Patent ID: 9367687
Filing Date: 2016-06-14
CPC Classification: G06F,H04L

Claim Text:
1. A method of detecting malware, the method comprising: from a database of historic network traffic, identifying a suspect file that traveled through a network as being suspected malware; deriving a distinctive signature based on contents of the suspect file; and scanning a computerized device of the network for the distinctive signature to detect whether the suspect file is present on the computerized device, wherein scanning the computerized device of the network for the distinctive signature to detect whether the suspect file is present on the computerized device includes scanning the computerized device of the network for the distinctive signature to detect whether the suspect file is stored within persistent storage of the computerized device; wherein identifying the suspect file includes: performing file extraction on the database, the database storing packets captured from the network, to extract from the captured packets a set of executable files traversing the network; performing file analysis on the set of executable files, assigning a suspicion score to each of the executable files based on a set of heuristic functions associated with malware; and placing executable files whose suspicion score exceeds a predetermined threshold score in a staging directory by, on a scheduled periodic basis, for each executable file of the set of executable files: comparing the suspicion score associated with that executable file to the predetermined threshold score; and if and only if the suspicion score associated with that executable file exceeds the predetermined threshold score, copying that executable file to the staging directory.