Resisting the spread of unwanted code and data

• US 9,038,174 B2
• Filed: 05/21/2013
• Issued: 05/19/2015
• Est. Priority Date: 12/04/2006
• Status: Active Grant

• Current Assignee: Glasswall (Ip) Limited
• Original Assignee: Glasswall (Ip) Limited
• Inventors: Hutton, Samuel Harrison, Goddard, Trevor
• Primary Examiner(s): Pyzocha, Michael
• Assistant Examiner(s): Wade, Shaqueal
• Application Number:
  US13/899,043
• Publication Number:
  US 20130326624A1
• Time in Patent Office: 728 Days
• Field of Search: 726/20, 726/22, 726/24, 709/206
• US Class Current: 726/22
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 2221/03 Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method of processing an electronic file by identifying portions of content data in the electronic file and determining if each portion of content data is passive content data having a fixed purpose or active content data having an associated function. If a portion is passive content data, then a determination is made as to whether the portion of passive content data is to be re-generated. If a portion is active content data, then the portion is analyzed to determine whether the portion of active content data is to be re-generated. A re-generated electronic file is then created from the portions of content data which are determined to be re-generated.

Claims

1. A system for testing an electronic file analysis and re-generation module, the system comprising:

means for receiving an electronic file when a cleaning flag is set to enabled;

an analysis and re-generation module for processing the received electronic file to create a re-generated electronic file by removing nonconforming portions of the file and portions that have unknown functionality;

wherein the system is arranged to process the re-generated electronic file using the analysis and re-generation module when the cleaning flag is set to disabled; and

wherein the analysis and re-generation module is determined to be functioning correctly if processing of the re-generated electronic file using the analysis and re-generation module creates a further re-generated electronic file; and

the analysis and re-generation module is determined to be functioning incorrectly if processing of the re-generated electronic file using the analysis and re-generation module does not create a further re-generated electronic file.

2. A system according to claim 1, wherein said analysis and re-generation module is an apparatus for processing an electronic file, comprising:

means for identifying a portion of content data in the electronic file;

means for determining if the identified portion of content data is passive content data having a fixed purpose or active content data having an associated function;

means for determining a file type or protocol of a portion of passive content data, and for determining whether a portion of passive content data is to be re-generated by determining if the passive content data conforms to a predetermined data format comprising a set of rules corresponding to the file type or protocol;

means for analysing a portion of active content data to determine whether a portion of active content data is to be re-generated; and

means for re-generating the portion of content data to create a re-generated electronic file, if the portion of content data is determined to be re-generated.

3. A system according to claim 2, wherein the electronic file comprises a plurality of portions of content data and wherein the apparatus is arranged to process each of said plurality of portions of content data to determine whether or not each portion of active content data is to be re-generated and to re-generate those portions of content data that are determined to be re-generated to create a re-generated electronic file.

4. A system according to claim 2, further comprising means for determining if a cleaning mode is enabled or disabled and wherein said means for re-generating portions of content data is arranged such that a re-generated electronic file is not created if it is determined that at least one portion of passive content data is not to be re-generated and the cleaning mode is disabled.

5. A system according to claim 4, wherein the apparatus is arranged to place the electronic file in quarantine if it is determined that at least one portion of passive content data is not to be re-generated and the cleaning mode is disabled.

6. A system according to claim 2, wherein said means for analysing a portion of active content data is arranged to:

generate a hash for the portion of active content data;

determine if the generated hash is present in a hash database of known active content data; and

determine that the portion of active content data is to be re-generated if it is determined that the generated hash is present in a hash database of known active content data.

7. A system according to claim 2, wherein the means for determining a file type or protocol of a portion of passive content data comprises a plurality of conformity analysers each associated with a particular file type or protocol.

8. A system according to claim 7, wherein a portion of passive content data in the electronic file comprises a plurality of sub-portions of passive content data, and each of said sub-portions is processed by a respective one of said plurality of conformity analysers to determine if the sub-portions of passive content data conform to a predetermined data format.

9. A system according to claim 2, wherein the means for re-generating a portion of content data comprises a plurality of content re-generators each associated with a particular file type or protocol.

10. A system according to claim 2, wherein said passive content data comprises text, image, audio or video content data.

11. A system according to claim 2, wherein said active content data comprises a script, macro or executable code.

12. A system according to claim 2, wherein said means for analysing a portion of active content data is further arranged to analyse a portion of passive content data if said means for determining a file type or protocol of a portion of passive content data cannot determine a file type or protocol of portion of passive content data.

13. A system according to claim 12, further comprising means for normalizing a portion of active content data.

14. A system according to claim 2, further comprising means for storing the electronic file in a scrambled format in memory.