Patent ID: 8769683
Filing Date: 2014-07-01
Classification: G06F,H04L

Abstract:
1. An apparatus for remote classification of malware, the apparatus comprising: a data storage system configured to store computer-readable code and data; a network interface communicatively connected to a network and configured to receive and send data via the network; a processor for accessing the data storage system and to execute said computer-readable code; computer-readable code for execution by the processor so as to receive a locality-sensitive hash (LSH) value and a checksum of a file from a host computer via the network interface; computer-readable code for execution by the processor so as to determine whether the LSH value of the file is similar to an LSH value in an entry in an LSH data structure; computer-readable code for execution by the processor so as to indicate that the file is a variant of known malware of the entry if the LSH value of the file is similar to the LSH value in the entry while the checksum of the file is different from the checksum in the entry; and computer-readable code for execution by the processor so as to determine that the file is a variant of an unknown malware when the LSH value of the file is similar to a group of LSH values that were previously received but not determined to be malware such that the LSH values in the group are not in any entry in the LSH data structure, wherein the group of LSH values has an adjustable predetermined number of matching bits, while the checksum of the file is different from checksums of the group; and computer-readable code for execution by the processor so as to indicate that files of the group of LSH values are variants of an unknown malware which is not of any entry in the LSH data structure.