Granted Patent B1

US 9,485,272 · App. 14/307,477 · Granted Nov 1, 2016

Abstract

Claims (99)

1. A computer-implemented method for estimating confidence scores of unverified signatures, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

detecting a potentially malicious event that triggers a malware signature designed to detect malware, the malware signature having a confidence score that:

represents a level of confidence in the accuracy or reliability of the malware signature; and

is above a certain threshold such that the malware signature's confidence score indicates a threshold level of confidence in the accuracy or reliability of the malware signature;

detecting another event that triggers another signature designed to detect malware, the other signature having a confidence score that:

represents a level of confidence in the accuracy or reliability of the other signature; and

is unknown such that the other signature's confidence score indicates an unknown level of confidence in the accuracy or reliability of the other signature;

determining that the potentially malicious event and the other event occurred within a certain time period of one another; and

assigning, to the other signature, a confidence score based at least in part on the potentially malicious event and the other event occurring within the certain time period of one another.

2. The method of claim 1 , wherein the malware signature's confidence score indicates a maximum level of confidence in the accuracy of the malware signature.

3. The method of claim 2 , wherein assigning the confidence score to the other signature comprises:

determining that the confidence score of the malware signature indicates the maximum level of confidence in the accuracy of the malware signature; and

assigning, to the other signature, a confidence score that indicates a maximum level of confidence in the accuracy of the other signature based at least in part on the confidence score of the malware signature.

4. The method of claim 3 , wherein:

determining that the potentially malicious event and the other event occurred within the certain time period of one another comprises determining that the potentially malicious event and the other event occurred simultaneously; and

assigning the confidence score that indicates the maximum level of confidence to the other signature comprises assigning, to the other signature, the confidence score that indicates the maximum level of confidence based at least in part on the potentially malicious event and the other event occurring simultaneously.

5. The method of claim 1 , wherein assigning the confidence score to the other signature comprises:

determining an amount of time that separated the occurrences of the potentially malicious event and the other event;

calculating a confidence score for the other signature by applying the amount of time that separated the occurrences of the potentially malicious event and the other event to an algorithmic function; and

assigning, to the other signature, the confidence score calculated by applying the amount of time to the algorithmic function.

6. The method of claim 5 , wherein the algorithmic function comprises a Gaussian function.

7. The method of claim 1 , wherein:

detecting the potentially malicious event that triggers the malware signature comprises detecting the potentially malicious event on each of a plurality of computing devices;

detecting the other event that triggers the other signature comprises detecting the other event on each of the plurality of computing devices;

determining that the potentially malicious event and the other event occurred within the certain time period of one another comprises determining that the potentially malicious event and the other event occurred within the certain time period of one another on each of the plurality of computing devices; and

assigning the confidence score to the other signature comprises assigning the confidence score to the other signature based at least in part on the potentially malicious event and the other event occurring within the certain time period of one another on each of the plurality of computing devices.

8. The method of claim 1 , wherein:

detecting the potentially malicious event that triggers the malware signature comprises detecting, on a single computing device, one or more potentially malicious events that trigger one or more malware signatures whose confidence scores are above a certain threshold and below another threshold;

determining that the potentially malicious event and the other event occurred within the certain time period of one another comprises determining that the one or more potentially malicious events and the other event occurred within the certain time period of one another on the single computing device; and

assigning the confidence score to the other signature comprises:

calculating a confidence score for the other signature based at least in part on:

the number of the one or more potentially malicious events detected on the single computing device; and

the confidence scores of the one or more potentially malicious events detected on the single computing device; and

assigning the calculated confidence score to the other signature.

9. The method of claim 1 , wherein:

detecting the potentially malicious event that triggers the malware signature comprises detecting one or more potentially malicious events that trigger one or more malware signatures whose confidence scores are above a certain threshold;

detecting the other event that triggers the other signature comprises detecting one or more instances of the other event that triggers the other signature whose confidence score is unknown; and

assigning the confidence score to the other signature comprises:

determining the number of the one or more potentially malicious events and the number of the one or more instances of the other event that occurred within a certain window of time;

calculating a confidence score for the other signature by dividing the number of the one or more potentially malicious events by the number of the one or more instances of the other event; and

assigning, to the other signature, the confidence score calculated by dividing the number of the one or more potentially malicious events by the number of the one or more instances of the other event.

10. The method of claim 1 , wherein assigning the confidence score to the other signature comprises:

updating a signature database that facilitates distribution of signatures to computing devices within a user base to account for the confidence score assigned to the other signature; and

enabling, based at least in part on updating the signature database, the computing devices within the user base to leverage the confidence score assigned to the other signature in assessing suspicious events detected on the computing devices.

