Tree pattern system and method for multiple virus signature recognition
View Patent ↗A system, method and computer program product are provided for recognizing virus signatures. Initially, a list of virus signatures is provided. Next, the list of virus signatures is combined into a tree of virus signatures. Data is subsequently compared against the tree of virus signatures for virus signature recognition.
1. A method for recognizing virus signatures, comprising
(a) identifying a list of virus signatures;
(b) combining the list of virus signatures into a tree of virus signatures; and
(c) comparing data against the tree of virus signatures for virus signature recognition;
wherein the virus signatures each include a sequence of characters;
wherein the tree includes a plurality of branches each including a sequence of characters;
wherein a portion of the branches corresponds to a plurality of the virus signatures;
wherein the efficiency of the virus signature recognition is improved by reducing an amount of virus signature data that is compared against the data;
wherein the branches include further sub-branches each corresponding to at least one virus signature;
wherein the branches include upper branch portions and lower branch portions;
wherein a pointer associated with a node of the tree is removed, if only one pointer exists, and an internal data structure includes a flag to indicate such removal.
2. The method as recited in claim 1 , wherein the characters include wildcards.
3. The method as recited in claim 1 , wherein the characters of the tree of virus signatures are obfuscated to prevent detection by the comparison.
4. The method as recited in claim 3 , wherein the obfuscation prevents accidental self-detection of the tree of virus signatures.
5. The method as recited in claim 4 , wherein the obfuscation is accomplished utilizing an exclusive-OR operation.
6. The method as recited in claim 1 , wherein the comparing includes comparing the data against the upper branch portions of the tree.
7. The method as recited in claim 6 , wherein the comparing further includes comparing the data against the lower branch portions of the tree if the data was successfully compared to the upper branch portions associated with the lower branch portions.
8. The method as recited in claim 7 , wherein a virus signature is determined to be recognized upon the successful comparison of the data against an entirety of at least one branch that includes all of the characters of one of the virus signatures.
9. The method as recited in claim 7 , wherein data is eligible to be declared clean upon the unsuccessful comparison of the data against an entirety of at least one branch that includes all of the characters of one of the virus signatures.
10. The method as recited in claim 1 , wherein pre-processing is performed prior to use of the tree of virus signatures.
11. The method as recited in claim 10 , wherein the pre-processing includes finding a correct location in a file where a virus resides, decryption, and emulation.
12. The method as recited in claim 1 , wherein the virus signature recognition is improved since comparison of similar portions of the virus signatures with the data more than once is avoided.
13. A computer program product embodied on a computer readable medium for recognizing virus signatures, comprising
(a) computer code for identifying a list of virus signatures;
(b) computer code for combining the list of virus signatures into a tree of virus signatures; and
(c) computer code for comparing data against the tree of virus signatures for virus signature recognition;
wherein the virus signatures each include a sequence of characters;
wherein the tree includes a plurality of branches each including a sequence of characters;
wherein a portion of the branches corresponds to a plurality of the virus signatures;
wherein the efficiency of the virus signature recognition is improved by reducing an amount of virus signature data that is compared against the data;
wherein the branches include further sub-branches each corresponding to at least one virus signature;
wherein the branches include upper branch portions and lower branch portions;
wherein a pointer associated with a node of the tree is removed, if only one pointer exists, and an internal data structure includes a flag to indicate such removal.
14. The computer program product as recited in claim 13 , wherein the characters include wildcards.
15. The computer program product as recited in claim 13 , wherein the characters of the tree of virus signatures are obfuscated to prevent detection by the comparison.
16. The computer program product as recited in claim 13 , wherein the comparing includes comparing the data against the upper branch portions of the tree.
17. The computer program product as recited in claim 16 , wherein the comparing further includes comparing the data against the lower branch portions of the tree if the data was successfully compared to the upper branch portions associated with the lower branch portions.
18. The computer program product as recited in claim 17 , wherein a virus signature is determined to be recognized upon the successful comparison of the data against an entirety of at least one branch that includes all of the characters of one of the virus signatures.
19. The computer program product as recited in claim 17 , wherein data is eligible to be declared clean upon the unsuccessful comparison of the data against an entirety of at least one branch that includes all of the characters of one of the virus signatures.
20. A system for recognizing virus signatures, comprising
(a) logic for identifying a list of virus signatures;
(b) logic for combining the list of virus signatures into a tree of virus signatures; and
(c) logic for comparing data against the tree of virus signatures for virus signature recognition;
wherein the virus signatures each include a sequence of characters;
wherein the tree includes a plurality of branches each including a sequence of characters;
wherein a portion of the branches corresponds to a plurality of the virus signatures;
wherein the efficiency of the virus signature recognition is improved by reducing an amount of virus signature data that is compared against the data;
wherein the branches include further sub-branches each corresponding to at least one virus signature;
wherein the branches include upper branch portions and lower branch portions;
wherein a pointer associated with a node of the tree is removed if only one pointer exists, and an internal data structure includes a flag to indicate such removal.
21. A method for recognizing virus signatures with improved efficiency, comprising
(a) identifying a list of virus signatures each including a sequence of characters;
(b) combining the list of virus signatures into a tree of virus signatures including a plurality of branches each including a sequence of characters, wherein at least a portion of the branches includes upper branch portions and lower branch portions;
(c) obfuscating the sequence of characters in the tree of virus signatures;
(d) comparing the data against the upper branch portions of the tree;
(e) comparing the data against the lower branch portions of the tree if the data was successfully compared to the upper branch portions associated with the lower branch portions;
(f) declaring a virus signature to be recognized upon the successful comparison of the data against an entirety of at least one branch of the tree that includes all of the characters of one of the virus signatures; and
(g) determining that the data is eligible to be declared clean upon the unsuccessful comparison of the data against an entirety of at least one branch of the tree that includes all of the characters of one of the virus signatures;
wherein a portion of the branches corresponds to a plurality of the virus signatures;
wherein the efficiency of the virus signature recognition is improved by reducing an amount of virus signature data that is compared against the data;
wherein the branches include further sub-branches each corresponding to at least one virus signature;
wherein a pointer associated with a node of the tree is removed, if only one pointer exists, and an internal data structure includes a flag to indicate such removal.