Webroot Inc.

Prevx Limited

Open Text Corporation

Melvyn Morris

Paul Stubbs

Markus Hartwig

Darren Harter

Joseph Jaroch

In one aspect, a method of classifying a computer object as malware includes receiving at a base computer data about a computer object from each of plural remote computers on which the object or similar objects are stored. The data about the computer object received from the plural computers is compared in the base computer. The computer object is classified as malware on the basis of said comparison. In one embodiment, the data about the computer object includes one or more of: executable instructions contained within or constituted by the object; the size of the object; the name of the object; the logical storage location or path of the object on the respective remote computers; the vendor of the object; the software product and version associated with the object; and, events initiated by or involving the object when the object is created, configured or runs on the respective remote computers.

Methods and apparatus for malware threat research

Methods and apparatus for dealing with malware

Methods for classifying computer objects as malware and the associated apparatus are disclosed. An exemplary method includes, at a base computer, receiving data about a computer object from each of plural remote computers on which the object or similar objects are stored and or processed and counting the number of times in a given time period objects having one or more common attributes or behaviors that have been seen by the remote computers. The counted number is then compared with the expected number based on past observations, and if the comparison exceeds a predetermined threshold, the objects are flagged as unsafe or as suspicious.

Methods and apparatus for managing the expiration and execution of commands sent from a remote system having administration functions to an agent residing on a computer system are disclosed. An exemplary method includes receiving, at an agent, one or more commands, storing the one or more received commands, retrieving the one or more stored commands, and determining whether the one or more retrieved commands can be executed by comparing at least one time parameter associated with the agent to at least one time parameter associated with the one or more retrieved commands.

Managed execution and expiration of agent commands

Examples provided relate to methods and apparatus for managing the expiration and execution of commands sent from a remote system having administration functions to an agent residing on a computer system. An exemplary method may include receiving, at an agent, one or more commands, storing the one or more received commands, retrieving the one or more stored commands, and determining whether the one or more retrieved commands can be executed by comparing at least one time parameter associated with the agent to at least one time parameter associated with the one or more retrieved commands.

Methods for classifying computer objects as malware and the associated apparatus are disclosed. An exemplary method includes, at a base computer, receiving data about a computer object from each of plural remote computers on which the object or similar objects are stored or processed wherein the base computer comprises plural threat servers arranged to receive the data from the plural remote computers and apply rules or heuristics against the data in real time to determine whether or not the object is malware and to communicate the determination to the remote computers. The base computer includes at least one central server in communication with the threat servers and arranged to receive the data about objects from the threat servers to maintain a master database of data received about objects from all threat servers.

In one aspect, a method of determining the protection that a remote computer has from malware includes receiving at a base computer, details of all or selected security products operating on a remote computer, receiving similar information from other remote computers, and identifying malware process that were not identified by the security products installed on the other remote computers and having a same or similar combination of security products installed on the remote computer.

Growing community of inventors

Turnditch, United Kingdom

Melvyn Morris