System, method, and computer program product for detecting unwanted data based on an analysis of an icon
View Patent ↗A system, method, and computer program product are provided for detecting unwanted data based on an analysis of an icon. In use, an icon is analyzed. Furthermore, unwanted data is detected based on the analysis.
1. A non-transitory computer program storage device, with instructions stored thereon, comprising instructions that when executed cause one or more processors to:
detect selection of an icon, the selection utilized to initiate execution of an application associated with the icon;
analyze properties of the icon in response to the detection;
compare the properties of the icon with a list of properties of known icons to identify a matching icon;
determine that the application is malware, responsive to a determination that the application does not contain multiple icons;
determine that the icon represents malware responsive to a determination that the icon matches an icon known not to represent malware and the determination that the application is malware.
2. The computer program storage device of claim 1 , wherein the instructions that when executed cause the one or more processors to analyze properties of the icon comprise instructions that when executed cause the one or more processors to generate a hash of the icon.
3. The computer program storage device of claim 2 ,
wherein the list of properties of known icons comprises a white list, and
wherein the instructions that when executed cause the one or more processors to compare the properties of the icon with the list of properties of known icons comprise instructions that when executed cause the one or more processors to compare the hash with the white list.
4. The computer program storage device of claim 2 ,
wherein the list of properties of known icons comprises a black list, and
wherein the instructions that when executed cause the one or more processors to compare the properties of the icon with the list of properties of known icons comprise instructions that when executed cause the one or more processors to compare the hash with the black list.
5. The computer program storage device of claim 1 , wherein the instructions that when executed cause the one or more processors to analyze properties of the icon comprise instructions that when executed cause the one or more processors to determine whether the icon is included in a packed file.
6. The computer program storage device of claim 1 , wherein the instructions that when executed cause the one or more processors to analyze properties of the icon comprise instructions that when executed cause the one or more processors to use a heuristic analysis of at least one aspect associated with the icon.
7. The computer program storage device of claim 6 , wherein the at least one aspect includes a file in which the icon resides.
8. The computer program storage device of claim 6 , wherein the at least one aspect includes version information corresponding with the application.
9. The computer program storage device of claim 6 , wherein the at least one aspect includes a programming language in which the application is written.
10. The computer program storage device of claim 1 , wherein the instructions that when executed cause the one or more processors to analyze properties of the icon comprise instructions that when executed cause the one or more processors to analyze pixels used to render the icon.
11. The computer program storage device of claim 1 , wherein the instructions that when executed cause the one or more processors to analyze properties of the icon comprise instructions that when executed cause the one or more processors to use image recognition involving the icon.
12. The computer program storage device of claim 1 , wherein the instructions further comprise instructions that when executed cause the one or more processors to react in response to the detection of the malware.
13. The computer program storage device of claim 12 , wherein the instructions that when executed cause the one or more processors to react in response to the detection of the malware comprise instructions that when executed cause the one or more processors to remove the application from a system on which the application is stored.
14. A method, comprising:
detecting, with a processor, selection of an icon, the selection utilized to initiate execution of an application associated with the icon;
analyzing properties of the icon with the processor in response to the act of detecting;
comparing, with the processor, the properties of the icon with a list of properties of known icons to identify a matching icon;
determining that the application is malware, comprising:
determining that the application does not contain multiple icons; and
determining that the icon represents malware, comprising:
determining that the icon matches an icon known not to represent malware and the determination that the application is malware.
15. The method of claim 14 , wherein analyzing properties of the icon comprises generating a hash of the icon.
16. The method of claim 15 ,
wherein the list of properties of known icons comprises a white list, and
wherein comparing the properties of the icon with the list of properties of known icons comprises comparing the hash with the white list.
17. The method of claim 14 , wherein analyzing properties of the icon comprises performing a heuristic analysis of at least one aspect associated with the icon.
18. A system comprising:
a memory; and
a hardware processor operatively coupled to the memory, the processor adapted to execute program code stored in the memory, comprising instructions that when executed cause the processor to:
detect a selection of an icon, the selection utilized to initiate execution of an application associated with the icon,
analyze properties of the icon in response to the detection,
compare the properties of the icon with a list of properties of known icons to identify a matching icon,
determine that the application is malware, responsive to a determination that the application does not contain multiple icons; and
determine that the icon represents malware responsive to a determination that the icon matches an icon known not to represent malware and the determination that the application is malware.