Preventing a malicious computer application from executing in a computing environment

A computer-implemented method for preventing a malicious computer application from executing in a computing environment, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

• identifying a base graph comprising edges and vertices, the base graph related to malicious computer applications;
• identifying a perturbed graph comprising edges and vertices, the perturbed graph representing a summarized version of the base graph;
• determining an importance of each of the edges in the base graph with respect to the base graph using an Edge Current-Flow Based Betweenness Centrality (ECFBBC) metric to generate an ECFBBC value for the edge;
• identifying the edges in the base graph that match the edges in the perturbed graph;
• determining an initial utility value for the perturbed graph by summing the ECFBBC values of the edges in the base graph that match the edges in the perturbed graph;
• determining a penalized utility value for the perturbed graph by decreasing the initial utility value for each spurious edge in the perturbed graph by a penalty value of the spurious edge;
• determining whether the penalized utility value is above a threshold utility value;
• in response to determining that the penalized value is above the threshold utility value, employing the perturbed graph to analyze a computer application and determine that the computer application is malicious;
• and
• performing a security action on the malicious computer application to prevent the malicious computer application from executing in a computing environment.

One or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform a method for preventing a malicious computer application from executing in a computing environment, the method comprising:

• identifying a base graph comprising edges and vertices, the base graph related to malicious computer applications;
• identifying a perturbed graph comprising edges and vertices, the perturbed graph representing a summarized version of the base graph;
• determining an importance of each of the edges in the base graph with respect to the base graph using an Edge Current-Flow Based Betweenness Centrality (ECFBBC) metric to generate an ECFBBC value for the edge;
• identifying the edges in the base graph that match the edges in the perturbed graph;
• determining a utility value for the perturbed graph by summing the ECFBBC values of the edges in the base graph that match the edges in the perturbed graph;
• determining whether the utility value is above a threshold utility value;
• in response to determining that the utility value is above the threshold utility value, employing the perturbed graph to analyze a computer application and determine that the computer application is malicious;
• and
• performing a security action on the malicious computer application to prevent the malicious computer application from executing in a computing environment.