Systems and methods for verifying trust of executable files

Abstract

Systems and methods for validating integrity of an executable file are described. In one aspect, the systems and methods determine that an executable file is being introduced into a path of execution. The executable file is then automatically evaluated in view of multiple malware checks to detect if the executable file represents a type of malware. If the executable file represents a type of malware, a protection path is implemented.

Description

technical field [0001] This disclosure relates to data authentication and verification. Background technique [0002] Executable files (such as binary images, object code, portable executables (PE), macros, Visual Basic Scripting (VBS)-like scripts, etc.) are dangerous to run on a computer when the computer contains a virus or Trojan horse. A virus is a program or code that alters a binary image on a disc, especially against the user's will and without the user's knowledge. Viruses can also replicate themselves. Simple viruses that continuously replicate themselves are relatively easy to generate. Even simple viruses are dangerous because they can quickly use up all available memory and bring down the system. Some viruses can transmit themselves over a network and bypass security systems. Unlike viruses, Trojan horses do not replicate themselves but they can be destructive, often masquerading as benign applications that can be launched by trusted users. One type of Troj...

AI Technical Summary

Problems solved by technology

Worse, files whose integrity is verified at install time can be corrupted after installation, invalidating any initial confidence verification estimates

Furthermore, today's computer systems have no built-in mechanism for distinguishing between trusted and suspicious or malicious executable object code

Images