Identifying malware containing computer files using embedded text
View Patent ↗A computer file may be scanned for suspicious words 18 occurring within suspicious contexts 20. Thus, messages embedded by malware authors within their malware may be detected. The detection of such embedded messages may be used to identify otherwise unknown items of malware or as a pre-filtering technique for controlling the use of further scanning techniques.
1. A computer program product embodied on a tangible computer readable medium operable for controlling a computer to identify a computer file as potentially containing malware, said computer program product comprising:
searching code operable to search within said computer file for text data containing one or more target words that match at least one of a word or a characteristic of a word within a predetermined word library;
context identifying code operable to identify a context within said computer file of said one or more target words; and
file identifying code operable if said context matches one of a predetermined set of contexts to identify said computer file as potentially containing malware;
wherein only those portions of said computer file matching said predetermined set of contexts are searched for said target words;
wherein said computer file includes a web page, such that a comments portion and a scripts portion of said web page which match said predetermined set of contexts are searched for said target words, and a hypertext transfer protocol text portion and a formatting commands portion of said web page which do not match said predetermined set of contexts are not searched for said target words.
2. A computer program product as claimed in claim 1 , wherein said predetermined word library includes one or more of:
words that are names associated with known malware authors;
words that are indicative of being part of a message embedded within said computer file by a malware author;
word format characteristics that are indicative of words being part of a message embedded within said computer file by a malware author; and
word suffix characteristics that are indicative of words being part of a message embedded within said computer file by a malware author.
3. A computer program product as claimed in claim 1 , wherein said predetermined sets of contexts includes one or more of:
within a script portion of the web page;
within a comment of the web page;
within executable code; and
within a predetermined proximity to another target word.
4. A computer program product as claimed in claim 1 , wherein, if said computer file is identified as potentially containing malware, then malware found code triggers one or more malware found actions.
5. A computer program product as claimed in claim 4 , wherein said malware found actions include one or more of:
quarantining said computer file;
deleting said computer file;
issuing a warning message concerning said computer file; and
deleting a portion of said computer file suspect of containing malware.
6. A computer program product as claimed in claim 1 , wherein, if said computer file is identified as potentially containing malware, then trigger thresholds associated with one or more other malware identifying processes applied to said computer file are adjusted to be more sensitive.
7. A computer program product as claimed in claim 1 , wherein if said computer file is identified as potentially containing malware, then a trigger threshold associated with a heuristic malware identifying process applied to said computer file is set to a more sensitive level.
8. A computer program product as claimed in claim 1 , wherein said malware comprises one or more of a computer virus, a worm and a Trojan.
9. A method of identifying a computer file as potentially containing malware, said method comprising the step of:
searching within said computer file for text data containing one or more target words that match at least one of a word or a characteristic of a word within a predetermined word library;
identifying a context within said computer file of said one or more target words; and
if said context matches one of a predetermined set of contexts, then identifying said computer file as potentially containing malware;
wherein only those portions of said computer file matching said predetermined set of contexts are searched for said target words;
wherein said computer file includes a web page, such that a comments portion and a scripts portion of said web page which match said predetermined set of contexts are searched for said target words, and a hypertext transfer protocol text portion and a formatting commands portion of said web page which do not match said predetermined set of contexts are not searched for said target words.
10. A method as claimed in claim 9 , wherein said predetermined word library includes one or more of:
words that are names associated with known malware authors;
words that are indicative of being part of a message embedded within said computer file by a malware author;
word format characteristics that are indicative of words being part of a message embedded within said computer file by a malware author; and
word suffix characteristics that are indicative of words being part of a message embedded within said computer file by a malware author.
11. A method as claimed in claim 9 , wherein said predetermined sets of contexts includes one or more of:
within a script portion of the web page;
within a comment of the web page;
within executable code; and
within a predetermined proximity to another target word.
12. A method as claimed in claim 9 , wherein, if said computer file is identified as potentially containing malware, then one or more malware found actions are triggered.
13. A method as claimed in claim 12 , wherein said malware found actions include one or more of:
quarantining said computer file;
deleting said computer file;
issuing a warning message concerning said computer file; and
deleting a portion of said computer file suspect of containing malware.
14. A method as claimed in claim 9 , wherein, if said computer file is identified as potentially containing malware, then trigger thresholds associated with one or more other malware identifying processes applied to said computer file are adjusted to be more sensitive.
15. A method as claimed in claim 9 , wherein if said computer file is identified as potentially containing malware, then a trigger threshold associated with a heuristic malware identifying process applied to said computer file is set to a more sensitive level.
16. Apparatus including a tangible computer readable medium, for identifying a computer file as potentially containing malware, said apparatus comprising:
searching logic operable to search within said computer file for text data containing one or more target words that match at least one of a word or a characteristic of a word within a predetermined word library;
context identifying logic operable to identify a context within said computer file of said one or more target words; and
file identifying logic operable if said context matches one of a predetermined set of contexts to identify said computer file as potentially containing malware;
wherein only those portions of said computer file matching said predetermined set of contexts are searched for said target words;
wherein said computer file includes a web page, such that a comments portion and a scripts portion of said web page which match said predetermined set of contexts are searched for said target words, and a hypertext transfer protocol text portion and a formatting commands portion of said web page which do not match said predetermined set of contexts are not searched for said target words.
17. A computer program product as claimed in claim 1 , wherein said predetermined sets of contexts includes a script portion of a webpage.
18. A computer program product as claimed in claim 1 , wherein said predetermined sets of contexts includes a comment of a webpage.
19. A computer program product as claimed in claim 1 , wherein said predetermined sets of contexts includes executable code.
20. A computer program product as claimed in claim 1 , wherein said predetermined sets of contexts includes a predetermined proximity to another target word.
21. A computer program product as claimed in claim 1 , wherein said predetermined sets of contexts includes:
within a script portion of a webpage;
within a comment of a webpage;
within executable code; and
within a predetermined proximity to another target word.