Mcafee, Inc.

Anthony Vaughan Bartram

Igor G Muttik

Fraser Peter Howard

Adrian M M T Dunbar

Alexander James Hinchliffe

Steve O Hearnden

Anthony Abrahams

Irene Michlin

A method in one example implementation includes generating a plurality of transformed views of an object in a network environment and generating a plurality of filtered information sets. The method further includes detecting a suspect correlation based on an analysis of at least some of the plurality of transformed views and of at least some of the plurality of filtered information sets. In a more specific embodiment, the analysis includes an original view of the object. Other more specific embodiments include applying filters to selected views of the object, where each of the filters is associated with a different obfuscation type. Applying the filters includes transforming obfuscation elements in the plurality of transformed views, where the object contains the one or more obfuscation elements.

System and method for detecting malware by transforming objects and analyzing different views of objects

A system, method, and computer program product are provided for determining whether code is unwanted based on the decompilation thereof. In use, code is identified and the code is decompiled. In addition, it is determined whether the code is unwanted, based on the decompiled code.

System, method, and computer program product for determining whether code is unwanted based on the decompilation thereof

A naming system, method and computer program product are provided. In use, unwanted code including at least one attribute is identified. In addition, an encoded name is generated for the unwanted code, where at least a portion of the encoded name represents the at least one attribute of the unwanted code.

System, method and computer program product for generating an encoded name for unwanted code

A method for creating a set of genericized signatures for detection of byte sequences in computer code includes accessing a first set of sample signatures, determining a maximum number of wildcards that a wildcarded signature may comprise, determining a first wildcarded signature corresponding to the first set of sample signatures, evaluating the first wildcarded signature, and repeating the steps of evaluating for any second wildcarded signatures. Each of the signatures corresponds to an instance of malware. The evaluation further includes if the number of wildcards in the first wildcarded signature exceeds the maximum number of wildcards, determining a plurality of second wildcarded signatures corresponding to a plurality of subsets of the set of sample signatures. The evaluation further includes if the number of wildcards in the first wildcarded signature is less than or equal to the maximum number of wildcards, adding the first wildcarded signature to a set of genericized signatures.

Method and system for automatic invariant byte sequence discovery for generic detection

A system, method and computer program product are provided including identifying a network communication and determining whether the network communication is initiated by a process associated with unwanted code. As an option, a firewall may identify the network communication and computer code may determine whether the network communication is initiated by a process associated with unwanted code. As an option, in one embodiment, a method may be provided whereby unwanted code identified by network communication may be quarantined and/or the process associated with the unwanted code may be terminated.

Growing community of inventors

Milton Keynes, United Kingdom

Anthony Vaughan Bartram