Patent ID: 8468602
Filing Date: 2013-06-18
Classification: G06F,H04L

Abstract:
1. A computer-implemented method, comprising: accessing, using a processor, a set of configuration parameters; accessing a set of identifiers of files known not to be malware; accessing a set of identifiers of files known to be malware; determining that a first file in a first host of a plurality of hosts should be analyzed by comparing parameters in the first file to the set of configuration parameters; generating a first hash of the first file in response to determining that a first file should be analyzed; determining that the first hash is not in the set of identifiers of files known not to be malware and that the first hash is not in the set of identifiers of files known to be malware; determining an entropy of the first file in response to determining that the first hash is not in the set of identifiers of files known not to be malware and is not in the set of identifiers of files known to be malware; comparing the entropy of the first file to an average entropy value of a file of a same file type as the first file; determining a statistical variance with respect to the entropy of the first file and the average entropy value when the entropy of the first file is higher than the average entropy value; sending the first file and information related to the first file, including the statistical variance, to be analyzed for malware in response to determining the statistical variance; and deleting the set of configuration parameters, the set of identifiers of files known not to be malware, and the set of identifiers of files known to be malware after sending the first file and related information to thwart detection of a malware scan by malware potentially present.