Malware detection

Patent metadata

Field	Value
Publication number	US-10984103-B2
Application number	US-201616071016-A
Country	US
Kind code	B2
Filing date	Jan 26, 2016
Priority date	Jan 26, 2016
Publication date	Apr 20, 2021
Grant date	Apr 20, 2021

Abstract

An example implementation of the present techniques determines, in response to a request to download a resource, whether the resource has previously been determined to comprise malware. Additionally, it is determined, if the resource has previously been determined to comprise malware, whether the resource has changed since the previous determination. Further the request to download the resource is terminated if the resource has not changed.

First claim

What is claimed is:

1. A method for detecting malware, comprising:
determining, by a firewall device, whether a resource comprises malware;
generating, by the firewall device, an entry in a hash table for the resource upon a determination that the resource comprises malware, wherein generating the entry comprises:
determining an absolute uniform resource locator (URL) for the resource; and
determining an Etag for the resource, wherein the entry comprises the absolute URL and the Etag;

determining, by the firewall device, in response to a subsequent request to download the resource, whether the resource has previously been determined to comprise malware, wherein determining whether the resource has previously been determined to comprise malware comprises performing a lookup in the hash table based on the absolute URL, wherein the resource has previously been determined to comprise malware if the lookup is successful, a successful lookup comprising a determination that the Etag of the generated entry in the hash table matches an Etag in a header packet of the subsequently requested resource;
determining, by the firewall device, if the resource has previously been determined to comprise malware, whether the resource has changed since the previous determination, wherein determining whether the resource has changed comprises:
determining the Etag based on the successful lookup;
determining a current Etag for the resource; and
comparing the Etag to the current Etag, wherein the resource has not changed if the Etag is equal to the current Etag; and

terminating, by the firewall device, the request to download the resource if the resource has not changed.

2. The method of claim 1 , wherein determining the resource comprises malware comprises one of:
signature scanning the resource;
performing a hash lookup of an entire file comprising the resource; and
monitoring the resource in a sandbox execution environment.

3. A system for detecting malware, comprising:
a processor; and
a memory comprising code that causes the processor to:
determine a resource comprises malware;
generate an entry in a hash table for the resource upon a determination that the resource comprises malware, wherein to generate the entry, the code causes the processor to:
determine an absolute uniform resource locator (URL) for the resource; and
determine an Etag for the resource, wherein the entry comprises the absolute URL and the Etag;

determine, in response to a subsequent request to download the resource, whether the resource has previously been determined to comprise malware, wherein the determination whether the resource has previously been determined to comprise malware comprises performing a lookup in the hash table based on the absolute URL, wherein the resource has previously been determined to comprise malware if the lookup is successful, a successful lookup comprising a determination that the Etag of the generated entry in the hash table matches an Etag in a header packet of the subsequently requested resource;
determine, if the resource has previously been determined to comprise malware, whether the resource has changed since the previous determination, wherein to determine whether the resource has changed, the code causes the processor to:
determining the Etag based on the successful lookup;
determining a current Etag for the resource; and
comparing the Etag to the current Etag, wherein the resource has not changed if the Etag is equal to the current Etag; and

terminate the request to download the resource if the resource has not changed.

4. The system of claim 3 , wherein determining the resource comprises malware comprises one of:
signature scanning the resource;
performing a hash lookup of an entire file comprising the resource; and
monitoring the resource in a sandbox execution environment.

5. A non-transitory, tangible computer-readable medium, comprising code to direct a processor to:
determine a resource comprises malware;
generate an entry in a hash table for the resource upon a determination that the resource comprises malware, wherein generating the entry comprises:
determining an absolute uniform resource locator (URL) for the resource; and
determining an Etag for the resource, wherein the entry comprises the absolute URL and the Etag;

determine, in response to a subsequent request to download the resource, whether the resource has previously been determined to comprise malware, wherein the determination whether the resource has previously been determined to comprise malware comprises performing a lookup in the hash table based on the absolute URL, wherein the resource has previously been determined to comprise malware if the lookup is successful, a successful lookup comprising a determination that the Etag of the generated entry in the hash table matches an Etag in a header packet of the subsequently requested resource;
determine, if the resource has previously been determined to comprise malware, whether the resource has changed since the previous determination, wherein determining whether the resource has changed comprises:
determining the Etag based on the successful lookup;
determining a current Etag for the resource; and
comparing the Etag to the current Etag, wherein the resource has not changed if the Etag is equal to the current Etag; and

terminate the request to download the resource if the resource has not changed.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Ardeli Ramesh

Classifications

• G06F21/567

  using dedicated hardware · CPC title

• H04L63/0245

  Filtering by information in the payload · CPC title

• G06F2221/2119

  Authenticating web pages, e.g. with suspicious links · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title