System and method for locating malware

• US 20060075500A1
• Filed: 10/01/2004
• Published: 04/06/2006
• Est. Priority Date: 10/01/2004
• Status: Active Grant

• Current Assignee: Carbonite LLC (Open Text Corporation)
• Original Assignee: Webroot Software Incorporated (Open Text Corporation)
• Inventors: Liston, Bryan M., Bertman, Justin R., Boney, Matthew L.
• Granted Patent: US 7,287,279 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/563 by source code analysis

Abstract

A system and method for managing malware is described. One embodiment is designed to receive an initial URL associated with a Web site; download content from that Web site; identify any obfuscation techniques used to hide malware or pointers to malware; interpret those obfuscation techniques; identify a new URL as a result of interpreting the obfuscation techniques; and add the new URL to a URL database.

Claims

1. A method for identify Web sites that may include malware, the method comprising:

receiving an initial URL associated with a Web site;

downloading content associated with the initial URL, the content including HTML, a script program, and code related to a button-click event that executes a function;

searching the HTML in the downloaded content for an embedded URL;

identifying a non-obfuscated URL in the script program;

identifying an obfuscated URL in the script program;

executing the function corresponding to the button-click event;

receiving a new URL as a result of executing the function;

adding the embedded URL, the non-obfuscated URL and the new URL to a URL database; and

adding a high-priority indicator to the URL database, the high-priority indicator corresponding to the obfuscated URL.

2. The method of claim 1, further comprising:

searching the HTML for a text string corresponding to malware.

3. The method of claim 1, further comprising:

searching the script program for a text string corresponding to malware.

4. The method of claim 1, further comprising:

identifying obfuscated text strings in the script program; and

interpreting the obfuscated text strings.

5. The method of claim 4, further comprising:

adding the initial URL to the URL database; and

responsive to identifying obfuscated text strings in the script program, adding a high-priority indicator to the URL database, the high-priority indicator corresponding to the initial URL.

6. A method for identify malware, the method comprising:

receiving an initial URL associated with a Web site;

downloading content associated with the initial URL, the content including a script program;

identifying obfuscation techniques in the script program;

interpreting the obfuscation techniques;

identifying a new URL as a result of interpreting the obfuscation techniques;

adding the new URL to a URL database; and

adding a high-priority indicator to the URL database, the high-priority indicator corresponding to the new URL and the high-priority indicator indicating that the new URL is likely to be associated with malware.

7. The method of claim 6, further comprising:

downloading additional content from a Web cite associated with the new URL; and

determining whether the additional content downloaded from the Web site associated with the new URL includes malware.

8. The method of claim 6, further comprising:

downloading additional content from the new URL;

identifying an additional embedded link in the additional content; and

adding the additional embedded link to the URL database.

9. A method for identify malware, the method comprising:

downloading content associated with an initial URL, the content including an object and an embedded URL;

extracting the embedded URL from the content;

adding the extracted URL to a URL database;

determine whether the object can be verified through text searching; and

responsive to the object not being verifiable through text searching, passing the object to an active browser.

10. The method of claim 9, wherein determining whether the object can be verified through text searching comprises:

determining whether the object includes obfuscated text.

11. The method of claim 9, wherein determining whether the object can be verified through text searching comprises:

determining whether the object includes a form that requires submittal to a remote computer.

12. The method of claim 9, wherein determining whether the object can be verified through text searching comprises:

determining whether the object includes a button click event that is configured to run a function.

13. A method for identify Web sites that may include malware, the method comprising:

receiving an initial URL associated with a Web site;

downloading content associated with the initial URL, the content including code related to a button-click event that executes a function;

searching the code for an embedded URL;

executing the function corresponding to the button-click event;

receiving a new URL as a result of executing the function;

adding the new URL to a URL database.