Patent ID: 8756695
Filing Date: 2014-06-17
Classification: G06F

Abstract:
1. A method comprising: establishing a set of rules for each of a plurality of fields in a binary file, each rule in the set having associated therewith a suspiciousness score indicative of a potential for adverse operation of a computer if a target process executing on the computer were to interpret contents of the corresponding field; retrieving the contents of one of the fields in the binary file in a manner that excludes transfer of control of the computer responsive to the interpretation thereby of the contents; evaluating the retrieved contents against the set of rules for the corresponding one of the fields to determine the suspiciousness score for the corresponding one of the fields; and indicating that the binary file is suspicious upon affirming that the suspiciousness score meets a criterion, wherein the establishing of the rules includes determining a statistical distribution of binary data values indicative of a probability that a particular binary data value contained in the field is interpretable by the target process without the adverse operation, assigning a value to the suspiciousness score for the corresponding rule associated with the field in accordance with the statistical distribution, assigning a set of descriptors to each rule indicative of a corresponding discrepancy in conformance to the rule, and assigning the suspiciousness score to each of the descriptors in accordance with a severity of the discrepancy.