Granted Patent B1

US 10,032,023 · App. 15/080,621 · Granted Jul 24, 2018

Abstract

Claims (56)

1. A computer-implemented method for selectively applying malware signatures, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

receiving a time-sensitive malware signature at a receiving time to apply to a computing environment;

identifying a first target object within the computing environment subject to malware scans, the first target object being observed within the computing environment at a first observation time;

deactivating the time-sensitive malware signature with respect to the first target object based at least in part on a difference between the receiving time and the first observation time, wherein the deactivation of the time-sensitive malware signature with respect to the first target object is set to end after a predetermined window of time;

observing a second target object within the computing environment subject to malware scans, the second target object being observed within the computing environment at a second observation time that is later than the first observation time;

activating the time-sensitive malware signature with respect to the second target object based at least in part on a difference between the receiving time and the second observation time;

sending an indication to a distributor of the time-sensitive malware signature, while the time-sensitive malware signature is deactivated with respect to the first target object, that the time-sensitive malware signature matches the first target object;

receiving from the distributor, in response to sending the indication, an instruction and preventing a subsequent application of the time-sensitive malware signature to the first target object.

2. The computer-implemented method of claim 1 , wherein:

deactivating the time-sensitive malware signature with respect to the first target object based at least in part on the difference between the receiving time and the first observation time comprises deactivating the time-sensitive malware signature with respect to the first target object based at least in part on the first observation time preceding the receiving time;

activating the time-sensitive malware signature with respect to the second target object based at least in part on the difference between the receiving time and the second observation time comprises activating the time-sensitive malware signature with respect to the second target object based at least in part on the receiving time preceding the second observation time.

3. The computer-implemented method of claim 1 , further comprising activating the time-sensitive malware signature with respect to the first target object after a predetermined window of time.

4. The computer-implemented method of claim 3 , wherein the predetermined window of time ends after the time-sensitive malware signature does not match any observed target objects within the computing environment for a predetermined amount of time.

5. The computer-implemented method of claim 1 , wherein:

receiving the instruction comprises receiving from the distributor, in response to sending the indication, a modified version of the time-sensitive malware signature that does not match the first target object to replace the time-sensitive malware signature.

6. The computer-implemented method of claim 1 , wherein:

receiving the instruction comprises receiving from the distributor, in response to sending the indication, an instruction to extend the predetermined window of time and, thereby, delay activating the time-sensitive malware signature within the computing environment.

7. The computer-implemented method of claim 1 , wherein:

receiving the instruction comprises receiving from the distributor, in response to sending the indication, an instruction to include the first target object in a whitelist.

8. The computer-implemented method of claim 1 , wherein deactivating the time-sensitive malware signature with respect to the first target object comprises silently comparing the time-sensitive malware signature to the first target object and sending a comparison result to a distributor of the time-sensitive malware signature.

9. The computer-implemented method of claim 1 , wherein deactivating the time-sensitive malware signature with respect to the first target object comprises putting the first target object on a whitelist based at least in part on the difference between the receiving time and the first observation time.

10. The computer-implemented method of claim 9 , wherein putting the first target object on the whitelist comprises putting the first target object on a whitelist specific to the time-sensitive malware signature that exempts the first target object from the time-sensitive malware signature.

11. The computer-implemented method of claim 1 , further comprising:

receiving a non-time-sensitive malware signature at a second receiving time to apply to the computing environment;

applying the non-time-sensitive malware signature to the first target object regardless of a difference between the second receiving time and the first observation time;

applying the non-time-sensitive malware signature to the second target object regardless of a difference between the second receiving time and the second observation time.

12. A system for selectively applying malware signatures, the system comprising:

a receiving module, stored in memory, that receives a time-sensitive malware signature at a receiving time to apply to a computing environment;

an identification module, stored in memory, that identifies a first target object within the computing environment subject to malware scans, the first target object being observed within the computing environment at a first observation time;

a deactivation module, stored in memory, that deactivates the time-sensitive malware signature with respect to the first target object based at least in part on a difference between the receiving time and the first observation time, wherein the deactivation of the time-sensitive malware signature with respect to the target object is set to end after a predetermined window of time;

an observation module, stored in memory, that observes a second target object within the computing environment subject to malware scans, the second target object being observed within the computing environment at a second observation time that is later than the first observation time;

an activation module, stored in memory, that activates the time-sensitive malware signature with respect to the second target object based at least in part on a difference between the receiving time and the second observation time;

wherein the deactivation module further:

sends an indication to a distributor of the time-sensitive malware signature, while the time-sensitive malware signature is deactivated with respect to the first target object, that the time-sensitive malware signature matches the first target object;

receives from the distributor, in response to sending the indication, an instruction and preventing a subsequent application of the time-sensitive malware signature to the first target object

at least one physical processor configured to execute the receiving module, the identification module, the deactivation module, the observation module, and the activation module.

13. The system of claim 12 , wherein:

the deactivation module deactivates the time-sensitive malware signature with respect to the first target object based at least in part on the difference between the receiving time and the first observation time by deactivating the time-sensitive malware signature with respect to the first target object based at least in part on the first observation time preceding the receiving time;

the activation module activates the time-sensitive malware signature with respect to the second target object based at least in part on the difference between the receiving time and the second observation time by activating the time-sensitive malware signature with respect to the second target object based at least in part on the receiving time preceding the second observation time.

14. The system of claim 12 , the activation module activates the time-sensitive malware signature with respect to the first target object after a predetermined window of time.

15. The system of claim 14 , wherein the predetermined window of time ends after the time-sensitive malware signature does not match any observed target objects within the computing environment for a predetermined amount of time.

16. The system of claim 14 , wherein the deactivation module:

receives the instruction by receiving, from the distributor, in response to sending the indication, a modified version of the time-sensitive malware signature that does not match the first target object to replace the time-sensitive malware signature.

17. The system of claim 14 , wherein the deactivation module:

receives the instruction by receiving, from the distributor, in response to sending the indication, an instruction to extend the predetermined window of time and, thereby, delay activating the time-sensitive malware signature within the computing environment.

18. The system of claim 14 , wherein the deactivation module:

receives the instruction by receiving, from the distributor, in response to sending the indication, an instruction to include the first target object in a whitelist.

19. The system of claim 12 , wherein the deactivation module deactivates the time-sensitive malware signature with respect to the first target object by silently comparing the time-sensitive malware signature to the first target object and send a comparison result to a distributor of the time-sensitive malware signature.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

receive a time-sensitive malware signature at a receiving time to apply to a computing environment;

identify a first target object within the computing environment subject to malware scans, the first target object being observed within the computing environment at a first observation time;

deactivate the time-sensitive malware signature with respect to the first target object based at least in part on a difference between the receiving time and the first observation time wherein the deactivation of the time-sensitive malware signature with respect to the first target object is set to end after a predetermined window of time;

observe a second target object within the computing environment subject to malware scans, the second target object being observed within the computing environment at a second observation time that is later than the first observation time;

activate the time-sensitive malware signature with respect to the second target object based at least in part on a difference between the receiving time and the second observation time;

send an indication to a distributor of the time-sensitive malware signature, while the time-sensitive malware signature is deactivated with respect to the first target object, that the time-sensitive malware signature matches the first target object;

receive from the distributor, in response to sending the indication, an instruction and preventing a subsequent application of the time-sensitive malware signature to the first target object.

Assignments (6)