System and methods for detection of new malicious executables
US7487544B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Jul 30, 2002 |
| Grant date | Feb 3, 2009 |
| Priority date | — |
| Expiry date | Aug 25, 2025 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F21/562
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
A system and methods for detecting malicious executable attachments at an email processing application of a computer system using data mining techniques. The email processing application may be located at the server or at the client or host. The executable attachments are filtered from said email, and byte sequence features are extracted from the executable attachment. The executable attachments are classified by comparing the byte sequence feature of the executable attachment to a classification rule set derived from byte sequence features of a data set of known executables having a predetermined class in a set of classes, e.g., malicious or benign. The system is also able to classify executable attachments as borderline when the difference between the probability that the executable is malicious and the probability that the executable is benign are within a predetermined threshold. The system can notify the user when the number of borderline attachments exceeds the threshold in order to refine the classification rule set.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.