Streaming malware definition updates

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 9,047,467
App. No.: 14/043,111
Granted: Jun 2, 2015
Kind: B1

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A method, system and apparatus for assembling and publishing frequent malware signature definition updates through the use of additive or “streaming” definition packages is provided. Embodiments of the present invention provide such functionality by publishing not only full malware signature definition updates on a long periodicity but also streaming malware signature definition updates containing newly certified signature definitions on a short periodicity. As newly-certified malware signature definitions are received, those newly-certified signature definitions are incorporated not only in the full signature definition file but also in a streaming signature definition update that contains only newly-certified signature definitions received during a streaming update period. At the end of the streaming update period, a streaming signature definition file is made available by publication to anti-malware clients. A streaming signature definition file only contains those signature definitions received during the assembly period for that streaming definition file.

Claims (94)

1. A method comprising:

receiving a first malware signature during a first time period, wherein

the first time period occurs before a publication time of a full signature definition file, and

the publication time of the full signature definition file is based, at least in part, upon a predetermined time interval;

incorporating the first malware signature into a first streaming signature definition file, wherein

the first streaming signature definition file is associated with the first time period, and

publishing the first streaming signature definition file upon completion of the first time period;

receiving a second malware signature during a second time period, wherein

the second time period occurs after the first time period and before the publication time of the full signature definition file;

incorporating the second malware signature into a second streaming signature definition file, wherein

the second streaming signature definition file is associated with the second time period;

publishing the second streaming signature definition file upon completion of the second time period;

receiving an indication that a first client computer did not receive the first streaming signature definition file; and

in response to the receiving the indication, providing the first client computer with a delta definition file comprising information related to the first malware signature.

2. The method of claim 1 , further comprising:

publishing the full signature definition file, wherein

the full signature definition file comprises a plurality of malware signatures received up to the publication time, and

the plurality of malware signatures comprises the first malware signature and the second malware signature.

3. The method of claim 2 , wherein

the full signature definition file further comprises an optimized tree, and

the optimized tree comprises one or more data structures associated with the plurality of malware signatures.

4. The method of claim 3 , wherein

the first streaming signature definition file and the second streaming signature definition file are configured to be used in addition to the full signature definition file to perform a malware scan, and

the first streaming signature definition file and the second streaming signature definition file are not configured to update the optimized tree of the full signature definition file.

5. The method of claim 1 , wherein

the publishing the second streaming signature definition file comprises

replacing the first streaming signature definition file with the second streaming signature definition file.

6. The method of claim 1 , wherein

the first streaming signature definition file comprises a first plurality of malware signatures,

the second streaming signature definition file comprises a second plurality of malware signatures, and

the first plurality of malware signatures and the second plurality of malware signatures are distinct from one another.

7. A non-transitory computer readable storage medium configured to store program instructions that, when executed on a processor, are configured to cause the processor to perform a method comprising: