US 12,455,885 B2
Computing threat detection rule systems and methods
Michal Najman, Vsetin (CZ)
Assigned to Avast Software s.r.o., Prague (CZ)
Filed by Avast Software s.r.o., Prague (CZ)
Filed on Jul. 26, 2022, as Appl. No. 17/873,611.
Prior Publication US 2024/0037103 A1, Feb. 1, 2024
Int. Cl. G06F 16/20 (2019.01); G06F 16/242 (2019.01); G06F 16/2455 (2019.01)
CPC G06F 16/24564 (2019.01) [G06F 16/244 (2019.01)] 32 Claims
OG exemplary drawing
 
1. A method for performing a malware threat intelligence update, the method comprising:
receiving a plurality of data points comprising a plurality of files;
determining a plurality of identifiers for the plurality of data points, the determining the plurality of identifiers for the plurality of data points comprising applying a hash function to transform the plurality of data points to a plurality of byte sequences;
determining at least one term for each of the plurality of data points to determine a plurality of terms respectively associated with the plurality of identifiers;
compressing the plurality of data points, the compressing comprising determining, based on the plurality of terms respectively associated with the plurality of identifiers, a plurality of collections of identifiers respectively associated with the plurality of terms, and limiting the number of identifiers in each of the plurality of collections to a threshold number;
receiving a rule;
determining a plurality of conditions of the rule;
comparing the plurality of conditions of the rule to the plurality of terms to determine a plurality of matching terms respectively associated with corresponding collections of identifiers of the plurality of collections of identifiers;
determining an intersection of the corresponding collections of identifiers;
determining a number of the plurality of data points covered by the rule based on the intersection of the corresponding collections of identifiers; and
updating malware threat intelligence of a computing device based on the number of the plurality of data points covered by the rule, the updating comprising performing a transmission of the rule to the computing device based on the number of the plurality of data points covered by the rule;
detecting an electronic message received by the computing device;
comparing the plurality of conditions of the rule to the electronic message received by the computing device; and
blocking the electronic message based on the comparing of the plurality of conditions of the rule to the electronic message.