US 10,476,899 B2 · Application phenotyping

Abstract

A collection of techniques is disclosed to allow for the detection of malware that leverages pattern recognition and machine learning to effectively provide “content-less” malware detection, i.e., detecting a process as being an ‘anomaly’ not based on its particular content, but instead based on comparisons of its behavior to known (and characterized) ‘trusted’ application behaviors, i.e., the trusted applications' “phenotypes” and/or the phenotypes of known malware applications. By analyzing the patterns of normal behavior performed by trusted applications as well as malware applications, one can build a set of sophisticated, content-agnostic behavioral models (i.e., “application phenotypes”)—and later compare the processes executed on a user device to the stored behavioral models to determine whether the actual measured behavior reflects a “good” application, or if it differs from the stored behavioral models to a sufficient degree and with a sufficient degree of confidence, thus indicating a potentially malicious application or behavior.

Claims25

Dependent claims

An application phenotyping system, the application phenotyping system comprising:

one or more processors;
and
a memory including instructions that, when executed, cause the one or more processors to:
determine two or more first-tier rules, respective ones of the two or more first-tier rules referencing a corresponding sequence of two or more operations to be performed by one or more applications to be executed on one or more devices;
identify second-tier rules, respective ones of the second-tier rules including a corresponding sequence of at least two of the first-tier rules;
identify one or more behaviors including a third sequence of at least two of the second-tier rules, the one or more behaviors to represent one or more normal activities to be performed by the one or more applications;
identify a phenotype for the one or more applications, the phenotype including one or more of the behaviors, the phenotype to represent the one or more of the normal activities identified for the one or more applications;
and
distribute an executable to the one or more devices, the executable to cause one or more of the devices to access the phenotype to identify malware.

6 more elements

A method for performing malware detection, the method comprising:

determining two or more first-tier rules, respective ones of the two or more first-tier rules referencing a corresponding sequence of two or more operations to be performed by one or more applications to be executed on one or more devices;
identifying second-tier rules, respective ones of the second-tier rules including a corresponding sequence of at least two of the first-tier rules;
identifying one or more behaviors including a third sequence of at least two of the second-tier rules, the one or more behaviors to represent one or more normal activities to be performed by the one or more applications;
identifying a phenotype for the one or more applications, the phenotype including one or more of the behaviors, the phenotype to represent one or more of the normal activities for the one or more applications;
and
distributing an executable to the one or more devices, the executable to cause one or more of the devices to access the phenotype to identify malware.

3 more elements

At least one storage disk or storage device, comprising instructions that, when executed, cause one or more processors of a first device to at least:

determine two or more first-tier rules, respective ones of the two or more first-tier rules referencing a corresponding sequence of two or more operations that a first application caused to occur on the first device;
determine one or more second-tier rules, respective ones of the one or more second-tier rules referencing a corresponding sequence of two or more of the two or more first-tier rules;
determine a first behavior;
when the first behavior is not associated with one or more behaviors associated with one or more normal activities to be performed by the first application, compare the first behavior to a phenotype for one or more known malware applications, the first behavior corresponding to a sequence of at least two of the second-tier rules;
determine whether the first behavior is indicative of malware based on the comparison of the first behavior to the phenotype for the one or more known malware applications;
and
perform a corrective action on the first device when the first behavior is indicative of malware.

4 more elements

A device, comprising:

one or more processors;
and
a memory including instructions that, when executed, cause the one or more processors to:
determine two or more first-tier rules, respective ones of the two or more first-tier rules referencing a corresponding sequence of two or more operations that a first application caused to occur on the device;
determine one or more second-tier rules, respective ones of the one or more second-tier rules referencing a corresponding sequence of two or more of the first-tier rules;
determine a first behavior;
when the first behavior is not associated with one or more behaviors associated with one or more normal activities to be performed by the first application, compare the first behavior to a phenotype for one or more known malware applications, the first behavior corresponding to a sequence of at least two of the second-tier rules;
determine whether the first behavior is indicative of malware based on the comparison of the first behavior to the phenotype for the one or more known malware applications;
and
perform a corrective action on the device when the first behavior is indicative of malware.

7 more elements

Dependencies are inferred from the claim text.

Application phenotyping

Life of this patent

Application phenotyping

Life of this patent

Abstract

Claims25