Granted Patent B1

US 8,590,039 · App. 11/946,777 · Granted Nov 19, 2013

Abstract

Claims (31)

1. A method, comprising:

extracting, at a client device, information from a portion of a sample of potentially unwanted data;

determining an extraction tag as a unique identifier with which to tag the extracted information the extraction tag indicating of extraction used to extract the extracted information;

sending the information and the extraction tag to a server device to generate a signature, wherein generation of the signature at the server device utilizes the extraction tag and the extracted information to generate a signature for the extracted information; and

receiving the signature at the client device.

2. The method of claim 1 , wherein the unwanted data includes malware represented by a file on a storage media.

3. The method of claim 1 , wherein the sample of potentially unwanted data includes a memory image.

4. The method of claim 1 , wherein the sample of potentially unwanted data includes a network packet.

5. The method of claim 1 , further comprising detecting the potentially unwanted data utilizing a computer security system.

6. The method of claim 5 , wherein the computer security system detects the potentially unwanted data based on heuristics.

7. The method of claim 1 , wherein the portion of the sample is determined based on a type of an operating environment associated with the potentially unwanted data.

8. The method of claim 1 , wherein the portion of the sample is determined based on a type of an object in which the potentially unwanted data is located.

9. The method of claim 8 , wherein the type of the object includes one of a text file, a script, a macro, a uniform resource locator, and an application.

10. The method of claim 1 , wherein the portion of the sample is determined based on a predetermined offset.

11. The method of claim 1 , wherein the information is extracted based on a rule that is at least one of accessible and interpretable by a system to which the information is sent.

12. The method of claim 1 , wherein the information includes a string included in the portion of the sample.

13. The method of claim 12 , wherein the information includes a hash of the portion of the sample.

14. The method of claim 1 , further comprising receiving the signature generated utilizing the information.

15. The method of claim 14 , further comprising verifying the signature utilizing the sample.

16. A non-transitory computer readable medium comprising executable instructions stored thereon to cause a programmable processor to:

extract, at a client device, information from a portion of a sample of potentially unwanted data;

determine an extraction tag as a unique identifier with which to tag the extracted information, the extraction tag indicating a type of extraction used to extract the extracted information;

send the information and the extraction tag to a server device to generate a signature, wherein generation of the signature at the server device utilizes the extraction tad and the extracted information to generate a signature for the extracted information; and

receive the signature at the client device.

17. A client device communicatively coupled to one or more server devices, the client device comprising:

a processor; and

a memory communicatively coupled to the processor wherein the memory stores executable instructions to cause the processor to:

extract, at the client device, information from a portion of a sample of potentially unwanted data;

determine an extraction tag as a unique identifier with which to tag the extracted information, the extraction tag indicating a type of extraction used to extract the extracted information;

send the information and the extraction tag to a server device to generate a signature, wherein generation of the signature at the server device utilizes the extraction tag and the extracted information to generate a signature for the extracted information; and

receive the signature at the client device.

Assignments (9)