System, method and computer program product for sending information extracted from a potentially unwanted data sample to generate a signature
View Patent ↗A system, method and computer program product are provided for sending information extracted from a potentially unwanted data sample to generate a signature. In use, information is extracted from a portion of a sample of potentially unwanted data. Further, the information is sent to generate a signature.
1. At least one non-transitory computer readable storage medium having instructions stored thereon, comprising instructions that when executed cause a machine to:
reduce signature generation bandwidth utilization, comprising instructions that when executed cause the machine to:
receive from a client device:
an extract from a potentially unwanted data; and
an indication of how the extract was obtained from the potentially unwanted data;
generate a signature of the potentially unwanted data based on the extract and the indication; and
send the signature to the client device.
2. The at least one computer readable storage medium of claim 1 , wherein the instructions further comprise instructions that when executed cause the machine to:
receive an offset of the extract into the potentially unwanted data,
wherein the instructions that when executed cause the machine to generate the signature comprise instructions that when executed cause the machine to generate the signature based on the extract, the indication, and the offset.
3. The at least one computer readable storage medium of claim 1 , wherein the potentially unwanted data includes malware represented by a file on a storage media.
4. The at least one computer readable storage medium of claim 1 , wherein the extract is based on a type of an operating environment associated with the potentially unwanted data.
5. The at least one computer readable storage medium of claim 1 , wherein the extract is based on a type of an object in which the potentially unwanted data is located.
6. The at least one computer readable storage medium of claim 1 , wherein the extract is based on a predetermined offset into the potentially unwanted data.
7. A computer system comprising:
one or more processors; and
a memory communicatively coupled to the one or more processors, wherein the memory stores instructions that when executed cause at least some of the processors to:
reduce bandwidth utilized by an analysis module, comprising instructions that when executed cause at least some of the processors to:
receive from a client device:
an extract from a potentially unwanted data; and
an indication of how the extract was obtained from the potentially unwanted data;
generate a signature of the potentially unwanted data based on the extract and the indication; and
send the signature to the client device.
8. The computer system of claim 7 , wherein the analysis module further comprises instructions that when executed cause at least some of the one or more processors to:
receive an offset of the extract into the potentially unwanted data,
wherein the instructions that when executed cause at least some of the one or more processors to generate the signature comprise instructions that when executed cause at least some of the one or more processors to generate the signature based on the extract, the indication, and the offset.
9. The computer system of claim 7 , wherein the potentially unwanted data includes malware represented by a file on a storage media.
10. The computer system of claim 7 , wherein the extract is based on a type of an operating environment associated with the potentially unwanted data.
11. The computer system of claim 7 , wherein the extract is based on a type of an object in which the potentially unwanted data is located.
12. The computer system of claim 7 , wherein the extract is based on a predetermined offset into the potentially unwanted data.
13. The computer system of claim 7 , further comprising a database, wherein the analysis module further comprises instructions that when executed cause at least some of the one or more processors to store the signature in the database.
14. At least one non-transitory computer readable storage medium having instructions stored thereon, comprising instructions that when executed cause a machine:
reduce signature generation bandwidth utilization, comprising instructions that when executed cause the machine to:
receive from a client device:
an extract from a potentially unwanted data;
an indication of how the extract was obtained from the potentially unwanted data; and
an offset of the extract into the potentially unwanted data;
generate a signature of the potentially unwanted data based on the extract, the indication, and the offset; and
send the signature to the client device.
15. The at least one computer readable storage medium of claim 14 , wherein the potentially unwanted data includes malware represented by a file on a storage media.
16. The at least one computer readable storage medium of claim 14 , wherein the extract is based on a type of an operating environment associated with the potentially unwanted data.
17. The at least one computer readable storage medium of claim 14 , wherein the extract is based on a type of an object in which the potentially unwanted data is located.
18. The at least one computer readable storage medium of claim 14 , wherein the extract is based on a predetermined offset into the potentially unwanted data.
19. At least one non-transitory computer readable storage medium having instructions stored thereon comprising instructions that when executed cause a machine to:
reduce bandwidth utilized for requesting a signature of potentially unwanted data, comprising instructions that when executed cause the machine to:
extract information from a potentially unwanted data;
identify how the information was extracted from the potentially unwanted data;
identify an offset of the information into the potentially unwanted data; and
request, from a server device, the signature based on the information, how the information was extracted from the potentially unwanted data, and the offset; and
receive the signature from the server device.
20. The at least one computer readable storage medium of claim 19 , wherein the potentially unwanted data includes malware represented by a file on a storage media.
21. The at least one computer readable storage medium of claim 19 , wherein the information is extracted based on a type of an operating environment associated with the potentially unwanted data.
22. The at least one computer readable storage medium of claim 19 , wherein the information is extracted based on a type of an object in which the potentially unwanted data is located.
23. The at least one computer readable storage medium of claim 19 , wherein the information is extracted based on a predetermined offset into the potentially unwanted data.