WO2004097602A2 - A method of, and system for, heuristically determining that an unknown file is harmless by using traffic heuristics - Google Patents
A method of, and system for, heuristically determining that an unknown file is harmless by using traffic heuristics Download PDFInfo
- Publication number
- WO2004097602A2 WO2004097602A2 PCT/GB2004/001333 GB2004001333W WO2004097602A2 WO 2004097602 A2 WO2004097602 A2 WO 2004097602A2 GB 2004001333 W GB2004001333 W GB 2004001333W WO 2004097602 A2 WO2004097602 A2 WO 2004097602A2
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- file
- database
- maiware
- processing
- dependence
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
Abstract
Description
Claims
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
AU2004235515A AU2004235515B2 (en) | 2003-04-25 | 2004-03-29 | A method of, and system for, heuristically determining that an unknown file is harmless by using traffic heuristics |
EP04724054A EP1618447A2 (en) | 2003-04-25 | 2004-03-29 | A method of, and system for, heuristically determining that an unknown file is harmless by using traffic heuristics |
US10/500,957 US20050080816A1 (en) | 2003-04-25 | 2004-03-29 | Method of, and system for, heurisically determining that an unknown file is harmless by using traffic heuristics |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
GB0309463A GB2400932B (en) | 2003-04-25 | 2003-04-25 | A method of,and system for,heuristically determining that an unknown file is harmless by using traffic heuristics |
GB0309463.8 | 2003-04-25 |
Publications (2)
Publication Number | Publication Date |
---|---|
WO2004097602A2 true WO2004097602A2 (en) | 2004-11-11 |
WO2004097602A3 WO2004097602A3 (en) | 2005-05-12 |
Family
ID=33042176
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/GB2004/001333 WO2004097602A2 (en) | 2003-04-25 | 2004-03-29 | A method of, and system for, heuristically determining that an unknown file is harmless by using traffic heuristics |
Country Status (6)
Country | Link |
---|---|
US (1) | US20050080816A1 (en) |
EP (1) | EP1618447A2 (en) |
AU (1) | AU2004235515B2 (en) |
GB (1) | GB2400932B (en) |
HK (1) | HK1070708A1 (en) |
WO (1) | WO2004097602A2 (en) |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN102831049A (en) * | 2011-06-13 | 2012-12-19 | 腾讯科技(深圳)有限公司 | Method and system for detecting software |
US8418250B2 (en) | 2005-06-30 | 2013-04-09 | Prevx Limited | Methods and apparatus for dealing with malware |
US8479174B2 (en) | 2006-04-05 | 2013-07-02 | Prevx Limited | Method, computer program and computer for analyzing an executable computer file |
US10574630B2 (en) | 2011-02-15 | 2020-02-25 | Webroot Inc. | Methods and apparatus for malware threat research |
Families Citing this family (20)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8239946B2 (en) * | 2004-04-22 | 2012-08-07 | Ca, Inc. | Methods and systems for computer security |
US7680890B1 (en) | 2004-06-22 | 2010-03-16 | Wei Lin | Fuzzy logic voting method and system for classifying e-mail using inputs from multiple spam classifiers |
US8484295B2 (en) | 2004-12-21 | 2013-07-09 | Mcafee, Inc. | Subscriber reputation filtering method for analyzing subscriber activity and detecting account misuse |
US7953814B1 (en) * | 2005-02-28 | 2011-05-31 | Mcafee, Inc. | Stopping and remediating outbound messaging abuse |
US9015472B1 (en) | 2005-03-10 | 2015-04-21 | Mcafee, Inc. | Marking electronic messages to indicate human origination |
US8738708B2 (en) | 2004-12-21 | 2014-05-27 | Mcafee, Inc. | Bounce management in a trusted communication network |
US9160755B2 (en) | 2004-12-21 | 2015-10-13 | Mcafee, Inc. | Trusted communication network |
US8713686B2 (en) | 2006-01-25 | 2014-04-29 | Ca, Inc. | System and method for reducing antivirus false positives |
US8201244B2 (en) | 2006-09-19 | 2012-06-12 | Microsoft Corporation | Automated malware signature generation |
US8413247B2 (en) * | 2007-03-14 | 2013-04-02 | Microsoft Corporation | Adaptive data collection for root-cause analysis and intrusion detection |
US8959568B2 (en) * | 2007-03-14 | 2015-02-17 | Microsoft Corporation | Enterprise security assessment sharing |
US8955105B2 (en) * | 2007-03-14 | 2015-02-10 | Microsoft Corporation | Endpoint enabled for enterprise security assessment sharing |
US20080229419A1 (en) * | 2007-03-16 | 2008-09-18 | Microsoft Corporation | Automated identification of firewall malware scanner deficiencies |
US8424094B2 (en) * | 2007-04-02 | 2013-04-16 | Microsoft Corporation | Automated collection of forensic evidence associated with a network security incident |
