Detecting malware using patterns
View Patent ↗In certain embodiments, a method includes receiving a first file. The method also includes accessing at least one storage module comprising a first malware pattern, a second malware pattern, and a third malware pattern. The second malware pattern is a first permutation of the first malware pattern. The third malware pattern is a second permutation of the second malware pattern and is different than the second malware pattern. The method includes comparing, by at least one processor, the first file to the third malware pattern. In addition, the method includes determining, by the at least one processor, that the first file comprises malware in response to comparing the file to the third malware pattern.
1. A method comprising:
receiving a first file;
accessing at least one storage module comprising a first malware pattern, a second malware pattern, and a third malware pattern, the second malware pattern being a first permutation of the first malware pattern, the third malware pattern being a second permutation of the second malware pattern and different than the second malware pattern, wherein one or more of the first permutation and the second permutation comprises a bit rotation;
comparing, by at least one processor, the first file to the third malware pattern; and
determining, by the at least one processor, that the first file comprises malware in response to comparing the file to the third malware pattern.
2. The method of claim 1 , wherein one or more of the first permutation and the second permutation comprises a bit-level XOR operation.
3. The method of claim 1 , wherein the first malware pattern is a malware payload.
4. The method of claim 1 , wherein the first malware pattern comprises a malware payload and shellcode.
5. The method of claim 1 , further comprising:
receiving a second file;
determining whether the second file comprises information regarding an internal resource; and
determining that the second file comprises malware based on determining that the second file comprises the information regarding the internal resource.
6. The method of claim 5 , wherein the information regarding an internal resource comprises an address of a proxy.
7. The method of claim 1 , further comprising storing the second malware pattern and the third malware pattern prior to receiving the first file.
8. A system comprising:
at least one storage module storing a first malware pattern, a second malware pattern, and a third malware pattern, the second malware pattern being a first permutation of the first malware pattern, the third malware pattern being a second permutation of the second malware pattern and being different than the second malware pattern, wherein one or more of the first permutation and the second permutation comprises a bit rotation; and
one or more processors configured to:
receive a first file;
compare the first file to the third malware pattern; and
determine that the first file comprises malware in response to comparing the file to the third malware pattern.
9. The system of claim 8 , wherein one or more of the first permutation and the second permutation comprises a bit-level XOR operation.
10. The system of claim 8 , wherein the first malware pattern is a malware payload.
11. The system of claim 8 , wherein the first malware pattern comprises a malware payload and shellcode.
12. The system of claim 8 , wherein the one or more processors are further configured to:
receive a second file;
determine whether the second file comprises information regarding an internal resource; and
determine that the second file comprises malware based on determining that the second file comprises the information regarding the internal resource.
13. The system of claim 12 , wherein the information regarding an internal resource comprises an address of a proxy.
14. The system of claim 8 , wherein the one or more processors are further configured to store the second malware pattern and the third malware pattern in the at least one storage module prior to receiving the first file.
15. At least one non-transitory computer-readable medium comprising instructions that, when executed by one or more processors, are configured to:
receive a first file;
access at least one storage module storing a first malware pattern, a second malware pattern, and a third malware pattern, the second malware pattern being a first permutation of the first malware pattern, the third malware pattern being a second permutation of the second malware pattern and different than the second malware pattern, wherein one or more of the first permutation and the second permutation comprises a bit rotation;
compare the first file to the third malware pattern; and
determine that the first file comprises malware in response to comparing the file to the third malware pattern.
16. The at least one non-transitory computer-readable medium of claim 15 , wherein one or more of the first permutation and the second permutation comprises a bit-level XOR operation.
17. The at least one non-transitory computer-readable medium of claim 15 , wherein the first malware pattern is a malware payload.
18. The at least one non-transitory computer-readable medium of claim 15 , wherein the first malware pattern comprises a malware payload and shellcode.
19. The at least non-transitory one computer-readable medium of claim 15 , wherein the instructions are further configured to:
receive a second file;
determine whether the second file comprises information regarding an internal resource; and
determine that the second file comprises malware based on determining that the second file comprises the information regarding the internal resource.
20. The at least one non-transitory computer-readable medium of claim 19 , wherein the information regarding an internal resource comprises an address of a proxy.
21. The at least one non-transitory computer-readable medium of claim 15 , wherein the instructions are further configured to store the second malware pattern and the third malware pattern prior to receiving the first file.