Cloud-based malware detection

Patent metadata

Field	Value
Publication number	US-10262136-B1
Application number	US-18548408-A
Country	US
Kind code	B1
Filing date	Aug 4, 2008
Priority date	Aug 4, 2008
Publication date	Apr 16, 2019
Grant date	Apr 16, 2019

Abstract

Systems, methods and apparatus for malware detection detect and stop the distribution of malware and other undesirable content before such content reaches computing systems. A malware detection service external to network edges of a system receives a request from a computer within the system, the request identifying a signature associated with content. The service determines a status indicator of the content using the signature, and transmits the status indicator to the computer.

First claim

What is claimed is:

1. A network security system, comprising:
a computer operating a malware detection service external to network edges of at least one system, the malware detection service comprising instructions, when executed, cause the computer to:
receive a request from a computer within the at least one system, the request identifying a hash signature associated with a file, wherein, prior to determining the hash signature, a random sequence which does not affect malware is added to the file;
identify a status indicator of content of the file using the hash signature, the hash signature comprises a digest of data in the file;
and transmit the status indicator to the computer within the at least one system.

2. The system of claim 1 , further comprising an access agent in communication with the computer and the malware detection service.

3. The system of claim 2 , wherein the access agent resides on the computer within the at least one system.

4. The system of claim 2 , wherein the hash signature is generated by the access agent, and the access agent causes transmission of the hash signature to the computer responsive to the access agent not finding a matching hash signature to the hash signature in a global table.

5. The system of claim 1 , wherein the malware detection service is further configured to perform a lookup in at least one table to identify the status indicator.

6. The system of claim 5 , wherein the at least one table comprises a global malware table or a enterprise specific table.

7. The system of claim 5 , wherein the malware detection service is further configured to:
receive the file from the computer; and
generate a hash signature for the file.

8. The system of claim 7 , wherein the malware detection service is further configured to:
add the hash signature for the file to the at least one table.

9. The system of claim 5 , wherein the at least one table resides within the malware detection service.

10. The system of claim 5 , wherein the at least one table comprises a list of hash signatures and their respective status indicators.

11. The system of claim 1 , wherein the status indicator is selected from the group of status indicators consisting of trusted, untrusted, and unknown.

12. The system of claim 1 , wherein the hash signature is generated using Message-Digest Algorithm (MD5).

13. The system of claim 1 , wherein the file is prepended with the random sequence prior to generating the hash signature to prevent signature matching by malware.

14. The system of claim 1 , wherein the hash signature comprises a digest of the file, file name, and file size, and the hash signature is transmitted to the malware detection service in lieu of transmitting the file.

15. The system of claim 1 , wherein the request is performed only if the file has changed since in length or last modified date since a last inspection.

16. The system of claim 1 , wherein the hash signature is about 16 bytes of signature information along with about 4 bytes of document length, and the hash signature is sent to the malware detection service instead of the file.

17. The system of claim 1 , wherein the random sequence is coordinated between the malware detection service, the computer within the at least one system, and other components in the system.

18. The system of claim 1 , wherein the random sequence comprises any of comments in scripts, NOOPs, and data bytes in the file.

19. The system of claim 1 , wherein the instructions, when executed, further cause the computer to:
transmit the status indicator as unknown to the computer within the at least one system;
receive the file from the computer within the at least one system; and
inspect the file to determine whether the file is trustworthy.

20. The system of claim 1 , wherein the file has a different name from another file that is already determined as trustworthy, and wherein the malware detection service is configured to determine the file is trustworthy if its file size and the hash signature match that of the another file.

21. The system of claim 1 , wherein the computer operating the malware detection service is communicatively coupled to the computer within the at least one system and a plurality of additional computers, and responsive to an update, the malware detection service is configured to provide the update to an access agent for the computer within the at least one system and the plurality of additional computers.

22. A method performed in a network security system, the network security system comprising a computer operating a malware detection service external to network edges of at least one system, the method comprising:
receiving a request from a computer within the at least one system, the request identifying a hash signature associated with a file, wherein, prior to determining the hash signature, a random sequence which does not affect malware is added to the file;
identifying a status indicator of content of the file using the hash signature, the hash signature comprises a digest of data in the file; and
transmit the status indicator to the computer within the at least one system.

23. The method of claim 22 , wherein the random sequence is coordinated between the malware detection service, the computer within the at least one system, and other components in the system, and wherein the random sequence comprises any of comments in scripts, NOOPs, and data bytes in the file.

Assignees

• Kailash Kailash
• Voit Robert L
• Raphel Jose
• Zscaler Inc

Inventors

• Kailash Kailash
• Voit Robert L
• Raphel Jose

Classifications

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F16/152

  using file content signatures, e.g. hash values · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title