Patent ID: 8806629
Filing Date: 2014-08-12
Classification: G06F,H04L

Abstract:
1. An anti-malware system, comprising: a processing device comprising: a payload monitoring component monitoring incoming payloads, detects an event that triggers a process of generating a signature based on the incoming payloads, and generates a rule request based on information associated with an incoming payload, the rule request employed to determine if a signature is to be generated for the incoming payloads after detecting the event and prior to generating the signature; a policy defining component receiving one or more policies from a user, the one or more policies include at least one of a policy for signature generation or a policy for filtering incoming payloads; a signature determining component comprising a signature-determining rules component comparing the rule request with the one of more policies to determine if the signature is to be generated, the signature determining component generating the signature for the incoming payloads based at least in part on the rule request and the one or more policies, the signature employed to identify malware, the signature-determining rules component further attaching metadata to the generated signature, the metadata including a confidence metric associated with the generated signature, wherein the confidence metric for a particular signature indicates a likelihood that a payload triggering the particular signature is malware and the metadata facilitates identification and separation of a particular malware attack from other malware attacks; and a signature verifying component sending the generated signature and its associated metadata to the user for approval of the generated signature based on the confidence metric.