US10354229B2 (en) | 2008-08-04 | 2019-07-16 | Mcafee, Llc | Method and system for centralized contact management |
GB2463467B (en) | 2008-09-11 | 2013-03-06 | F Secure Oyj | Malware detection method and apparatus |
US8621625B1 (en) * | 2008-12-23 | 2013-12-31 | Symantec Corporation | Methods and systems for detecting infected files |
US20110069089A1 (en) * | 2009-09-23 | 2011-03-24 | Microsoft Corporation | Power management for organic light-emitting diode (oled) displays |
US8832835B1 (en) * | 2010-10-28 | 2014-09-09 | Symantec Corporation | Detecting and remediating malware dropped by files |
GB2532199B (en) * | 2014-11-05 | 2018-10-03 | F Secure Corp | Determining malware status of file |
Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2002033525A2 (en) * | 2000-10-17 | 2002-04-25 | Chuang Shyne Song | A method and system for detecting rogue software |
GB2378015A (en) * | 2001-07-26 | 2003-01-29 | Networks Assoc Tech Inc | Detecting computer programs within packed computer files |
Family Cites Families (20)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5617533A (en) * | 1994-10-13 | 1997-04-01 | Sun Microsystems, Inc. | System and method for determining whether a software package conforms to packaging rules and requirements |
US20030033402A1 (en) * | 1996-07-18 | 2003-02-13 | Reuven Battat | Method and apparatus for intuitively administering networked computer systems |
US6357008B1 (en) * | 1997-09-23 | 2002-03-12 | Symantec Corporation | Dynamic heuristic method for detecting computer viruses using decryption exploration and evaluation phases |
US6721721B1 (en) * | 2000-06-15 | 2004-04-13 | International Business Machines Corporation | Virus checking and reporting for computer database search results |
US7281267B2 (en) * | 2001-02-20 | 2007-10-09 | Mcafee, Inc. | Software audit system |
US7080000B1 (en) * | 2001-03-30 | 2006-07-18 | Mcafee, Inc. | Method and system for bi-directional updating of antivirus database |
US7069594B1 (en) * | 2001-06-15 | 2006-06-27 | Mcafee, Inc. | File system level integrity verification and validation |
US7673342B2 (en) * | 2001-07-26 | 2010-03-02 | Mcafee, Inc. | Detecting e-mail propagated malware |
US7310817B2 (en) * | 2001-07-26 | 2007-12-18 | Mcafee, Inc. | Centrally managed malware scanning |
US6792543B2 (en) * | 2001-08-01 | 2004-09-14 | Networks Associates Technology, Inc. | Virus scanning on thin client devices using programmable assembly language |
US7356736B2 (en) * | 2001-09-25 | 2008-04-08 | Norman Asa | Simulated computer system for monitoring of software performance |
US20030070088A1 (en) * | 2001-10-05 | 2003-04-10 | Dmitry Gryaznov | Computer virus names cross-reference and information method and system |
US7340774B2 (en) * | 2001-10-15 | 2008-03-04 | Mcafee, Inc. | Malware scanning as a low priority task |
US7310818B1 (en) * | 2001-10-25 | 2007-12-18 | Mcafee, Inc. | System and method for tracking computer viruses |
US7150042B2 (en) * | 2001-12-06 | 2006-12-12 | Mcafee, Inc. | Techniques for performing malware scanning of files stored within a file storage device of a computer network |
US7096500B2 (en) * | 2001-12-21 | 2006-08-22 | Mcafee, Inc. | Predictive malware scanning of internet data |
US7415726B2 (en) * | 2001-12-28 | 2008-08-19 | Mcafee, Inc. | Controlling access to suspicious files |
US7093121B2 (en) * | 2002-01-10 | 2006-08-15 | Mcafee, Inc. | Transferring data via a secure network connection |
JP3979285B2 (en) * | 2002-12-17 | 2007-09-19 | 株式会社日立製作所 | Information processing system |
US7257842B2 (en) * | 2003-07-21 | 2007-08-14 | Mcafee, Inc. | Pre-approval of computer files during a malware detection |
-
2003
- 2003-04-25 GB GB0309463A patent/GB2400932B/en not_active Expired - Fee Related
-
2004
- 2004-03-29 AU AU2004235515A patent/AU2004235515B2/en not_active Ceased
- 2004-03-29 WO PCT/GB2004/001333 patent/WO2004097602A2/en active Application Filing
- 2004-03-29 EP EP04724054A patent/EP1618447A2/en not_active Withdrawn
- 2004-03-29 US US10/500,957 patent/US20050080816A1/en not_active Abandoned
-
2005
- 2005-03-15 HK HK05102248A patent/HK1070708A1/en not_active IP Right Cessation
Patent Citations (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2002033525A2 (en) * | 2000-10-17 | 2002-04-25 | Chuang Shyne Song | A method and system for detecting rogue software |
GB2378015A (en) * | 2001-07-26 | 2003-01-29 | Networks Assoc Tech Inc | Detecting computer programs within packed computer files |
