

15. The computer program product of claim 12, wherein the step of querying the database to obtain information indicating whether the at least one file is known comprises the step of:

querying a local database to obtain the information indicating whether the at least one file is known.