Virus localization using cryptographic hashing
US8578498B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Feb 29, 2012 |
| Grant date | Nov 5, 2013 |
| Priority date | — |
| Expiry date | Feb 29, 2032 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F21/565
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Methods for using integrity checking techniques to identify and locate computer viruses are provided. A method for virus localization for each of three types of virus infections is provided, including the steps of computing a sequence of file blocks, calculating hashes for the sequences of file blocks from a host file and calculating hashes for the same or related sequences of file blocks from an infected file, and comparing the hashes from host file to the hashes from the infected file from the same or related sequences of file blocks such that when some of said first hashes and said second hashes do not match, a location of a virus is output. Methods for computing the sequence of file blocks depending on the type of virus infection, and for calculating the hashes using a collision resistant hash function, a digital signature scheme, a message authentication code, or a pseudo-random function.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.