11. A system for estimating confidence scores of unverified signatures, the system comprising:

a detection module, stored in memory, that:

detects a potentially malicious event that triggers a malware signature designed to detect malware, the malware signature having a confidence score that:

represents a level of confidence in the accuracy or reliability of the malware signature; and

is above a certain threshold such that the malware signature's confidence score indicates a threshold level of confidence in the accuracy or reliability of the malware signature;

detects another event that triggers another signature designed to detect malware, the other signature having a confidence score that:

represents a level of confidence in the accuracy or reliability of the other signature; and

is unknown such that the other signature's confidence score indicates an unknown level of confidence in the accuracy or reliability of the other signature;

a determination module, stored in memory, that determines that the potentially malicious event and the other event occurred within a certain time period of one another;

a confidence module, stored in memory, that assigns, to the other signature, a confidence score based at least in part on the potentially malicious event and the other event occurring within the certain time period of one another; and

at least one physical processor that executes the detection module, the determination module, and the confidence module.

12. The system of claim 11 , wherein the malware signature's confidence score indicates a maximum level of confidence in the accuracy of the malware signature.

13. The system of claim 12 , wherein:

the determination module determines that the confidence score of the malware signature indicates the maximum level of confidence in the accuracy of the malware signature; and

the confidence module assigns, to the other signature, a confidence score that indicates a maximum level of confidence in the accuracy of the other signature based at least in part on the confidence score of the malware signature.

14. The system of claim 13 , wherein:

the determination module determines that the potentially malicious event and the other event occurred simultaneously; and

the confidence module assigns, to the other signature, the confidence score that indicates the maximum level of confidence based at least in part on the potentially malicious event and the other event occurring simultaneously.

15. The system of claim 11 , wherein:

the determination module determines an amount of time that separated the occurrences of the potentially malicious event and the other event; and

the confidence module:

calculates a confidence score for the other signature by applying the amount of time that separated the occurrences of the potentially malicious event and the other event to an algorithmic function; and

assigns, to the other signature, the confidence score calculated by applying the amount of time to the algorithmic function.

16. The system of claim 11 , wherein:

the detection module:

detects the potentially malicious event on each of a plurality of computing devices; and

detects the other event on each of the plurality of computing devices;

the determination module determines that the potentially malicious event and the other event occurred within the certain time period of one another on each of the plurality of computing devices; and

the confidence module assigns the confidence score to the other signature based at least in part on the potentially malicious event and the other event occurring within the certain time period of one another on each of the plurality of computing devices.

17. The system of claim 11 , wherein:

the detection module detects, on a single computing device, one or more potentially malicious events that trigger one or more malware signatures whose confidence scores are above a certain threshold and below another threshold;

the determination module determines that the one or more potentially malicious events and the other event occurred within the certain time period of one another on the single computing device; and

the confidence module:

calculates a confidence score for the other signature based at least in part on:

the number of the one or more potentially malicious events detected on the single computing device; and

the confidence scores of the one or more potentially malicious events detected on the single computing device; and

assigns the calculated confidence score to the other signature.

18. The system of claim 11 , wherein:

the detection module:

detects one or more potentially malicious events that trigger one or more malware signatures whose confidence scores are above a certain threshold; and

detects one or more instances of the other event that triggers the other signature whose confidence score is unknown;

the determination module determines the number of the one or more potentially malicious events and the number of the one or more instances of the other event that occurred within a certain window of time; and

the confidence module:

calculates a confidence score for the other signature by dividing the number of the one or more potentially malicious events by the number of the one or more instances of the other event; and

assigns, to the other signature, the confidence score calculated by dividing the number of the one or more potentially malicious events by the number of the one or more instances of the other event.

19. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

detect a potentially malicious event that triggers a malware signature designed to detect malware, the malware signature having a confidence score that:

represents a level of confidence in the accuracy or reliability of the malware signature; and

is above a certain threshold such that the malware signature's confidence score indicates a threshold level of confidence in the accuracy or reliability of the malware signature;

detect another event that triggers another signature designed to detect malware, the other signature having a confidence score that:

represents a level of confidence in the accuracy or reliability of the other signature; and

is unknown such that the other signature's confidence score indicates an unknown level of confidence in the accuracy or reliability of the other signature;

determine that the potentially malicious event and the other event occurred within a certain time period of one another; and

assign, to the other signature, a confidence score based at least in part on the potentially malicious event and the other event occurring within the certain time period of one another.

20. The method of claim 1 , wherein the other signature's confidence score is unknown due at least in part to the other signature having yet to be assigned a confidence score.

Assignments (6)