Streaming malware definition updates
View Patent ↗A method, system and apparatus for assembling and publishing frequent malware signature definition updates through the use of additive or “streaming” definition packages is provided. Embodiments of the present invention provide such functionality by publishing not only full malware signature definition updates on a long periodicity but also streaming malware signature definition updates containing newly certified signature definitions on a short periodicity. As newly-certified malware signature definitions are received, those newly-certified signature definitions are incorporated not only in the full signature definition file but also in a streaming signature definition update that contains only newly-certified signature definitions received during a streaming update period. At the end of the streaming update period, a streaming signature definition file is made available by publication to anti-malware clients. A streaming signature definition file only contains those signature definitions received during the assembly period for that streaming definition file.
1. A method comprising:
receiving a mini drive file after a threshold publication time, wherein
the mini drive file comprises a plurality of version identifiers (IDs) and a plurality of pointers,
each of the plurality of version IDs is associated with one of a plurality of delta definition sets,
each of the plurality of delta definition sets comprises update information for a corresponding version of a full signature definition file, and
each of the plurality of pointers indicates a corresponding storage area of each of the plurality of delta definition sets;
comparing a local version identifier of a local copy of the full signature definition file and the plurality of version IDs, wherein
the comparing indicates the local version identifier corresponds to a first delta definition set of the plurality of delta definition sets,
the comparing further indicates the local version identifier corresponds to a first pointer of the plurality of pointers, and
the first pointer indicates a first storage area configured to provide the first delta definition set;
requesting the first delta definition set from the first storage area, in response to the comparing; and
updating the local copy of the full signature definition file, wherein
the local copy is updated with the first delta definition set, and
the local version identifier of the local copy is updated to a current version identifier.
2. The method of claim 1 , further comprising:
comparing a version identifier of one or more local streaming signature definition files with the current version identifier, wherein
the one or more local streaming signature definition files were received before the local copy of the full signature definition file was updated; and
removing ones of the local streaming signature definition files that comprise version identifiers that match the current version identifier.
3. The method of claim 1 , further comprising:
receiving a first streaming signature definition file before the receiving the mini drive file, wherein
the first streaming signature definition file comprises a first malware signature,
the local copy of the full signature definition file comprises a first plurality of malware signatures, and
the first plurality of malware signatures does not comprise the first malware signature.
4. The method of claim 3 , further comprising:
scanning for an instance of malware corresponding to the first malware signature and the first plurality of malware signatures, wherein
the scanning uses the local copy of the full signature definition file and the first streaming signature definition file.
5. The method of claim 3 , further comprising:
receiving a second streaming signature definition file after the receiving the first streaming signature definition file, wherein
the second streaming signature definition comprises a second malware signature,
the second streaming signature definition file does not comprise the first malware signature, and
the second streaming signature definition file is configured to be used to scan for an instance of malware corresponding to the second malware signature.
6. A non-transitory computer readable storage medium configured to store program instructions that, when executed on a processor, are configured to cause the processor to perform a method comprising:
receiving a mini drive file after a threshold publication time, wherein
the mini drive file comprises a plurality of version identifiers (IDs) and a plurality of pointers,
each of the plurality of version IDs is associated with one of a plurality of delta definition sets,
each of the plurality of delta definition sets comprises update information for a corresponding version of a full signature definition file, and
each of the plurality of pointers indicates a corresponding storage area of each of the plurality of delta definition sets;
comparing a local version identifier of a local copy of the full signature definition file with the plurality of version IDs, wherein
the comparing indicates the local version identifier corresponds to a first delta definition set of the plurality of delta definition sets,
the comparing further indicates the local version identifier corresponds to a first pointer of the plurality of pointers, and
the first pointer indicates a first storage area configured to provide the first delta definition set;
requesting the first delta definition set from the first storage area, in response to the comparing; and
updating the local copy of the full signature definition file, wherein
the local copy is updated with the first delta definition set, and
the local version identifier of the local copy is updated to a current version identifier.
7. The non-transitory computer readable storage medium of claim 6 , wherein the method further comprises:
comparing a version identifier of one or more local streaming signature definition files with the current version identifier, wherein
the one or more local streaming signature definition files were received before the local copy of the full signature definition file was updated; and
removing ones of the local streaming signature definition files that comprise version identifiers that match the current version identifier.
8. The non-transitory computer readable storage medium of claim 6 , wherein the method further comprises:
receiving a first streaming signature definition file before the receiving the mini drive file, wherein
the first streaming signature definition file comprises a first malware signature,
the local copy of the full signature definition file comprises a first plurality of malware signatures, and
the first plurality of malware signatures does not comprise the first malware signature.
9. The non-transitory computer readable storage medium of claim 8 , wherein the method further comprises:
scanning for an instance of malware corresponding to the first malware signature and the first plurality of malware signatures, wherein
the scanning uses the local copy of the full signature definition file and the first streaming signature definition file.
10. The non-transitory computer readable storage medium of claim 8 , wherein the method further comprises:
receiving a second streaming signature definition file after the receiving the first streaming signature definition file, wherein
the second streaming signature definition comprises a second malware signature,
the second streaming signature definition file does not comprise the first malware signature, and
the second streaming signature definition file is configured to be used to scan for an instance of malware corresponding to the second malware signature.
11. An apparatus comprising:
a processor; and
a memory coupled to the processor and configured to store instructions executable by the processor, the instructions configured to:
receive a mini drive file after a threshold publication time, wherein
the mini drive file comprises a plurality of version identifiers (IDs) and a plurality of pointers,
each of the plurality of version IDs is associated with one of a plurality of delta definition sets,
each of the plurality of delta definition sets comprises update information for a corresponding version of a full signature definition file, and
each of the plurality of pointers indicates a corresponding storage area of each of the plurality of delta definition sets;
compare a local version identifier of a local copy of the full signature definition file with the plurality of version IDs, wherein
the comparing indicates the local version identifier corresponds to a first delta definition set of the plurality of delta definition sets,
the comparing further indicates the local version identifier corresponds to a first pointer of the plurality of pointers, and
the first pointer indicates a first storage area configured to provide the first delta definition set;
request the first delta definition set from the first storage area, in response to the comparing; and
update the local copy of the full signature definition file, wherein
the local copy is updated with the first delta definition set, and
the local version identifier of the local copy is updated to a current version identifier.
12. The apparatus of claim 11 , wherein the instructions are further configured to
compare a version identifier of one or more local streaming signature definition files with the current version identifier, wherein
the one or more local streaming signature definition files were received before the local copy of the full signature definition file was updated; and
remove ones of the local streaming signature definition files that comprise version identifiers that match the current version identifier.
13. The apparatus of claim 11 , wherein the instructions are further configured to
receive a first streaming signature definition file before the receiving the mini drive file, wherein
the first streaming signature definition file comprises a first malware signature,
the local copy of the full signature definition file comprises a first plurality of malware signatures, and
the first plurality of malware signatures does not comprise the first malware signature.
14. The apparatus of claim 13 , wherein the instructions are further configured to
scan for an instance of malware corresponding to the first malware signature and the first plurality of malware signatures, wherein
the scanning uses the local copy of the full signature definition file and the first streaming signature definition file.
15. The apparatus of claim 13 , wherein the instructions are further configured to
receive a second streaming signature definition file after the receiving the first streaming signature definition file, wherein
the second streaming signature definition comprises a second malware signature,
the second streaming signature definition file does not comprise the first malware signature, and
the second streaming signature definition file is configured to be used to scan for an instance of malware corresponding to the second malware signature.