Symantec Corporation

Ca, Inc.

Everett J Lai

Patrick Gardner

Mark Kevin Kennedy

Haik A Mesropian

Kenneth J Coleman

Yuval Tarsi

Nivedhitha Raman

Thuan Vo

John Meade

Tamas Rudnai

Samuel Kim

Qun Li

The disclosed computer-implemented method for protecting against malicious content may include intercepting, by a security application installed on the computing device, an original message intended for a target application installed on the same computing device. The original message may include potentially malicious content. The security application may forward the original message to a security service. The computing device may receive a clean message from the security service, wherein the clean message includes a safe representation of the potentially malicious content. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for protecting against malicious content

Techniques for detecting malicious files are disclosed. In one embodiment, the techniques may be realized as a system for detecting malicious files comprising one or more computer processors. The one or more computer processors may be configured to collect at least one of a file or an attribute of the file. The one or more computer processors may further be configured to determine if the file is malicious. The one or more computer processors may further be configured to identify, if the file is determined to be malicious, a Uniform Resource Locator (URL) and a time frame associated with the file. The one or more computer processors may further be configured to detect a threat based on the URL and the time frame.

Techniques for detecting malicious files

A computer-implemented method for scanning a file is described. A Golomb-Compressed Sequence (GCS) index may be queried to determine whether GCS data is associated with the scanned data. The GCS index may be stored in a first storage medium and the GCS data may be stored in a second storage medium. The second storage medium may be different from the first storage medium. Upon determining the GCS data is associated with the scanned data, the location of the GCS data associated with the scanned data may be identified. The GCS data may be retrieved from the identified location. At least a portion of the retrieved GCS data may be analyzed. Based on the analysis of the retrieved GCS data, it may be determined whether to perform additional data querying.

Systems and methods for determining membership of an element within a set using a minimum of resources

Techniques for intelligently executing a digital signature are disclosed. In one embodiment, the techniques may be realized as a method for intelligently executing a digital signature. The method may include receiving a signature request from a user, wherein the signature request comprises a file. The method may also include performing a signature process on the file in response to receiving the signature request from the user. The method may further include scanning the signature request to generate one or more scan results, and transmitting an indication of the one or more scan results to a reputation service server.

Techniques for intelligently executing a digital signature

A computer-implemented method includes identifying a file and calculating a first identifier for the file. The method may also include identifying a first malware identifier that is associated with a first malware program. The method may further include comparing the first file identifier with the first malware identifier to determine whether the file comprises the first malware program. The method may include saving the first file identifier in a manner that allows the first file identifier to be retrieved for comparison with a second malware identifier. The second malware identifier may be associated with a second malware program. Various other methods and systems are also disclosed herein.

Methods and systems for scanning files for malware

A method for mitigating false-positives as detected by antivirus software comprising accessing an operating system file that has been identified as malware; creating a signature for the operating system file; comparing the created signature to a signature database; and, if the created signature is not found in the signature database, defining the operating system file as malware. An operating system file, as used herein, is any file included as a part of the operating system binary executable file set, as well as any files added from third party vendors that integrate with or plug into the operating system.

Growing community of inventors

Monterey, CA, United States of America

Everett J Lai