US 10,122,742 B1Granted

Classifying software modules based on comparisons using a neighborhood distance metric

AssigneeEMC IP Holding Company LLC

InventorsAlina M. Oprea, Zhou Li, Ahmet Buyukkayhan

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method comprises obtaining at least a first software module not classified as benign or potentially malicious, extracting a set of features associated with the first software module, the set of features comprising static features, behavior features and context features, identifying a first cluster comprising one or more known software modules previously classified as benign, computing distance metrics between the extracted feature set of the first software module and feature sets of respective ones of the known software modules in the first cluster, classifying the first software module as one of benign and potentially malicious based on a comparison between the computed distance metrics and a neighborhood distance metric based on distances between feature sets of the known software modules in the first cluster, and modifying access by a given client device to the first software module responsive to classifying the first software module as potentially malicious.

Claims19

Dependent claims

A method comprising:

obtaining at least a first software module not classified as benign or potentially malicious;
extracting a set of features associated with the first software module, the set of features comprising one or more static features, one or more behavior features and one or more context features;
identifying a first cluster, the first cluster comprising one or more known software modules previously classified as benign;
computing distance metrics between the extracted feature set of the first software module and feature sets of respective ones of the known software modules in the first cluster;
classifying the first software module as one of benign and potentially malicious based on a comparison between the computed distance metrics and a neighborhood distance metric, the neighborhood distance metric being based on distances between feature sets of the known software modules in the first cluster;
and
modifying access by a given client device to the first software module responsive to classifying the first software module as potentially malicious;
wherein computing the distance metrics comprises assigning penalty values for one or more features missing in the extracted feature set of the first software module;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

6 more elements

A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device cause the at least one processing device:

to obtain at least a first software module not classified as benign or potentially malicious;
to extract a set of features associated with the first software module, the set of features comprising one or more static features, one or more behavior features and one or more context features;
to identify a first cluster, the first cluster comprising one or more known software modules previously classified as benign;
to compute distance metrics between the extracted feature set of the first software module and feature sets of respective ones of the known software modules in the first cluster;
to classify the first software module as one of benign and potentially malicious based on a comparison between the computed distance metrics and a neighborhood distance metric, the neighborhood distance metric being based on distances between feature sets of the known software modules in the first cluster;
and
to modify access by a given client device to the first software module responsive to classifying the first software module as potentially malicious;
wherein computing the distance metrics comprises assigning penalty values for one or more features missing in the extracted feature set of the first software module.

5 more elements

An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured:
to obtain at least a first software module not classified as benign or potentially malicious;
to extract a set of features associated with the first software module, the set of features comprising one or more static features, one or more behavior features and one or more context features;
to identify a first cluster, the first cluster comprising one or more known software modules previously classified as benign;
to compute distance metrics between the extracted feature set of the first software module and feature sets of respective ones of the known software modules in the first cluster;
to classify the first software module as one of benign and potentially malicious based on a comparison between the computed distance metrics and a neighborhood distance metric, the neighborhood distance metric being based on distances between feature sets of the known software modules in the first cluster;
and
to modify access by a given client device to the first software module responsive to classifying the first software module as potentially malicious;
wherein computing the distance metrics comprises assigning penalty values for one or more features missing in the extracted feature set of the first software module.

7 more elements

Dependencies are inferred from the claim text.