Trend Micro Inc.

Weimin Wu

Kai Yu

Xuewen Zhu

Tao Shen

Wei Zuo

Xingqi Ding

Jie Tang

Chengguo Zhang

Yiping Shen

Executable files are evaluated for malware in one or more lightweight executors, such as lightweight executor processes. An executable file is loaded and executed in a lightweight executor. Instructions in an execution path of the executable file are executed. Instructions in another execution path of the executable file are executed in another lightweight executor when a conditional branch instruction in an execution path has a suspicious condition. A fake kernel that mimics a real operating system kernel receives system calls, and responds to the system calls without servicing them in a way the real operating system kernel would. Runtime behavior of the executable file is observed for malware behavior. A response action, such as preventing the executable file from subsequently executing in a computer, is performed when the executable file is detected to be malware.

Dynamic evaluation of executable files in a lightweight executor

A virus detection engine determines that a file is suspected of being malware. A property is retrieved, along with the same file property of other executable files within the same folder. If the property value is similar to property values of the other files then the suspect file is benign. If the number of matches is greater than a threshold then the suspect file is benign. Other file properties of the suspect file are compared. If no file properties are similar to properties of the other files then the suspect file is malware and an alert is generated. The longest common subsequence compares property values. The same property value may be added to files within the same folder after these files are installed on the computer but before any detection takes place. A comparison of the same property values concludes that files are not malware, even if they are suspect.

Reduction of false positives in malware detection using file property analysis

A Web browser or operating system of a computer maintains a historical URL list of Web sites and Web pages that have been accessed in the past. When a prescan module of antivirus software performs an initial prescan of a computer before the antivirus software is installed, it queries this historical URL list to obtain the URLs that have been accessed in the past. These URLs are sent to a URL online query service located remotely over the Internet in order to determine the status of any of these URLs. Each URL is attempted to be matched with a database of known malicious URLs including associated malicious files and associated cleanup patterns. The query service then informs the requesting computer of the status of a particular URL sent, sending back any related malicious files and any appropriate cleanup pattern. A time period associated with each URL in the database indicates when it is known that the URL was malicious.

Pre-scan by historical URL access

Growing community of inventors

Nanjing, China

Weimin Wu