Preventing malware downloads

Patent metadata

Field	Value
Publication number	US-11816216-B2
Application number	US-201616061856-A
Country	US
Kind code	B2
Filing date	Jan 27, 2016
Priority date	Jan 27, 2016
Publication date	Nov 14, 2023
Grant date	Nov 14, 2023

Abstract

An example embodiment of the present techniques determines, in response to a byte-serving request to download a portion of a resource, that the resource has previously been determined to comprise malware. Further, the byte-serving request is modified to request downloading all the resource. Additionally, all the resource is requested for downloading using the modified byte-serving request.

First claim

What is claimed is:

1. A method for preventing malware downloads, comprising:
receiving, by a system comprising a hardware processor, a byte-serving request to download a portion of a resource;
determining, by the system, that the resource requested by the byte-serving request has previously been determined to comprise malware;
based on determining that the resource has previously been determined to comprise malware, modifying, by the system, the byte-serving request to request downloading all the resource; and
requesting, by the system, downloading all the resource using the modified byte-serving request.

2. The method of claim 1 , comprising:
receiving a request to download a first resource;
determining, by the system, the first resource comprises malware; and
generating, by the system, an entry in a hash table for the first resource.

3. The method of claim 2 , wherein the generating of the entry in the hash table comprises:
determining an absolute uniform resource locator (URL) for the first resource; and
determining a hash value for the absolute URL, wherein the entry comprises the hash value for the absolute URL.

4. The method of claim 3 , wherein the determining that the resource requested by the byte-serving request has previously been determined to comprise malware comprises determining that a hash value for the resource matches an entry in the hash table.

5. The method of claim 3 , wherein the determining that the resource requested by the byte-serving request has previously been determined to comprise malware comprises:
determining an associated absolute URL associated with the byte-serving request;
computing a hash value for the associated absolute URL determined for the byte-serving request; and
performing a successful lookup in the hash table based on the computed hash value for the associated absolute URL.

6. The method of claim 1 , wherein the modifying of the byte-serving request to request downloading all the resource comprises modifying an If-Range value of a packet header that produces a modified If-Range value different than an Etag value for the resource.

7. The method of claim 6 , wherein the modified If-Range value being different from the Etag value for the resource disables a byte serving functionality associated with downloading the resource.

8. The method of claim 1 , wherein the requesting the downloading of all the resource using the modified byte-serving request comprises sending the modified byte-serving request to a server hosting the resource.

9. The method of claim 1 , wherein the byte-serving request comprises a Range field defining a beginning byte number of remaining packets of the resource to be downloaded, the remaining packets being in addition to previously downloaded packets of the resource.

10. The method of claim 1 , wherein the receiving of the byte-serving request, the determining that the resource requested by the byte-serving request has previously been determined to comprise malware, the modifying of the byte-serving request, and the requesting of the downloading of all the resource are performed by a firewall device in the system.

11. A system comprising:
a processor; and
a memory comprising code that causes the processor to:
receive a request to download a resource;
determine the resource comprises malware;
generate an entry in a hash table for the resource;
receive a byte-serving request to download a portion of the resource;
determine that the resource requested by the byte-serving request has previously been determined to comprise malware;
based on determining that the resource has previously been determined to comprise malware, modify the byte-serving request to request downloading all the resource; and
request downloading all the resource using the modified byte-serving request.

12. The system of claim 11 , wherein the generating of the entry in the hash table comprises:
determining an absolute uniform resource locator (URL) for the resource; and
determining a hash value based on the absolute URL, wherein the entry comprises the hash value based on the absolute URL.

13. The system of claim 12 , wherein the determining that the resource requested by the byte-serving request has previously been determined to comprise malware comprises:
determining an associated absolute URL based on fields in the byte-serving request;
computing a hash value based on the associated absolute URL determined based on the fields in the byte-serving request; and
performing a successful lookup in the hash table based on the computed hash value.

14. The system of claim 11 , wherein the modifying of the byte-serving request to request downloading all the resource comprises modifying an If-Range value of a packet header that produces a modified If-Range value different than an Etag value for the resource.

15. The system of claim 14 , wherein the modified If-Range value being different from the Etag value for the resource disables a byte serving functionality associated with downloading the resource.

16. The system of claim 11 , wherein the requesting the downloading of all the resource using the modified byte-serving request comprises sending the modified byte-serving request to a server hosting the resource.

17. A non-transitory, tangible computer-readable medium, comprising code to direct a processor to:
determine, in response to a byte-serving request to download a portion of a resource, that the resource has previously been determined to comprise malware;
in response to determining that the resource has previously been determined to comprise malware, modify the byte-serving request to request downloading all the resource by modifying an If-Range value of a packet header such that the If-Range value is different than an Etag value for the resource; and
request downloading all the resource using the modified byte-serving request.

18. The non-transitory, tangible computer-readable medium of claim 17 , comprising code to direct the processor to:
receive a request to download a first resource;
determine the first resource comprises malware; and
generate an entry in a hash table for the first resource.

19. The non-transitory, tangible computer-readable medium of claim 18 , wherein the generating of the entry of the hash table comprises:
determining an absolute uniform resource locator (URL) for the resource; and
determining a hash value based on the absolute URL, wherein the entry comprises the hash value based on the absolute URL.

20. The non-transitory, tangible computer-readable medium of claim 19 , wherein the determining that the resource has previously been determined to comprise malware comprises:
determining an associated absolute URL based on fields in the byte-serving request;
computing a hash value based on the associated absolute URL determined based on the fields in the byte-serving request; and
performing a successful lookup in the hash table based on the computed hash value.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Ardeli Ramesh

Classifications

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• H04L12/22

  Arrangements for preventing the taking of data from a data transmission channel without authorisation (means for verifying the identity or the authority of a user of a secure or secret communication system H04L9/32) · CPC title

• H04L45/7453

  using hashing · CPC title