Patent ID: 8875294
Filing Date: 2014-10-28
Classification: G06F,H04L

Abstract:
1. A method for detecting and blocking computer malware, the method comprising: receiving by a security server information about a suspicious software object detected on a client computer using one or more malware detection methods; identifying, from the received information, the one or more malware detection methods used to detect the suspicious object on the client computer wherein the malware detection methods used on the client computer, wherein the malware detection methods used on the client computer include one or more methods selected from a behavior analysis method, a script emulation method, an executable file emulation method, a network address filtering method, and a network path filtering method; selecting a different malware detection method to check whether the suspicious object is malicious or clean, the different malware detection method including a different method selected from a signature matching method, a behavior analysis method, a script emulation method, an executable file emulation method, a checksum analysis method, a network address filtering method, and a network path filtering method, wherein selecting includes applying interaction rules that associate one or more malware detection methods used to detect the suspicious object on the client computer with the one or more different malware detection methods used on the security server, analyzing the suspicious object using the selected one or more different malware detection methods on the security server to check whether the object is malicious or clean; and when the object is determined to be malicious, classifying results of the analysis based on compatibility with one or more malware blocking methods used on the client computer, wherein the one or more malware blocking methods differ from the one or more malware detection methods used to detect the suspicious object on the client computer, and generating by the security server blocking instructions specific to the one or more compatible malware blocking methods used on the client computer for blocking the malicious object on the client computer.