Known files database for malware elimination
First Claim
Patent Images
1. A method, comprising:
- scanning a plurality of files to identify at least one file as potential malware;
generating information identifying the at least one file, wherein the generated information comprises a secure hash of the at least one file that is generated using a cryptographic hash function;
querying a database to determine whether the at least one scanned file identified as potential malware is already known to be free from potential malware or known to be representative of malware, wherein the secure hash is evaluated in order to determine its status as being legitimate or representative of malware, wherein the database includes at least one entry representing a file known to legitimate and at least one entry representing a file known to be representative of malware, wherein each entry of the database represents either a file known to be legitimate or a file known to be representative of malware, and wherein each entry further includes information indicating whether the representation of the file is legitimate or representative of malware;
excluding the at least one file from further analysis if the at least one file is known; and
performing further analysis on the at least one file if the at least one file is not known.
10 Assignments
0 Petitions
Accused Products
Abstract
A method, system, and computer program product for identifying files that are found during a malware scan, thus enabling them to be excluded from further analysis. A method for handling a potential malware file comprises the steps of scanning a plurality of files to identify at least one file as potential malware, querying a database to determine whether the at least one file is known, and handling the at least one file based on whether the at least one file is known.
-
Citations
15 Claims
-
1. A method, comprising:
-
scanning a plurality of files to identify at least one file as potential malware; generating information identifying the at least one file, wherein the generated information comprises a secure hash of the at least one file that is generated using a cryptographic hash function; querying a database to determine whether the at least one scanned file identified as potential malware is already known to be free from potential malware or known to be representative of malware, wherein the secure hash is evaluated in order to determine its status as being legitimate or representative of malware, wherein the database includes at least one entry representing a file known to legitimate and at least one entry representing a file known to be representative of malware, wherein each entry of the database represents either a file known to be legitimate or a file known to be representative of malware, and wherein each entry further includes information indicating whether the representation of the file is legitimate or representative of malware; excluding the at least one file from further analysis if the at least one file is known; and performing further analysis on the at least one file if the at least one file is not known. - View Dependent Claims (2, 3, 4, 5)
-
-
6. A system comprising:
-
a processor operable to execute computer program instructions; a memory coupled to the processor and operable to store computer program instructions executable by the processor such that the system is configured for; scanning a plurality of files to identify at least one file as potential malware; generating information identifying the at least one file, wherein the generated information comprises a secure hash of the at least one file that is generated using a cryptographic hash function; querying a database to determine whether the at least one scanned file identified as potential malware is already known to be free from potential malware or known to be representative of malware, wherein the secure hash is evaluated in order to determine its status as being legitimate or representative of malware, wherein the database includes at least one entry representing a file known to legitimate and at least one entry representing a file known to be representative of malware, wherein each entry of the database represents either a file known to be legitimate or a file known to be representative of malware, and wherein each entry further includes information indicating whether the representation of the file is legitimate or representative of malware; excluding the at least one file from further analysis if the at least one file is known; and performing further analysis on the at least one file if the at least one file is not known. - View Dependent Claims (7, 8, 9, 10)
-
-
11. A computer program product comprising:
-
a non-transitory computer readable storage medium; computer program instructions, recorded on the computer readable storage medium, executable by a processor, for performing; scanning a plurality of files to identify at least one file as potential malware; generating information identifying the at least one file, wherein the generated information comprises a secure hash of the at least one file that is generated using a cryptographic hash function; querying a database to determine whether the at least one scanned file identified as potential malware is already known to be free from potential malware or known to be representative of malware, wherein the secure hash is evaluated in order to determine its status as being legitimate or representative of malware, wherein the database includes at least one entry representing a file known to legitimate and at least one entry representing a file known to be representative of malware, wherein each entry of the database represents either a file known to be legitimate or a file known to be representative of malware, and wherein each entry further includes information indicating whether the representation of the file is legitimate or representative of malware; excluding the at least one file from further analysis if the at least one file is known; and performing further analysis on the at least one file if the at least one file is not known. - View Dependent Claims (12, 13, 14, 15)
-
Specification