Patent ID: 8484347
Filing Date: 2013-07-09
Classification: H04L

Abstract:
1. A method for malware detection in a peer-to-peer (P2P) network, the method comprises: receiving by a peer node a user request to download a data object from the P2P network; identifying a metadata object associated with the requested data object, wherein the metadata object includes at least a checksum of the data object; obtaining the identified metadata object associated with the requested data object; extracting from the metadata object the checksum of the data object; determining if the extracted checksum is associated with a malicious data object by comparing the checksum associated with the requested data object with a plurality of checksums associated with known malicious data objects stored in a local malware database; denying user request to download the data object from the P2P network if it is determined that the checksum is associated with a malicious data object and further notifying other peer nodes in the P2P network that the data object is malicious to prevent distribution of the malicious data object through the P2P network; or granting user request to download the data object from the P2P network if it is determined that the checksum is not associated with a malicious data object; downloading pieces of the requested data object from a plurality of peer nodes; analyzing each downloaded piece of the data object for presence of malware; when malware is detected in a piece of the data object, terminating downloading of remaining pieces of the data object; and when all of the pieces of the data object are downloaded, verifying authenticity of the downloaded data object by computing checksum of the downloaded data object and comparing the computed checksum with the extracted checksum, wherein if the computed checksum and the extracted checksum are identical, determining the downloaded data object is authentic, and if the computed checksum and extracted checksum are not identical, repeating the step of downloading the pieces of the requested data object from the plurality of peer nodes and analyzing each piece for the presence of malware.