Method and device for determining propagation relationship of Trojan horse files

Patent metadata

Field	Value
Publication number	US-9256741-B2
Application number	US-201414276627-A
Country	US
Kind code	B2
Filing date	May 13, 2014
Priority date	Jan 30, 2013
Publication date	Feb 9, 2016
Grant date	Feb 9, 2016

Abstract

A method performed by a computer system determines propagation relationships of Trojan horse files. A current Trojan horse file is stored into a corresponding current level of a propagation relationship tree. A condition of the current Trojan horse file or of the propagation relationship tree is assessed. The following steps are repeated until the condition is satisfied: search Trojan horse files for a parent, child or sibling relative to the current Trojan horse file, identify one of the Trojan horse files as the current Trojan horse file, and store the current Trojan horse file into a corresponding current level of the propagation relationship tree. When the condition is satisfied, the propagation relationship tree is displayed. The storing of the current Trojan horse file may include storing an identifier of the current Trojan horse file, which may include data abstraction output, and/or a downloading address of the current Trojan horse file.

First claim

I claim:

1. A method performed by a computer system for determining propagation relationships of Trojan horse files, the method comprising:
storing, by a computer comprising a processor, a current Trojan horse file into a corresponding current level of a propagation relationship tree;
determining, by the computer, whether a relationship condition of the current Trojan horse file or of the propagation relationship tree, is satisfied;
repeating, by the computer, the following steps until the relationship condition is satisfied:
searching, by the computer, Trojan horse files for a parent, child or sibling relationship to the current Trojan horse file,
identifying, by the computer, one of the Trojan horse files as the current Trojan horse file, and
storing, by the computer, the current Trojan horse file into a corresponding current level of the propagation relationship tree; and

displaying, by the computer, the propagation relationship tree when the relationship condition is satisfied;
wherein the relationship condition comprises:
whether a current level number at which the current Trojan horse file is positioned in the propagation relationship tree is greater than a threshold N;
whether a level number of a highest level in the propagation relationship tree is greater than the threshold N; or
whether the current Trojan horse file has no parent, child or sibling Trojan horse file.

2. The method according to claim 1 , wherein the displaying, by the computer, the propagation relationship tree includes one or more of:
displaying the propagation relationship tree;
displaying a current level number corresponding to the level at which the current Trojan horse file is positioned in the propagation relationship tree;
displaying an identifier of the current Trojan horse file; and
displaying a downloading address for the current Trojan horse file.

3. The method according to claim 1 , wherein the storing, by the computer, a current Trojan horse file into a corresponding current level of a propagation relationship tree includes storing one or both of:
an identifier of the current Trojan horse file, and
a downloading address for the current Trojan horse file,
into the corresponding level of the propagation relationship tree.

4. The method according to claim 3 , wherein the identifier of the current Trojan horse file includes one or both of a data abstraction and a name of the current Trojan horse file.

5. A system including one or more hardware processors for determining propagation relationships of Trojan horse files, the system comprising:
a storing unit, adapted to store a current Trojan horse file into a corresponding current level of a propagation relationship tree;
a determining unit, adapted to determine whether a relationship condition of the stored current Trojan horse file or of the propagation relationship tree, is satisfied;
a searching unit, adapted to, repeat the following steps until it is determined by the determining unit that the relationship condition is satisfied:
search Trojan horse files for a parent, child or sibling of the current Trojan horse file,
identify one of the searched Trojan horse files as the current Trojan horse file, and
trigger the storing unit to store the current Trojan horse file into a corresponding current level of the propagation relationship tree; and

a processing unit, adapted to display the propagation relationship tree in instances when it is determined by the determining unit that the relationship condition is satisfied;
wherein the relationship condition comprises:
whether a current level number at which the current Trojan horse file is positioned in the propagation relationship tree is greater than a threshold N;
whether a number of a highest level in the propagation relationship tree is greater than the threshold N; or
whether the current Trojan horse file has no parent, child or sibling Trojan horse file.

6. The system according to claim 5 , wherein the processing unit is further adapted to, when it is determined by the determining unit that the relationship condition is satisfied, perform one or more of:
display the propagation relationship tree;
display a current level number corresponding to the level at which the current Trojan horse file is positioned in the propagation relationship tree;
display an identifier of the current Trojan horse file; and
display a downloading address for the current Trojan horse file.

7. The system according to claim 5 , wherein the storing unit is further adapted to store one or both of:
an identifier of the current Trojan horse file, and
a downloading address of the current Trojan horse file,

into the corresponding level of the propagation relationship tree.

8. The system according to claim 7 , wherein the identifier of the current Trojan horse file includes one or both of a data abstraction and a name of the current Trojan horse file.

9. A non-transitory computer-readable medium containing codes that can be executed by a computer, when the codes are executed by the computer, the computer performs the following steps for determining propagation relationships of Trojan horse files, the steps comprising:
storing a current Trojan horse file into a corresponding current level of a propagation relationship tree;
determining whether a relationship condition of the current Trojan horse file or of the propagation relationship tree, is satisfied;
repeating the following steps until the relationship condition is satisfied:
searching Trojan horse files for a parent, child or sibling relative to the current Trojan horse file,
identifying one of the Trojan horse files as the current Trojan horse file, and
storing the current Trojan horse file into a corresponding current level of the propagation relationship tree; and

displaying the propagation relationship tree when the relationship condition is satisfied;
wherein the relationship condition comprises:
whether a current level number at which the current Trojan horse file is positioned in the propagation relationship tree is greater than a threshold N;
whether a level number of a highest level in the propagation relationship tree is greater than the threshold N; or
whether the current Trojan horse file has no parent, child or sibling Trojan horse file.

10. The non-transitory computer-readable medium according to claim 9 , wherein the displaying the propagation relationship tree includes one or more of:
displaying the propagation relationship tree;
displaying a current level number corresponding to the level at which the current Trojan horse file is positioned in the propagation relationship tree;
displaying an identifier of the current Trojan horse file; and
displaying a downloading address for the current Trojan horse file.

11. The non-transitory computer-readable medium according to claim 9 , wherein the storing a current Trojan horse file into a corresponding current level of a propagation relationship tree includes storing one or both of:
an identifier of the current Trojan horse file, and
a downloading address for the current Trojan horse file,
into the corresponding level of the propagation relationship tree.

12. The non-transitory computer-readable medium according to claim 11 , wherein the identifier of the current Trojan horse file includes one or both of a data abstraction and a name of the current Trojan horse file.

Assignees

• Tencent Tech Shenzhen Co Ltd

Inventors

• Tang Yeshang

Classifications

• G06F21/561 Primary

  Virus type analysis · CPC title

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title