Method and apparatus for retroactively detecting malicious or otherwise undesirable software as well as clean software through intelligent rescanning

Patent metadata

Field	Value
Publication number	US-9747445-B2
Application number	US-201514971168-A
Country	US
Kind code	B2
Filing date	Dec 16, 2015
Priority date	Jul 13, 2012
Publication date	Aug 29, 2017
Grant date	Aug 29, 2017

Abstract

Techniques are provided for the detection of malicious software (malware) on a general purpose computing device. A challenge in detecting malicious software is that files are typically scanned for the presence of malicious intent only once (and subsequent rescanning is typically performed in a simplistic manner). Existing methods in the art do not address how to most effectively rescan collections of files in a way that tries to optimize performance and efficacy. These methods may also be useful if additional information is now available regarding a file that might be useful to an end-user or an administrator, even though the file's core disposition might not have changed. More specifically, we describe methods, components, and systems that perform data analytics to intelligently rescan file collections for the purpose of retroactively identifying malware and retroactively identifying clean files.

First claim

What is claimed is:

1. A method comprising:
at a server in a computing system, receiving meta-data extracted from files of interest from a plurality of client computers, wherein the files of interests are selected files of the plurality of client computers and have been identified based upon activity of the files including creating, moving, copying or executing the files, and wherein the meta-data includes contextual information of how each of the files of interests are identified;
logging the files of interest and the extracted meta-data into log files;
periodically scanning the log files to identify a subset of files as candidates for rescanning based on a vector of scores, wherein the vector of scores is determined at least in part based on the contextual information including whether a file was accessed after one or more known malicious or known clean files were accessed, whether a parent process that created the file is determined to be malicious or benign, whether there is system-level behavior that is indicative of malicious software running on the system, and whether prevalence of the file among multiple users exceeds a pre-defined threshold; and
rescanning the identified candidates against information stored at the server to determine whether a previously assigned disposition needs to be changed.

2. The method of claim 1 , further comprising:
communicating with a client computer when it is determined upon rescanning that a file that had been previously assigned a malicious, benign or unknown disposition should be assigned a different disposition; and
updating a database of information pertaining to known malicious and benign applications.

3. The method of claim 1 , further comprising:
communicating with a client computer when it is determined upon rescanning that there is additional information about a file that had been previously assigned a malicious, benign or unknown disposition; and
updating a database of information pertaining to known malicious and benign applications.

4. The method of claim 3 , wherein the additional information comprises one or more of: an updated threat name for the file, an updated classification about how to categorize the file, updated information about what the file does, when executed, on different systems.

5. The method of claim 1 , wherein the extracted meta-data is first used to make an immediate disposition and is subsequently used to determine whether a file is a good candidate for subsequent rescanning and is later used to simplify the process of rescanning.

6. The method of claim 1 , further comprising:
logging transactional information relating to the extracted meta-data; and
maintaining a record of software applications and end user systems on which the software applications reside.

7. The method of claim 1 , further comprising examining meta-data gathered on a plurality of files from a plurality of devices on which the plurality of files reside and identifying a subset of plurality of files that are suitable candidates for rescanning.

8. The method of claim 7 , wherein file characteristics used to determine whether a file is a suitable candidate for rescanning further include information indicating whether the file was detected as a threat on a system in a way that might have been specific to that system.

9. An apparatus comprising:
a memory containing computer readable instructions; and
a processor configured to execute the computer readable instructions to:
receive meta-data extracted from files of interest from a plurality of client computers, wherein the files of interests are selected files of the plurality of client computers and have been identified based upon activity of the files including creating, moving, copying or executing the files, and wherein the meta-data includes contextual information of how each of the files of interests are identified;
log the files of interest and the extracted meta-data into log files;
periodically scan the log files to identify a subset of files as candidates for rescanning based on a vector of scores, wherein the vector of scores is determined at least in part based on the contextual information including whether a file was accessed after one or more known malicious or known clean files were accessed, whether a parent process that created the file is determined to be malicious or benign, whether there is system-level behavior that is indicative of malicious software running on the system, and whether prevalence of the file among multiple users exceeds a pre-defined threshold; and
rescan the identified candidates against information stored at a server to determine whether a previously assigned disposition need to be changed.

10. The apparatus of claim 9 , wherein the processor is further configured to execute the computer readable instructions to:
communicate with a client computer when it is determined upon rescanning that a file that had been previously assigned a malicious, benign or unknown disposition should be assigned a different disposition, and/or that there is additional information about a file that had been previously assigned a malicious, benign or unknown disposition; and
update a database of information pertaining to known malicious and benign applications, wherein the additional information comprises one or more of: an updated threat name for the file, an updated classification about how to categorize the file, updated information about what the file does, when executed, on different systems.

11. The apparatus of claim 9 , wherein the extracted meta-data is first used to make an immediate disposition and is subsequently used to determine whether a file is a good candidate for subsequent rescanning and is later used to simplify the process of rescanning.

12. The apparatus of claim 9 , wherein the processor is further configured to execute the computer readable instructions to:
log transactional information relating to the extracted meta-data; and
maintain a record of software applications and end user systems on which the software applications reside.

13. The apparatus of claim 9 , wherein the processor is further configured to execute the computer readable instructions to:
examine meta-data gathered on a plurality of files from a plurality of devices on which the plurality of files reside; and
identify a subset of plurality of files that are suitable candidates for rescanning.

14. The apparatus of claim 13 , wherein file characteristics used to determine whether a file is a suitable candidate for rescanning further include information indicating whether the file was detected as a threat on a system in a way that might have been specific to that system.

15. A non-transitory computer-readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:
receive meta-data extracted from files of interest from a plurality of client computers, wherein the files of interests are selected files of the plurality of client computers and have been identified based upon activity of the files including creating, moving, copying or executing the files, and wherein the meta-data includes contextual information of how each of the files of interests are identified;
log the files of interest and the extracted meta-data into log files;
periodically scan the log files to identify a subset of files as candidates for rescanning based on a vector of scores, wherein the vector of scores is determined at least in part based on the contextual information including whether a file was accessed after one or more known malicious or known clean files

Assignees

• Cisco Tech Inc

Inventors

• Friedrichs Oliver
• Huger Alfred
• Ramzan Zulfikar

Classifications

• G06F21/562

  Static detection · CPC title

• G06F21/565 Primary

  by checking file integrity · CPC title

• G06F16/2358

  Change logging, detection, and notification (replication G06F16/27) · CPC title

• G06F16/13

  File access structures, e.g. distributed indices (arrangements of input from, or output to, record carriers G06F3/06) · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title