Discrimination of malicious changes to digital information using multiple signatures

Claim 2

A computer implemented method for determining whether changes to a set of digital information are innocent or malicious, comprising the steps of: using a reference separation algorithm, separating the set of digital information into a plurality of reference subsets of digital information, the step of separating the set of digital information into reference subsets being done at a reference time; using a reference selection algorithm, selecting a plurality of the reference subsets; using a reference information algorithm associated with each respective selected reference subset, deriving characteristic reference subset information from the respective selected reference subset; storing the derived characteristic reference subset information; using a test separation algorithm, separating the set of digital information into a plurality of test subsets of digital information, the step of separating the set of digital information into test subsets being done at a test time, the test time being later than the reference time; using a test selection algorithm, selecting a plurality of the test subsets, each selected test subset corresponding to a selected reference subset; using a test information algorithm associated with each respective selected test subset, deriving characteristic test subset information from the respective selected test subset; comparing the derived characteristic test subset information to the derived characteristic reference subset information to produce a set of differences; and analyzing the set of differences in accordance with a set of rules to determine whether the set of digital information at test time is changed from the set of digital information at reference time and if changed to determine whether the change is considered malicious or innocent, each of said rules specifying a particular combination of the selected test subsets, and specifying a state for the characteristic information of each selected test subset of each said particular combination relative to the characteristic information of each corresponding selected reference subset, and specifying for each said particular combination having its selected test subsets in said specified stake either a malicious conclusion or an innocent conclusion.

Claim 3

A method, as in claim 1, where the information generated by the reference information algorithm and the test information algorithm includes information about the structure of the reference and test subsets.

Claim 4

A method, as in claim 1, where the information generated by the reference information algorithm and the test information algorithm includes other system-maintained information about the reference and test subsets.

Claim 5

A method, as in claim 2, where the reference information algorithm and the test information algorithm are the same for each respective reference and test subset.

Claim 6

A method, as in claim 1, where the information generated by the reference information algorithm and the test information algorithm comprises signature information about the reference and test subsets.

Claim 7

A method, as in claim 5, where the reference information algorithm and the test information algorithm are the same for each respective reference and test subset.

Claim 8

A method, as in claim 1, where the reference and test subsets include the entire set of digital information.

Claim 9

A method, as in claim 1, where the rules establish that the change is malicious if the set of differences indicates that the entry point to the set of digital information has been moved, but that most of the information has remained the same.

Claim 10

A method, as claim 1, where the rules establish that a simple patch has occurred and the change is not malicious if the set of differences indicates that the size of the set of information has remained the same and the entrypoint information has not changed but that one area of the set of information has changed.

Claim 11

A method, as in claim 1, where the digital information is a structured object and the separation algorithms separate the object into reference and test subsets comprising fixed-sized blocks.

Claim 12

A method, as in claim 1, where the digital information is a file with multiple resource forks and the separation algorithms separate the forks into separate subsets.

Claim 13

A method, as in claim 1, where the test separation algorithm uses information from the stored reference subset information to determine how to separate the digital data at test time.

Claim 14

A computer implemented system for determining whether changes to a set of digital information are innocent or malicious, comprising: a computer having a data storage element and a platform for executing one or more application programs; and an application program comprising means for implementing the steps of: using a reference separation algorithm, separating the set of digital information into a plurality of reference subsets of digital information, the step of separating the set of digital information into reference subsets being done at a reference time; using a reference selection algorithm, selecting a plurality of the reference subsets; using a reference information algorithm associated with each respective selected reference subset, deriving characteristic reference subset information from the respective selected reference subset; storing the derived characteristic reference subset information; using a test separation algorithm, separating the set of digital information into a plurality Of test subsets of digital information, the step of separating the set of digital information into test subsets being done at a test time, the test time being later than the reference time; using a test selection algorithm, selecting a plurality of the test subsets, each selected test subset corresponding to a selected reference subset; using a test information algorithm associated with each respective selected test subset, deriving characteristic test subset information from the respective selected test subset; comparing the derived characteristic test subset information to the derived characteristic reference subset information to produce a set of differences; and analyzing the set of differences in accordance with a set of rules to determine whether the set of digital information at test time is changed from the set of digital information at reference time and if changed to determine whether the change is considered malicious or innocent, each of said rules specifying a particular combination of the selected test subsets, and specifying a state for the characteristic information of each selected test subset of each said particular combination relative to the characteristic information of each corresponding selected reference subset, and specifying for each said particular combination having its selected test subsets in said specified state either a malicious conclusion or an innocent conclusion.

Claim 15

A computer implemented system for determining whether changes to a set of digital information are innocent or malicious, comprising: a computer having a data storage element and a platform for executing one or more application programs; and an application program comprising means for implementing the steps of: using a reference separation algorithm, separating the set of digital information into a plurality of reference subsets of digital information, the step of separating the set of digital information into reference subsets being done at a reference time; using a reference selection algorithm, selecting a plurality of the reference subsets; using a reference information algorithm associated with each respective selected reference subset, deriving characteristic reference subset information from the respective selected reference subset; storing the derived characteristic reference subset information; using a test separation algorithm, separating the set of digital information into a plurality Of test subsets of digital information, the step of separating the set of digital information into test subsets being done at a test time, the test time being later than the reference time; using a test selection algorithm, selecting a plurality of the test subsets, each selected test subset corresponding to a selected reference subset; using a test information algorithm associated with each respective selected test subset, deriving characteristic test subset information from the respective selected test subset; comparing the derived characteristic test subset information to the derived characteristic reference subset information to produce a set of differences; and analyzing the set of differences in accordance with a set of rules to determine whether the set of digital information at test time is changed from the set of digital information at reference time and if changed to determine whether the change is considered malicious or innocent, each of said rules specifying a particular combination of the selected test subsets, and specifying a state for the characteristic information of each selected test subset of each said particular combination relative to the characteristic information of each corresponding selected reference subset, and specifying for each said particular combination having its selected test subsets in said specified state either a malicious conclusion or an innocent conclusion.

Claim 16

A system, as in claim 13, further comprising: a link connecting the system to one or more other computers, whereby the application program determines whether or not digital information sent to the computer system over the link has been changed maliciously.