Symantec Corporation

Ryan Pereira

Ian Oliver

Rolf Repasi

Simon Clausen

Neil Younusov

A method, and associated system and computer program product, of validating site data. The method includes the steps of, in a processing system, receivingan indication of site data, performing a comparisonof the indication to site data criteria, and validating or invalidatingthe indication based on a result of the comparison. The indication of site data could be at least part of a webpage, a link to a webpage, a Uniform Resource Locator, an IP address, at least part of an AJAX page, and/or at least part of a document.

Method and system for validating site data

A method, system, computer program product and/or a computer readable medium of instructions for detecting one or more entities which are able to reinfect a processing system with malicious software. The method includes: monitoring, in the processing system, activity indicative of the malicious software reinfecting the processing system; in response to detecting the activity, storing a record of the activity and one or more entities associated with the activity; determining if the malicious software has reinfected the processing system; and in response to determining that the malicious software has reinfected the processing system, analysing the record to detect the one or more entities which were associated with the activity that caused and/or assisted in reinfecting the processing system with the malicious software. There is also disclosed a method, system, computer program product and/or a computer readable medium of instructions for detecting a variant of malicious software in a processing system.

Malicious software detection

A method, system, computer program product and/or computer readable medium of instructions to detect malicious activity. The method comprises intercepting an activity in a processing system, wherein a requesting entity requests the activity to be performed in relation to a target entity; determining, using a filter module if the activity is suspicious or non-suspicious; and in response to determining that the activity is suspicious, analysing at least one of the activity, the requesting entity and the target entity using an analysis module to detect malicious activity. There is also disclosed a method, system, computer program product and/or computer readable medium of instructions to facilitate the detection of malicious activity.

Detecting malicious activity

A method of determining an indication of an invalid request, the method including the steps of, in a processing system: receiving data at step, comparing at least a portion of the received data to predetermined criteria at step, determining an indication of an invalid request included in the data at step, and generating a notification in accordance with the determined invalid request at step

Determining an invalid request

A method/system/computer program for obtaining the network origin of a downloaded entity of interest (e.g. a threat or malicious software). The method includes recording the network locations of at least some files downloaded to a processing system and recording the physical locations of the at least some files stored in one or more storage devices of the processing system. Then, identifying an entity of interest in the processing system and searching the recorded network locations and the recorded physical locations for the network location and the physical location of the entity of interest. Then, if the network location and the physical location of the entity of interest is identified, transmitting the network location and the physical location of the entity of interest to a remote processing system.

Obtaining network origins of potential software threats

A method/system for determining a group of related entities of interest in one or more processing systems. The method comprises identifying a starting entity from one or more entities in the one or more processing systems, then obtaining, based on an entity type of the starting entity, a first set of rules for determining at least one other related entity, and then determining, using the first set of rules, the at least one related entity.

Determination of related entities

A method, system, computer program product and/or computer readable medium of instructions for detecting malicious software, comprising intercepting a request to perform an activity in a processing system; determining an entity associated with the activity, wherein the entity comprises at least one of: a requesting entity of the activity; and a target entity of the activity; analysing the entity and the activity to determine if the request is associated with malicious software; and in the event that the request is determined to be associated with malicious software, restricting the request to perform the activity in the processing system.

Real time malicious software detection

A method, system, computer program product, and/or computer readable medium of instructions for identifying a malicious entity in a processing system, comprising determining an entity threat value for an entity, the entity threat value being indicative of a level of threat that the entity represents to the processing system, wherein the entity threat value is determined based on one or more characteristics of the entity; and compare the entity threat value to an entity threat threshold to identify if the entity is malicious. In another form, there is provided a method, system, computer program product, and/or computer readable medium of instructions for identifying a malicious entity in a processing system, comprising determining one or more input values indicative of an entity; and performing a fuzzy logic analysis in relation to the one or more input values to identify if the entity is malicious.

Growing community of inventors

New South Wales, Australia

Ryan Pereira