Patent ID: 9396333
Filing Date: 2016-07-19
CPC Classification: G06F

Claim Text:
1. A computer-implemented method of scanning a file for malicious codes, the method comprising: grouping malicious code patterns into a plurality of groups of malicious code patterns for different categories of files, each group of malicious code patterns in the plurality of groups of malicious code patterns comprising malicious code patterns that are grouped for scanning a particular category of files; intercepting a file access event to access a file in a computer; determining a category of the file; selecting a group of malicious code patterns from among the plurality of groups of malicious code patterns for the category of the file; loading the selected group of malicious code patterns into a memory of the computer where the file access event is detected; determining that the file access event is a suspicious file access event by applying a rule set associated with the file access event, the rule set including a rule that identifies a malicious code behavior of modifying an entry pointer in a header of the file to point to a section comprising malicious code; and in response to determining that the file access event is a suspicious file access event, scanning the file and detecting for malicious codes in the computer using the selected group of malicious code patterns by matching contents of the file with malicious code patterns in the selected group of malicious code patterns.