Patent ID: 8689331
Filing Date: 2014-04-01
Classification: G06F

Abstract:
1. A method comprising: receiving a file comprising a plurality of micro-files embedded in the file; segmenting the file into two or more segments by extracting the micro-files, wherein each of the micro-files is a logical segment of the file; comparing at least one initial byte sequence of each segment with a plurality of reference byte sequences, each reference byte sequence corresponding to at least one of a plurality of file types; identifying a short list of a plurality of possible file types that indicate possible classifications of each of the segments using a heuristic file type detection based on the comparison of the initial byte sequence to the reference byte sequences, the short list containing fewer possible file types than a total number of the plurality of file types with corresponding reference byte sequences; comparing each of the segments of the file to corresponding logical segments of one or more predetermined models of normal file types, wherein the predetermined models correspond to the possible file types in the short list and are derived using one or more character patterns for correlation sequences associated with the normal file types; generating probability values for each segment indicating a probability of each segment being one of a particular file type in the short list based on the comparing each of the segments of the file to the corresponding logical segments; based on the probability values, determining whether or not the received file comprises any segment corresponding to any of the one or more predetermined models of normal file types; if the received file comprises any segment that does not correspond to any of the one or more predetermined models of normal file types, flagging the received file as a potential exploit; and if all of the segments of the received file correspond to one of the predetermined models of normal file types, flagging the received file as normal.