Detecting a trojan horse
View Patent ↗A method and apparatus for detecting a Trojan horse in a suspicious version of a software application in the form of at least one electronic file. A computer device determines a source from which the suspicious version of the software application was obtained. A comparison is then made between the source from which the suspicious version of the software application was obtained and a source from which an original, clean version of the software application was obtained. If the sources differ, then it is determined that the suspicious version of the software application is more likely to contain a Trojan horse than if the sources were the same.
1. A method of detecting a Trojan horse in a suspicious version of a software application in the form of at least one electronic file, the method comprising:
at a computer device, determining a source from which the suspicious version of the software application was obtained;
comparing the source from which the suspicious version of the software application was obtained with a source associated with an identity of a vendor from which an original, clean version of the software application was obtained; and
in the event that the sources differ, determining that the suspicious version of the software application is likely to contain a Trojan horse.
2. The method according to claim 1 , further comprising making a comparison between the suspicious version of the software application and the original, clean version of the software application of any of version numbers, version histories, application classes, size of code blocks, imported Application Programming Interfaces, Application Programming Interface functions called, file size of components of the software application, and capabilities and access controls indicating Application Programming Interface functions that the software application wishes to be able to access.
3. The method according to claim 1 , wherein the source from which the original, clean version of the software application was obtained and further metadata relating to the original, clean version of the software application is stored at a database.
4. The method according to claim 1 , further comprising sending a message from a computer device to a remote server, the message including any of the suspicious version of the software application and metadata relating to the suspicious version of the software application such that the remote server can perform the comparison.
5. The method according to claim 4 , further comprising at the computer device, receiving a response message from the remote server, the response message including an indication that the suspicious software application is likely to contain a Trojan horse.
6. The method according to claim 1 , further comprising, at the computer device, sending a message to a remote database, the message including at least an identity of the suspicious software application; and
receiving from the remote database a response, the response including the source from which the original, clean version of the software application was obtained.
7. A device for use in a communication network, the device comprising:
a processor for determining that a version of a software application in the form of at least one electronic file is suspicious;
the processor being further arranged to determine a source of the suspicious version of the software application;
the processor being further arranged to compare the source from which the suspicious version of the software application was obtained with a source associated with an identity of a vendor from which an original, clean version of the software application was obtained and, in the event that the sources differ, determine that the suspicious version of the software application is likely to contain a Trojan horse.
8. The device according to claim 7 , further comprising:
a transmitter for sending to one of a server and a database a request message, the request message including a request for the source from which the original, clean version of the software application was obtained; and
a receiver for receiving a response, the response including the source from which the original, clean version of the software application was obtained.
9. The device according to claim 7 , wherein the processor is further arranged to make a comparison between the suspicious version of the software application and the original, clean version of the software application of any of version numbers, version histories, application classes, size of code blocks, imported Application Programming Interfaces, Application Programming Interface functions called, file size of components of the software application, and capabilities and access controls indicating Application Programming Interface functions that the software application wishes to be able to access.
10. The device according to claim 7 , further comprising a database for storing data relating to the source from which the original, clean version of the software application was obtained and further metadata relating to the original, clean version of the software application.
11. A non-transitory computer readable medium comprising a computer program, the computer program comprising computer readable code which, when run on a device, causes the device to behave as a device as claimed in claim 7 .
12. A non-transitory computer readable medium comprising a computer program product and a computer program according to claim 11 , wherein the computer program is stored on the non-transitory computer readable medium.
13. A device for use in a communication network, the device comprising:
a processor for determining that a version of a software application in the form of at least one electronic file is suspicious;
a transmitter for sending a request message to a remote server, the request message including at least an identity of a source from which the suspicious version of the software application was obtained;
a receiver for receiving a response from the remote server, the response including an indication of whether the suspicious version of the software application is likely to contain a Trojan horse, the likelihood having been determined at least by the remote server comparing the source from which the suspicious version of the software application was obtained with a source associated with an identity of a vendor from which an original, clean version of the software application was obtained and, in the event that the sources differ, determining that the suspicious version of the software application is likely to contain a Trojan horse.
14. A server for use in a communication network, the server comprising:
a receiver for receiving from a remote device a request message, the request message including at least an identify of a source from which a suspicious version of a software application in the form of at least one electronic file has been obtained;
a processor for comparing the source from which the suspicious version of the software application was obtained with a source associated with an identity of a vendor from which an original, clean version of the software application was obtained and, in the event that the sources differ, determining that the suspicious version of the software application is likely to contain a Trojan horse;
a transmitter for sending a response message, the response message including one of a result of the comparison and an indication that the suspicious version of the software application is likely to contain a Trojan horse.
15. The server according to claim 14 , further comprising a database for storing the source from which the original, clean version of the software application was obtained and further metadata relating to the original, clean version of the software application.
16. The server according to claim 14 , wherein the processor is further arranged to make a comparison between the suspicious version of the software application and the original, clean version of the software application of any of version numbers, version histories, application classes, size of code blocks, imported Application Programming Interfaces, Application Programming Interface functions called, file size of components of the software application, and capabilities and access controls indicating Application Programming Interface functions that the software application wishes to be able to access.
17. A non-transitory computer readable medium comprising a computer program, the computer program comprising computer readable code which, when run on a server, causes the server to behave as a server as claimed in claim 14 .
18. A non-transitory computer readable medium comprising a computer program product comprising a computer program according to claim 17 , wherein the computer program is stored on the non-transitory computer readable medium.