Malware determination
View Patent ↗A method for determining whether an electronic file stored at a client device is infected with malware. A server receives from the client device a request message that includes signature information of the electronic file. The server queries a database of signature information. If the signature information corresponds to signature information stored on the database, a determination is made as to whether the electronic file is malware. If the signature information does not correspond to signature information stored on the database, a determination is made as to whether a number of further request messages for the electronic file are received from additional client devices within a time period. If fewer request messages are received within the time period, it is likely that the electronic file is malware.
1. A method of making a determination of whether an electronic file stored at a client device is malware, the method comprising:
receiving at a server from the client device a request message comprising signature information of the electronic file;
querying a database storing signature information of a multiplicity of electronic files;
if the signature information of the electronic file corresponds to signature information stored on the database, determining whether the electronic file is malware,
in the event that the signature information of the electronic file does not correspond to signature information stored on the database, determining whether a predetermined number of further request messages relating to the electronic file are received from further client devices within a predetermined time period, and in the event that fewer than the predetermined number of further request messages are received within the predetermined time period, determining that the electronic file is likely to be malware, and in the event that more than the predetermined number of further request messages are received within the predetermined time period, determining that the electronic file is not likely to be malware; and
sending the result of the determination to the client device.
2. The method according to claim 1 , further comprising: in the event that fewer than the predetermined number of further requests are received within the predetermined time period, performing further malware checks.
3. The method according to claim 1 , further comprising:
sending to the client device a request for the client device to send the file to a verification server for verification that the electronic file is not malware.
4. The method according to claim 1 , wherein the signature information of the multiplicity of electronic files stored at the database includes signature information of clean copies of electronic files; and
if the signature information relating to the electronic file corresponds to signature information of a clean copy of an electronic file stored at the database, determining that the electronic file is not malware.
5. The method according to claim 1 , wherein the signature information of the multiplicity of electronic files stored at the database includes signature information of known malware; and
if the signature information relating to the electronic file corresponds to signature information of known malware stored at the database, determining that the electronic file is malware.
6. A computer program stored on a non-transitory computer readable medium, comprising computer readable code configured to, when run on a server, cause the server to perform the method of claim 1 .
7. A server for use in a communication network, the server comprising:
a hardware receiver for receiving from a client device a request message, the request message including information relating to an electronic file;
a processor for querying a database storing signature information of a multiplicity of electronic files, the processor being arranged to determine if the signature information of the electronic file corresponds to signature information stored on the database, and in the event that such a determination is made, determining whether the electronic file is malware, and if is determined that signature information relating to the electronic file does not correspond to signature information stored on the database, determining whether a predetermined number of further request messages relating to the electronic file are received from further client devices within a predetermined time period, and in the event that fewer than the predetermined number of further request messages are received within a predetermined time period, determining that the electronic file is likely to be malware, and in the event that more than the predetermined number of further request messages are received within the predetermined time period, determining that the electronic file is not likely to be malware.
8. The server according to claim 7 , further comprising a transmitter for sending the result of the determination to the client device.
9. The server according to claim 7 , wherein the processor is further arranged to, in the event that fewer than a predetermined number of further requests are received within a predetermined time period, perform further malware checks.
10. The server according to claim 7 , wherein the signature information of the multiplicity of electronic files stored at the database includes signature information of clean copies of electronic files; and
the processor is arranged to, in event that the signature information relating to the electronic file corresponds to signature information of a clean copy of an electronic file stored at the database, determine that the electronic file is not malware.
11. The server according to claim 7 , wherein the signature information of the multiplicity of electronic files stored at the database includes signature information of known malware; and
the processor is arranged to, in event that the signature information relating to the electronic file corresponds to signature information of known malware stored at the database, determine that the electronic file is malware.