Patent ID: 9009820
Filing Date: 2015-04-14
Classification: G06F,H04L

Abstract:
1. A method comprising: receiving, at a first malware detection node from a malware detection system, a request to apply a first malware detection technique to a file, the request being in a first format that the malware detection system is configured to use, the request including an instruction having a configuration parameter in the first format to be used in application of the first malware detection technique to the file, the configuration parameter being separate from the file, the malware detection system configured to determine whether the file is suspected malware by analyzing a plurality of predefined result states received in response to the first malware detection node applying the first malware detection technique to the file and a second malware detection node applying a second malware detection technique to the file; determining, using an agent and a malware system definition, the agent coupled between the malware detection system and the first malware detection node, that the first format of the request and the configuration parameter are incompatible with a malware detection engine of the first malware detection node; formatting, by translation logic and the malware system definition of the first malware detection node and in response to determining that the first format of the request and the configuration parameter are incompatible with a malware detection engine, the request and the configuration parameter of the instruction in a second format different than the first format; providing, by the first malware detection node, the file and the configuration parameter to the malware detection engine, the configuration parameter being in the second format, the malware detection engine configured to process files received in requests of the second format but not files received in the first format of the request; applying, by the malware detection engine, the first malware detection technique to the file based at least in part on the configuration parameter in the second format, the configuration parameter identifying an application and a version of the application to open the file, a time limit, a format of results, a reason the file is suspect, and a log file; receiving, at the first malware detection node, at least one result in the second format from the malware detection engine applying the first malware detection technique to the file; determining, at the first malware detection node, at least one predefined result state of the plurality of predefined result states based on the received at least one result; and reporting, by the first malware detection node, the at least one predefined result state to the malware detection system.