FRAGMENTED MALWARE HASH LOOKUP IN CLOUD REPOSITORY

    公开(公告)号:US20180288072A1

    公开(公告)日:2018-10-04

    申请号:US15471306

    申请日:2017-03-28

    Abstract: A server communicates over a network with a data inspection device (DID) having access to at least portions of a data file, and assists the DID with matching the data file to known data files represented on the server. A hash tree is constructed for each known data file. To construct each hash tree: the known data file is fragmented into contiguous fragments; spaced fragments separated based on an offset schema are selected from the contiguous fragments; and nodes of the hash tree are generated based on hashes of the spaced fragments, but not the skipped fragments. A hash of a fragment of the data file is received from the DID, and it is compared to the hash trees constructed using the offset schema. Compare results are sent to the data inspection device indicating a match or a mismatch between the received hash and the hash trees.

    Fragmented malware hash lookup in cloud repository

    公开(公告)号:US10567399B2

    公开(公告)日:2020-02-18

    申请号:US15471306

    申请日:2017-03-28

    Abstract: A server communicates over a network with a data inspection device (DID) having access to at least portions of a data file, and assists the DID with matching the data file to known data files represented on the server. A hash tree is constructed for each known data file. To construct each hash tree: the known data file is fragmented into contiguous fragments; spaced fragments separated based on an offset schema are selected from the contiguous fragments; and nodes of the hash tree are generated based on hashes of the spaced fragments, but not the skipped fragments. A hash of a fragment of the data file is received from the DID, and it is compared to the hash trees constructed using the offset schema. Compare results are sent to the data inspection device indicating a match or a mismatch between the received hash and the hash trees.

Patent Agency Ranking