Cited By (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8418250B2 (en) | 2005-06-30 | 2013-04-09 | Prevx Limited | Methods and apparatus for dealing with malware |
EP2629231A2 (en) | 2005-06-30 | 2013-08-21 | Prevx Limited | Methods and apparatus for dealing with malware |
EP2629232A2 (en) | 2005-06-30 | 2013-08-21 | Prevx Limited | Methods and apparatus for dealing with malware |
US8726389B2 (en) | 2005-06-30 | 2014-05-13 | Prevx Limited | Methods and apparatus for dealing with malware |
US8763123B2 (en) | 2005-06-30 | 2014-06-24 | Prevx Limited | Methods and apparatus for dealing with malware |
US10803170B2 (en) | 2005-06-30 | 2020-10-13 | Webroot Inc. | Methods and apparatus for dealing with malware |
US11379582B2 (en) | 2005-06-30 | 2022-07-05 | Webroot Inc. | Methods and apparatus for malware threat research |
US8479174B2 (en) | 2006-04-05 | 2013-07-02 | Prevx Limited | Method, computer program and computer for analyzing an executable computer file |
US10574630B2 (en) | 2011-02-15 | 2020-02-25 | Webroot Inc. | Methods and apparatus for malware threat research |
CN102831049A (en) * | 2011-06-13 | 2012-12-19 | 腾讯科技(深圳)有限公司 | Method and system for detecting software |
Also Published As
Publication number | Publication date |
---|---|
AU2004235515B2 (en) | 2008-03-06 |
WO2004097602A3 (en) | 2005-05-12 |
GB2400932A (en) | 2004-10-27 |
GB2400932B (en) | 2005-12-14 |
HK1070708A1 (en) | 2005-06-24 |
EP1618447A2 (en) | 2006-01-25 |
US20050080816A1 (en) | 2005-04-14 |
AU2004235515A1 (en) | 2004-11-11 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
AU2004235515B2 (en) | A method of, and system for, heuristically determining that an unknown file is harmless by using traffic heuristics | |
US7664754B2 (en) | Method of, and system for, heuristically detecting viruses in executable code | |
US9992165B2 (en) | Detection of undesired computer files using digital certificates | |
US10699011B2 (en) | Efficient white listing of user-modifiable files | |
US6757830B1 (en) | Detecting unwanted properties in received email messages | |
US8572740B2 (en) | Method and system for detection of previously unknown malware | |
JP4708466B2 (en) | Method for interfering with sending or receiving unwanted electronic messages | |
US7343624B1 (en) | Managing infectious messages as identified by an attachment | |
JP5118020B2 (en) | Identifying threats in electronic messages | |
US20020004908A1 (en) | Electronic mail message anti-virus system and method | |
US8732825B2 (en) | Intelligent hashes for centralized malware detection | |
US9106694B2 (en) | Electronic message analysis for malware detection | |
US8359651B1 (en) | Discovering malicious locations in a public computer network | |
US20080201722A1 (en) | Method and System For Unsafe Content Tracking | |
US20090293103A1 (en) | Federating trust in a heterogeneous network | |
US8856931B2 (en) | Network browser system, method, and computer program product for scanning data for unwanted content and associated unwanted sites | |
US7539871B1 (en) | System and method for identifying message propagation | |
US20120069400A1 (en) | System, Method, and Computer Program Product for Conditionally Performing a Scan on Data Based on an Associated Data Structure | |
US8613092B2 (en) | System, method and computer program product for updating a security system definition database based on prioritized instances of known unwanted data | |
US20150180888A1 (en) | System, Method and Computer Program Product for Making a Scan Decision During Communication of Data Over a Network |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
WWE | Wipo information: entry into national phase |
Ref document number: 10500957 Country of ref document: US |
|
AK | Designated states |
Kind code of ref document: A2 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A2 Designated state(s): BW GH GM KE LS MW MZ SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
WWE | Wipo information: entry into national phase |
Ref document number: 2004724054 Country of ref document: EP |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2004235515 Country of ref document: AU |
|
ENP | Entry into the national phase |
Ref document number: 2004235515 Country of ref document: AU Date of ref document: 20040329 Kind code of ref document: A |
|
WWP | Wipo information: published in national office |
Ref document number: 2004235515 Country of ref document: AU |
|
WWP | Wipo information: published in national office |
Ref document number: 2004724054 Country of ref document: EP |