Trend Micro Inc.

Chih-Kun Ho

Sung-Ching Lin

Ren-Chien Chou

Te-Ching Chen

Yung-Hsiang Lee

Chen-Wei Hsiao

Ming-Hui Teng

Chiu-Ming Wang

Tsun-Sheng Chuo

Chien Ping Lo

An endpoint system receives a target file for evaluation for malicious scripts. The original content of the target file is normalized and stored in a normalized buffer. Tokens in the normalized buffer are translated to symbols, which are stored in a tokenized buffer. Strings in the normalized buffer are stored in a string buffer. Tokens that are indicative of syntactical structure of the normalized content are extracted from the normalized buffer and stored in a structure buffer. The content of the tokenized buffer and counts of tokens represented as symbols in the tokenized buffer are compared against heuristic rules indicative of malicious scripts. The contents of the tokenized buffer and string buffer are compared against signatures of malicious scripts. The contents of the tokenized buffer, string buffer, and structure buffer are input to a machine learning model that has been trained to detect malicious scripts.

System and method for detecting malicious scripts

A file or other data unit may be scanned for malicious code by calculating a hash value of a portion of the file or data unit and transmitting the hash value of the portion over a computer network to a remotely located server computer. In the server computer, the hash value of the portion may be compared to hash values of malicious codes. The server computer may send the result of the comparison over the computer network to the client computer. The client computer may send one or more additional hash values of other portions of the file or data unit when the result indicates that the hash value of the portion matches a hash value of malicious code. Otherwise, the client computer may deem the file or data unit to be free of malicious code.

Interactive malicious code detection over a computer network

The invention generally provides an antivirus network system and method having a virtual scanning processor with plug-in functionalities. A preferred embodiment of the system according to the invention primarily comprises an antivirus scanning module operable with an operating system (OS), an antivirus database comprising a plurality of computer virus signatures, a library of external antivirus instructions wherein an antivirus system external to the network system is operable to update the external instructions, a virtual scanning processor further comprising a processor emulator operable to execute a plurality of internal antivirus instructions in detecting computer viruses based on the virus signatures, and a plug-in module connected to the processor emulator and the library and receiving the external instructions from the library, wherein the processor emulator is operable to execute the external instructions. The virtual scanning processor according to the invention is advantageously hardware-independent, i.e., is operable transparently to the hardware of a computer or network system. Moreover, the virtual scanning processor according to the invention is advantageously cross-platform, i.e., is operable transparently to, and regardless of the type of, the operating system (OS) it is operating in conjunction with.

System and method having an antivirus virtual scanning processor with plug-in functionalities

Growing community of inventors

Taipei, Taiwan

Chih-Kun Ho