Granted Patent B2

US 12,455,885 · App. 17/873,611 · Granted Oct 28, 2025

Inventor: Michal Najman (Vsetin, CZ)

Assignee: Avast Software s.r.o.

G06F16/24564G06F16/244

Abstract

Claims (100)

1. A method for performing a malware threat intelligence update, the method comprising:

receiving a plurality of data points comprising a plurality of files;

determining a plurality of identifiers for the plurality of data points, the determining the plurality of identifiers for the plurality of data points comprising applying a hash function to transform the plurality of data points to a plurality of byte sequences;

determining at least one term for each of the plurality of data points to determine a plurality of terms respectively associated with the plurality of identifiers;

compressing the plurality of data points, the compressing comprising determining, based on the plurality of terms respectively associated with the plurality of identifiers, a plurality of collections of identifiers respectively associated with the plurality of terms, and limiting the number of identifiers in each of the plurality of collections to a threshold number;

receiving a rule;

determining a plurality of conditions of the rule;

comparing the plurality of conditions of the rule to the plurality of terms to determine a plurality of matching terms respectively associated with corresponding collections of identifiers of the plurality of collections of identifiers;

determining an intersection of the corresponding collections of identifiers;

determining a number of the plurality of data points covered by the rule based on the intersection of the corresponding collections of identifiers; and

updating malware threat intelligence of a computing device based on the number of the plurality of data points covered by the rule, the updating comprising performing a transmission of the rule to the computing device based on the number of the plurality of data points covered by the rule;

detecting an electronic message received by the computing device;

comparing the plurality of conditions of the rule to the electronic message received by the computing device; and

blocking the electronic message based on the comparing of the plurality of conditions of the rule to the electronic message.

2. The method of claim 1 , wherein the determining the plurality of collections of identifiers comprises determining a plurality of k minimum value (“KMV”) sketches of identifiers.

3. The method of claim 1 , further comprising determining the number of the plurality of data points covered by the rule divided by the number of the plurality of data points, wherein the transmission is further performed based on a number of the plurality of data points covered by the rule divided by a total number of the plurality of data points.

4. The method of claim 1 , wherein performing the transmission comprises transmitting the rule to the computing device based on the number of the plurality of data points covered by the rule.

5. The method of claim 1 , wherein performing the transmission comprises transmitting the rule to the computing device based on the number of the plurality of data points covered by the rule and the total number of the plurality of data points.

6. The method of claim 1 , wherein performing the transmission comprises transmitting an indication of the number of the plurality of data points covered by the rule.

7. The method of claim 1 , wherein performing the transmission comprises transmitting an indication of the number of the plurality of data points covered by the rule divided by the total number of the plurality of data points.

8. The method of claim 1 , further comprising:

determining the largest identifier of each of the corresponding collections of identifiers;

determining the smallest identifier of the largest identifiers of the corresponding collections of identifiers;

determining the number of identifiers of the intersection of the corresponding collections of identifiers; and

determining the number of the plurality of data points covered by the rule based on the number of identifiers of the intersection and the smallest identifier of the largest identifiers of the corresponding collections of identifiers.

9. The method of claim 8 , further comprising determining the number of the plurality of data points covered by the rule based on the number of identifiers of the intersection divided by the smallest identifier of the largest identifiers of the corresponding collections of identifiers.

10. The method of claim 8 , wherein the corresponding collections of identifiers comprise a group of collections in which the number of identifiers is equal to the threshold number in each collection of the group of collections.

11. The method of claim 1 , wherein the corresponding collections of identifiers comprise:

at least a first collection in which the number of identifiers is less than the threshold number; and

at least a second collection in which the number of identifiers is equal to the threshold number.

12. The method of claim 1 , wherein the corresponding collections of identifiers comprise:

a first group of collections in which the number of identifiers is less than the threshold number in each collection of the first group of collections; and

a second group of collections in which the number of identifiers is equal to the threshold number in each collection of the second group of collections.

13. The method of claim 12 , further comprising:

determining an intersection of the first group of collections;

determining an intersection of the second group of collections; and

determining an intersection of the intersection of the first group of collections and the intersection of the second group of collections to determine the intersection of the corresponding collections of identifiers.

14. The method of claim 13 , wherein:

determining the intersection of the first group of collections comprises determining identifiers common to the collections of the first group of collections;

determining the intersection of the second group of collections comprises determining identifiers common to the collections of the second group of collections; and

determining the intersection of the intersection of the first group of collections and the intersection of the second group of collections comprises determining identifiers common to the intersection of the first group of collections and the intersection of the second group of collections, the method further comprising:

determining the largest identifier of the intersection of the first group of collections;

determining the largest identifier of each of the collections of the second group of collections;

determining the smallest identifier of the largest identifiers of the collections of the second group of collections;

determining the smaller of the smallest identifier of the largest identifiers of the collections of the second group of collections and the largest identifier of the intersection of the first group of collections;

determining the number of identifiers of the intersection of the corresponding collections of identifiers; and

determining the number of the plurality of data points covered by the rule based on the number of identifiers of the intersection of the corresponding collections of identifiers and the smaller of the smallest identifier of the largest identifiers of the collections of the second group of collections and the largest identifier of the intersection of the first group of collections.

15. The method of claim 14 , further comprising determining the number of the plurality of data points covered by the rule as the number of identifiers of the intersection of the corresponding collections of identifiers divided by the smaller of the smallest identifier of the largest identifiers of the collections of the second group of collections and the largest identifier of the intersection of the first group of collections.

16. The method of claim 1 , wherein receiving the plurality of data points comprising the plurality of files comprises receiving a first plurality of labeled file samples.

