RESISTING THE SPREAD OF UNWANTED CODE AND DATA

• US 20130326624A1
• Filed: 05/21/2013
• Published: 12/05/2013
• Est. Priority Date: 12/04/2006
• Status: Active Grant

• Current Assignee: Glasswall (Ip) Limited
• Original Assignee: Glasswall (Ip) Limited
• Inventors: Hutton, Samuel Harrison, Goddard, Trevor
• Granted Patent: US 9,038,174 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 2221/03 Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of processing an electronic file by identifying portions of content data in the electronic file and determining if each portion of content data is passive content data having a fixed purpose or active content data having an associated function. If a portion is passive content data, then a determination is made as to whether the portion of passive content data is to be re-generated. If a portion is active content data, then the portion is analysed to determine whether the portion of active content data is to be re-generated. A re-generated electronic file is then created from the portions of content data which are determined to be re-generated.

Claims

1. A method of pre-processing an electronic file to be transmitted to a processing module, comprising the steps of:

re-writing the electronic file such that portions of the electronic file to be processed together by the processing module are arranged in a sequential order; and

transmitting the re-written electronic file to the processing module.

2. A method according to claim 1, further comprising the steps of:

receiving, at the processing module, portions of the re-written electronic file;

storing said received portions of the re-written electronic file in a buffer; and

processing the buffered received portions of the re-written electronic file once all portions to be processed together have been received.

3. A computer readable medium comprising a computer program adapted to perform the method of claim 1 when the computer program is run on a computer.

4. A semiconductor device comprising a memory means including instructions for performing the method of claim 1.

5. A system for pre-processing an electronic file to be transmitted to a processing module for malicious data detection, comprising:

means for identifying discrete portions of the file that need to be processed together in the course of malicious code analysis by the processing module;

means for re-writing the electronic file such that the portions to be processed together are arranged contiguously; and

means for transmitting the re-written electronic file to the processing module.

6. A system according to claim 5, further comprising a processing module arranged to:

receive portions of the re-written electronic file;

store said received portions of the re-written electronic file in a buffer; and

process the buffered received portions of the re-written electronic file once all portions to be processed together have been received, prior to receiving the entire file.

7. A system for testing an electronic file analysis and re-generation module, the system comprising:

means for receiving an electronic file;

an analysis and re-generation module for processing the received electronic file to create a re-generated electronic file;

wherein the system is arranged to process the re-generated electronic file using the analysis and re-generation module and wherein the analysis and re-generation module is determined to be functioning correctly if processing of the re-generated electronic file using the analysis and re-generation module creates a further re-generated electronic file.

8. A system according to claim 7, wherein said analysis and re-generation module is an apparatus for processing an electronic file, comprising:

means for identifying a portion of content data in the electronic file;

means for determining if the identified portion of content data is passive content data having a fixed purpose or active content data having an associated function;

means for determining a file type or protocol of a portion of passive content data, and for determining whether a portion of passive content data is to be re-generated by determining if the passive content data conforms to a predetermined data format comprising a set of rules corresponding to the file type or protocol;

means for analysing a portion of active content data to determine whether a portion of active content data is to be re-generated; and

means for re-generating the portion of content data to create a re-generated electronic file, if the portion of content data is determined to be re-generated.

9. An apparatus according to claim 8, wherein the electronic file comprises a plurality of portions of content data and wherein the apparatus is arranged to process each of said plurality of portions of content data to determine whether or not each portion of active content data is to be re-generated and to re-generate those portions of content data that are determined to be re-generated to create a re-generated electronic file.

10. An apparatus according to claim 8, further comprising means for determining if a cleaning mode is enabled or disabled and wherein said means for re-generating portions of content data is arranged such that a re-generated electronic file is not created if it is determined that at least one portion of passive content data is not to be re-generated and the cleaning mode is disabled.

11. An apparatus according to claim 10, wherein the apparatus is arranged to place the electronic file in quarantine if it is determined that at least one portion of passive content data is not to be re-generated and the cleaning mode is disabled.

12. An apparatus according to claim 8, wherein said means for analysing a portion of active content data is arranged to:

generate a hash for the portion of active content data;

determine if the generated hash is present in a hash database of known active content data; and

determine that the portion of active content data is to be re-generated if it is determined that the generated hash is present in a hash database of known active content data.

13. An apparatus according to claim 8, wherein the means for determining a file type or protocol of a portion of passive content data comprises a plurality of conformity analysers each associated with a particular file type or protocol.

14. An apparatus according to claim 8, wherein a portion of passive content data in the electronic file comprises a plurality of sub-portions of passive content data, and each of said sub-portions is processed by a respective one of said plurality of conformity analysers to determine if the sub-portions of passive content data conform to a predetermined data format.

15. An apparatus according to claim 8, wherein the means for re-generating a portion of content data comprises a plurality of content re-generators each associated with a particular file type or protocol.

16. An apparatus according to claim 8, wherein said passive content data comprises text, image, audio or video content data.

17. An apparatus according to claim 8, wherein said active content data comprises a script, macro or executable code.

18. An apparatus according to claim 8, wherein said means for analysing a portion of active content data is further arranged to analyse a portion of passive content data if said means for determining a purported predetermined data type of that portion of passive content data cannot determine a purported predetermined data type for that portion of passive content data.

19. An apparatus according to claim 18, further comprising means for normalizing a portion of active content data.

20. An apparatus according to claim 8, further comprising means for storing the electronic file in a scrambled format in memory.