System, method and computer program product for sending information extracted from a potentially unwanted data sample to generate a signature
View Patent ↗A system, method and computer program product are provided for sending information extracted from a potentially unwanted data sample to generate a signature. In use, information is extracted from a portion of a sample of potentially unwanted data. Further, the information is sent to generate a signature.
1. At least one non-transitory computer readable storage medium having instructions stored thereon that when the instructions are executed by one or more processors cause the one or more processors to:
receive information including an extraction tag and a portion of a sample of potentially unwanted data, the portion of the sample extracted at a client device;
determine, using the extraction tag, a type of extraction used at the client device to extract the portion of the sample;
generate a signature utilizing the extraction tag and the portion of the sample, the signature generation process producing the signature based on both the extraction tag and the portion of the sample; and
send the generated signature to the client device.
2. The at least one computer readable storage medium of claim 1 having additional instructions that when executed by one or more processors cause the one or more processors to:
receive information identifying an extraction offset indicating an offset to the portion of the sample when extracted at the client device; and
generate the signature further utilizing the extraction offset.
3. The at least one computer readable storage medium of claim 1 , wherein the unwanted data includes malware represented by a file on a storage media.
4. The at least one computer readable storage medium of claim 1 , wherein the portion of the sample is determined based on a type of an operating environment associated with the potentially unwanted data.
5. The at least one computer readable storage medium of claim 1 , wherein the portion of the sample is determined based on a type of an object in which the potentially unwanted data is located.
6. The at least one computer readable storage medium of claim 1 , wherein the portion of the sample is determined based on a predetermined offset.
7. A computer system comprising:
a processor; and
a memory communicatively coupled to the processor wherein the memory stores executable instructions that when executed cause the processor to:
invoke an analysis module configured to:
receive information including an extraction tag and a portion of a sample of potentially unwanted data, the portion of the sample extracted at a client device;
determine, using the extraction tag, a type of extraction used at the client to extract the portion of the sample; and
generate a signature utilizing the extraction tag and the portion of the sample, the signature generation process producing the signature based on both the extraction tag and the portion of the sample; and
send the generated signature to the client device.
8. The computer system of claim 7 , wherein the analysis module is further configured to:
receive information identifying an extraction offset indicating an offset to the portion of the sample when extracted at the client device; and
generate the signature further utilizing the extraction offset.
9. The computer system of claim 7 , wherein the unwanted data includes malware represented by a file on a storage media.
10. The computer system of claim 7 , wherein the portion of the sample is determined based on a type of an operating environment associated with the potentially unwanted data.
11. The computer system of claim 7 , wherein the portion of the sample is determined based on a type of an object in which the potentially unwanted data is located.
12. The computer system of claim 7 , wherein the portion of the sample is determined based on a predetermined offset.
13. The computer system of claim 7 , further comprising a database, wherein the analysis module is further configured to store the generated signature in the database.
14. At least one non-transitory computer readable storage medium having instructions stored thereon that when the instructions are executed by one or more processors cause the one or more processors to:
receive information from a portion of a sample of potentially unwanted data, the portion of the sample extracted at a client device;
receive information identifying an extraction offset as indicating an offset to the extracted portion of the sample when extracted at the client device;
receive information identifying a type of extraction used at the client to extract the portion of the sample;
generate a signature utilizing the extraction offset, the type of extraction, and the extracted portion, the signature generation process producing the signature based on both the extraction offset and the extracted portion; and
send the generated signature to the client device.
15. The at least one computer readable storage medium of claim 14 , wherein the unwanted data includes malware represented by a file on a storage media.
16. The at least one computer readable storage medium of claim 14 , wherein the portion of the sample is determined based on a type of an operating environment associated with the potentially unwanted data.
17. The at least one computer readable storage medium of claim 14 , wherein the portion of the sample is determined based on a type of an object in which the potentially unwanted data is located.
18. The at least one computer readable storage medium of claim 14 , wherein the portion of the sample is determined based on a predetermined offset.
19. At least one non-transitory computer readable storage medium having instructions stored thereon that when the instructions are executed by one or more processors cause the one or more processors to:
extract information from a portion of a sample of potentially unwanted data;
identify an extraction offset indicating an offset to the extracted portion of the sample when extracted;
identify a type of extraction used to extract the portion of the sample;
send the extraction offset, the type of exraction, and the extracted information to a server; and
receive a signature, the signature generated at the server, the signature generation process producing the signature based on all of the extraction offset, the type of extraction, and the extracted information.
20. The at least one computer readable storage medium of claim 19 , wherein the unwanted data includes malware represented by a file on a storage media.
21. The at least one computer readable storage medium of claim 19 , wherein the portion of the sample is determined based on a type of an operating environment associated with the potentially unwanted data.
22. The at least one computer readable storage medium of claim 19 , wherein the portion of the sample is determined based on a type of an object in which the potentially unwanted data is located.
23. The at least one computer readable storage medium of claim 19 , wherein the portion of the sample is determined based on a predetermined offset.
24. A method, comprising:
receiving information by a server device, the information including an extraction tag and a portion of a sample of potentially unwanted data, the portion of the sample extracted at a client device;
determine, by the server device, using the extraction tag, a type of extraction used at the client device to extract the portion of the sample;
generate, by the server device, a signature utilizing the extraction tag and the portion of the sample, the signature generation process producing the signature based on both the extraction tag and the portion of the sample; and
sending the generated signature from the server device to the client device.
25. The method of claim 24 , further comprising:
receiving information identifying an extraction offset indicating an offset to the portion of the sample when extracted at the client device; and
generating the signature further utilizing the extraction offset.