17. The method of claim 16 , further comprising:

receiving a second plurality of labeled file samples; and

generating the rule based on the second plurality of labeled file samples.

18. The method of claim 1 , wherein the plurality of identifiers comprise unique identifiers.

19. The method of claim 1 , wherein the plurality of identifiers are unique identifiers greater than zero and less than or equal to 1.

20. The method of claim 1 , further comprising curating a plurality of benign files, wherein the receiving of the plurality of data points comprising the plurality of files comprises receiving the curated plurality of benign files.

21. The method of claim 1 , wherein each of the plurality of conditions of the rule are matched respectively to ones of the plurality of terms.

22. The method of claim 1 , wherein determining the at least one term for each of the plurality of data points comprises determining at least one of a file name or a file size.

23. The method of claim 1 , wherein determining the at least one term for each of the plurality of data points comprises determining at least two terms for each of the plurality of data points.

24. The method of claim 1 , further comprising generating the rule based on a curated set of files of known threat level, wherein the receiving of the rule comprises receiving the generated rule.

25. The method of claim 1 , wherein the plurality of terms each comprise a value comprising at least one of a text string or a number.

26. The method of claim 1 , wherein the plurality of terms each comprise a path and a value, the value comprising at least one of a text string or a number.

27. A system for performing a malware threat intelligence update, the system comprising:

one or more processors; and

memory storing executable instructions that, as a result of being executed, cause the system to perform operations comprising:

receiving a plurality of data points comprising a plurality of files;

determining a plurality of identifiers for the plurality of data points, the determining the plurality of identifiers for the plurality of data points comprising applying a hash function to transform the plurality of data points to a plurality of byte sequences;

determining at least one term for each of the plurality of data points to determine a plurality of terms respectively associated with the plurality of identifiers;

compressing the plurality of data points, the compressing comprising determining, based on the plurality of terms respectively associated with the plurality of identifiers, a plurality of collections of identifiers respectively associated with the plurality of terms, and limiting the number of identifiers in each of the plurality of collections of identifiers to a threshold number;

receiving a rule;

determining a plurality of conditions of the rule;

comparing the plurality of conditions of the rule to the plurality of terms to determine a plurality of matching terms respectively associated with corresponding collections of identifiers of the plurality of collections of identifiers;

determining an intersection of the corresponding collections of identifiers;

determining a number of the plurality of data points covered by the rule based on the intersection of the corresponding collections of identifiers; and

updating malware threat intelligence of a computing device based on the number of the plurality of data points covered by the rule, the updating comprising performing a transmission of the rule to the computing device based on the number of the plurality of data points covered by the rule, wherein the malware threat intelligence is configured to detect an electronic message received by the computing device, compare the plurality of conditions of the rule to the electronic message received by the computing device, and block the electronic message based on the comparing of the plurality of conditions of the rule to the electronic message.

28. A non-transitory computer-readable storage medium storing executable instructions that, as a result of execution by one or more processors of a computer system, cause the computer system to perform operations comprising:

receiving a plurality of data points comprising a plurality of files;

determining a plurality of identifiers for the plurality of data points, the determining the plurality of identifiers for the plurality of data points comprising applying a hash function to transform the plurality of data points to a plurality of byte sequences;

determining at least one term for each of the plurality of data points to determine a plurality of terms respectively associated with the plurality of identifiers;

compressing the plurality of data points, the compressing comprising determining, based on the plurality of terms respectively associated with the plurality of identifiers, a plurality of collections of identifiers respectively associated with the plurality of terms, and limiting the number of identifiers in each of the plurality of collections of identifiers to a threshold number;

receiving a rule;

determining a plurality of conditions of the rule;

comparing the plurality of conditions of the rule to the plurality of terms to determine a plurality of matching terms respectively associated with corresponding collections of identifiers of the plurality of collections of identifiers;

determining an intersection of the corresponding collections of identifiers;

determining a number of the plurality of data points covered by the rule based on the intersection of the corresponding collections of identifiers; and

updating malware threat intelligence of a computing device based on the number of the plurality of data points covered by the rule, the updating comprising performing a transmission of the rule to the computing device based on the number of the plurality of data points covered by the rule, wherein the malware threat intelligence is configured to detect an electronic message received by the computing device, compare the plurality of conditions of the rule to the electronic message received by the computing device, and block the electronic message based on the comparing of the plurality of conditions of the rule to the electronic message.

29. The method of claim 1 , further comprising:

receiving by a computing system the plurality of data points;

determining a free memory of the computing system;

determining the threshold number based on the free memory of the computing system;

hosting the compressed plurality of data points in the free memory; and

determining the intersection of the corresponding collections of identifiers based on the compressed plurality of data points in the free memory.

30. The method of claim 29 , wherein:

the determining the plurality of collections of identifiers comprises determining a plurality of k minimum value (“KMV”) sketches of identifiers;

the threshold number comprises a k minimum value of the plurality of KMV sketches; and

the determining the threshold number comprises determining the k minimum value based on the free memory wherein the compressed plurality of data points are configured to fit in the free memory.

31. The method of claim 1 , further comprising:

providing a plurality of computing devices comprising an agent executed on the plurality of computing devices;

receiving from the plurality of computing devices via a network via the agent the plurality of files from the plurality of computing devices, the plurality of files comprising at least one of a plurality of applications, a plurality of emails, a plurality of URLs, or a plurality of links, wherein the data points comprise the plurality of files; and

performing the transmission of the rule via the network to the computing device.

32. The method of claim 31 , further comprising generating the rule based on the at least one of the plurality of applications, the plurality of emails, the plurality of URLs, or the plurality of links.

Assignments (3)

Continuity (1)

References Cited (24)