Identifying malware containing computer files using embedded text
View Patent ↗A computer file may be scanned for suspicious words 18 occurring within suspicious contexts 20 . Thus, messages embedded by malware authors within their malware may be detected. The detection of such embedded messages may be used to identify otherwise unknown items of malware or as a pre-filtering technique for controlling the use of further scanning techniques.
1. A computer program product embodied on a computer readable medium for controlling a computer to identify a computer file as potentially containing malware, said computer program product comprising:
searching code to search within said computer file for text data containing one or more target words that match at least one of a word or a characteristic of a word within a predetermined word library;
context identifying code to identify a context within said computer file of said one or more target words; and
file identifying code to identify said computer file as potentially containing malware, if said context matches one or a predetermined set of contexts;
wherein said predetermined word library includes one or more of:
words that are names associated with known malware authors;
word format characteristics that are indicative of words being part of a message embedded within said computer file by a malware author; and
word suffix characteristics that are indicative of words being part of a message embedded within said computer file by a malware author;
wherein said predetermined set of contexts includes one or more of:
within a script portion of a webpage;
within a comment of a webpage; and
within a predetermined proximity to another target word;
wherein, if said computer file is identified as potentially containing malware, then trigger thresholds associated with one or more other malware identifying processes applied to said computer file are adjusted to be more sensitive.
2. A computer program product as claimed in claim 1 , wherein, as a result of the one or more other malware identifying processes, identified malware is acted upon with one or more malware found actions.
3. A computer program product as claimed in claim 2 , wherein said malware found actions include one or more of:
quarantining said computer file;
deleting said computer file;
issuing a warning message concerning said computer file; and
deleting a portion of said computer file suspect of containing malware.
4. A computer program product as claimed in claim 1 , wherein if said computer file is identified as potentially containing malware, then a trigger threshold associated with a heuristic malware identifying process applied to said computer file is set to a more sensitive level.
5. A computer program product as claimed in claim 1 , wherein all of said computer file is searched for said target words.
6. A computer program product as claimed in claim 1 , wherein only those portions of said computer file matching said predetermined set of contexts are searched for said target words.
7. A computer program product as claimed in claim 1 , wherein said malware comprises one or more of a computer virus, a worm and a Trojan.
8. A method of identifying a computer file as potentially containing malware, said method comprising the step of:
searching within said computer file for text data containing one or more target words that match at least one of a word or a characteristic of a word within a predetermined word library;
identifying a context within said computer file of said one or more target words; and
if said context matches one or a predetermined set of contexts, then identifying said computer file as potentially containing malware;
wherein said predetermined word library includes one or more of:
words that are names associated with known malware authors;
word format characteristics that are indicative of words being part of a message embedded within said computer file by a malware author; and
word suffix characteristics that are indicative of words being part of a message embedded within said computer file by a malware author;
wherein said predetermined set of contexts includes one or more of:
within a script portion of a webpage;
within a comment of a webpage; and
within a predetermined proximity to another target word;
wherein, if said computer file is identified as potentially containing malware, then trigger thresholds associated with one or more other malware identifying processes applied to said computer file are adjusted to be more sensitive.
9. A method as claimed in claim 8 , wherein, as a result of the one or more other malware identifying processes, identified malware is acted upon with one or more malware found actions.
10. A method as claimed in claim 9 , wherein said malware found actions include one or more of:
quarantining said computer file;
deleting said computer file;
issuing a warning message concerning said computer file; and
deleting a portion of said computer file suspect of containing malware.
11. A method as claimed in claim 8 , wherein if said computer file is identified as potentially containing malware, then a trigger threshold associated with a heuristic malware identifying process applied to said computer file is set to a more sensitive level.
12. A method as claimed in claim 8 , wherein all of said computer file is searched for said target words.
13. A method as claimed in claim 8 , wherein only those portions of said computer file matching said predetermined set of contexts are searched for said target words.
14. A method as claimed in claim 8 , wherein said malware comprises one or more of a computer virus, a worm and a Trojan.
15. Apparatus including a program embodied on a computer readable medium for identifying a computer file as potentially containing malware, said apparatus comprising:
searching logic to search within said computer file for text data containing one or more target words that match at least one of a word or a characteristic of a word within a predetermined word library;
context identifying logic to identify a context within said computer file of said one or more target words; and
file identifying logic to identify said computer file as potentially containing malware, if said context matches one or a predetermined set of contexts;
wherein said predetermined word library includes one or more of:
words that are names associated with known malware authors;
word format characteristics that are indicative of words being part of a message embedded within said computer file by a malware author; and
word suffix characteristics that are indicative of words being part of a message embedded within said computer file by a malware author;
wherein said predetermined set of contexts includes one or more of:
within a script portion of a webpage;
within a comment of a webpage; and
within a predetermined proximity to another target word;
wherein, if said computer file is identified as potentially containing malware, then trigger thresholds associated with one or more other malware identifying processes applied to said computer file are adjusted to be more sensitive.
16. Apparatus as claimed in claim 15 , wherein, as a result of the one or more other malware identifying processes, identified malware is acted upon with one or more malware found actions.
17. Apparatus as claimed in claim 16 , wherein said malware found actions include one or more of:
quarantining said computer file;
deleting said computer file;
issuing a warning message concerning said computer file; and
deleting a portion of said computer file suspect of containing malware.
18. Apparatus as claimed in claim 15 , wherein if said computer file is identified as potentially containing malware, then a trigger threshold associated with a heuristic malware identifying process applied to said computer file is set to a more sensitive level.
19. Apparatus as claimed in claim 15 , wherein all of said computer file is searched for said target words.
20. Apparatus as claimed in claim 15 , wherein only those portions of said computer file matching said predetermined set of contexts are searched for said target words.
21. Apparatus as claimed in claim 15 , wherein said malware comprises one or more of a computer virus, a worm and a Trojan.
22. A computer program product as claimed in claim 1 , wherein said predetermined word library includes: words that are names associated with known malware authors; words that are indicative of being part of a message embedded within said computer file by a malware author; word format characteristics that are indicative of words being part of a message embedded within said computer file by a malware author; and word suffix characteristics that are indicative of words being part of a message embedded within said computer file by a malware author.
23. A computer program product as claimed in claim 1 , wherein said predetermined set of contexts includes: within a script portion of a webpage; within a comment of a webpage; within executable code; and within a predetermined proximity to another target word.
24. A computer program product embodied on a computer readable medium for controlling a computer to identify a computer file as potentially containing malware, said computer program product comprising:
searching code to search within said computer file for text data containing one or more target words that match at least one of a word or a characteristic of a word within a predetermined word library, wherein said target words include a phonetic equivalent thereof such that said searching code further searches within said computer file for text data containing one or more phonetic equivalents of said target words that match a phonetic equivalent of a word within said predetermined word library;
context identifying code to identify a context within said computer file of said one or more target words;
context identifying code to identify a context within said computer file of said one or more target words; and
file identifying code to identify said computer file as potentially containing malware, if said context matches one or a predetermined set of contexts;
wherein said predetermined word library includes one or more of:
words that are names associated with known malware authors;
word format characteristics that are indicative of words being part of a message embedded within said computer file by a malware author; and
word suffix characteristics that are indicative of words being part of a message embedded within said computer file by a malware author;
wherein said predetermined set of contexts includes one or more of:
within a script portion of a webpage;
within a comment of a webpage; and
within a predetermined proximity to another target word.
25. A computer program product as claimed in claim 1 , wherein said computer file identified as potentially containing malware is prevented from being transmitted outward from a mail server and is further analyzed when being transmitted inward to said mail server.
26. A computer program product as claimed in claim 4 , wherein said heuristic malware identifying process is set to a more sensitive level by reducing a suspicious activities score required to trigger identification of said computer file as containing malware.
27. A computer program product embodied on a computer readable medium for controlling a computer to identify a computer file as potentially containing malware, said computer program product comprising:
searching code to search within said computer file for text data containing one or more target words that match at least one of a word or a characteristic of a word within a predetermined word library;
context identifying code to identify a context within said computer file of said one or more target words; and
file identifying code to identify said computer file as potentially containing malware, if said context matches one or a predetermined set of contexts;
wherein said predetermined word library includes one or more of:
words that are names associated with known malware authors;
word format characteristics that are indicative of words being part of a message embedded within said computer file by a malware author; and
word suffix characteristics that are indicative of words being part of a message embedded within said computer file by a malware author;
wherein said predetermined set of contexts includes one or more of:
within a script portion of a webpage;
within a comment of a webpage; and
within a predetermined proximity to another target word;
wherein if said computer file is identified as potentially containing malware, then a trigger threshold associated with a heuristic malware identifying process applied to said computer file is set to a more sensitive level.
28. A method of identifying a computer file as potentially containing malware, said method comprising the step of:
searching within said computer file for text data containing one or more target words that match at least one of a word or a characteristic of a word within a predetermined word library;
identifying a context within said computer file of said one or more target words; and
if said context matches one or a predetermined set of contexts, then identifying said computer file as potentially containing malware;
wherein said predetermined word library includes one or more of:
words that are names associated wit known malware authors;
word format characteristics that are indicative of words being part of a message embedded within said computer file by a malware author; and
word suffix characteristics that are indicative of words being part of a message embedded within said computer file by a malware author;
wherein said predetermined set of contexts includes one or more of:
within a script portion of a webpage;
within a comment of a webpage; and
within a predetermined proximity to another target word;
wherein if said computer file is identified as potentially containing malware, then a trigger threshold associated with a heuristic malware identifying process applied to said computer file is set to a more sensitive level.
29. Apparatus including a program embodied on a computer readable medium for identifying a computer file as potentially containing malware, said apparatus comprising:
searching logic to search within said computer file for text data containing one or more target words that match at least one of a word or a characteristic of a word within a predetermined word library;
context identifying logic to identify a context within said computer file of said one or more target words; and
file identifying logic to identify said computer file as potentially containing malware, if said context matches one or a predetermined set of contexts;
wherein said predetermined word library includes one or more of:
words that are names associated with known malware authors;
word format characteristics that are indicative of words being part of a message embedded within said computer file by a malware author; and
word suffix characteristics that are indicative of words being part of a message embedded within said computer file by a malware author;
wherein said predetermined set of contexts includes one or more of:
within a script portion of a webpage;
within a comment of a webpage; and
within a predetermined proximity to another target word;
wherein if said computer file is identified as potentially containing malware, then a trigger threshold associated with a heuristic malware identifying process applied to said computer file is set to a more sensitive level.