Automatic threat detection of executable files based on static data analysis
AssigneeWebroot Inc.
InventorsMauritius Schmidtler, Gaurav Dalal, Reza Yoosoofmiya
Life of this patent
Estimating the term…
Abstract
Aspects of the present disclosure relate to threat detection of executable files. A plurality of static data points may be extracted from an executable file without decrypting or unpacking the executable file. The executable file may then be analyzed without decrypting or unpacking the executable file. Analysis of the executable file may comprise applying a classifier to the plurality of extracted static data points. The classifier may be trained from data comprising known malicious executable files, known benign executable files and known unwanted executable files. Based upon analysis of the executable file, a determination can be made as to whether the executable file is harmful.
Claims20
A computer-implemented method comprising:
- extracting a plurality of static data points from an executable file without decrypting or unpacking the executable file, wherein the plurality of static data points represent predefined character strings in the executable file;
- generating a feature vector from the plurality of static data points using a classifier trained to classify the plurality of static data points based on a collection of data comprising known malicious executable files, known benign executable files, and known unwanted executable files, wherein the collection of data comprises at least a portion of the plurality of static data points, and wherein one or more features of the feature vector are selectively turned on or off based on whether a value of one or more static data points from the plurality of extracted static data points is within a predetermined range;
- and
- evaluating the feature vector using support vector processing to determine whether the executable file is harmful.
A computer-readable storage device containing instructions, that when executed on at least one processor, causing the processor to execute a process comprising:
- extracting a plurality of static data points from an executable file without decrypting or unpacking the executable file, wherein the plurality of static data points represent predefined character strings in the executable file;
- generating a feature vector from the plurality of static data points using a classifier trained to classify the plurality of static data points based on a collection of data comprising known malicious executable files, known benign executable files and known unwanted executable files, wherein the collection of data comprises at least a portion of the plurality of static data points, and wherein one or more features of the feature vector are selectively turned on or off based on whether one or more values of one or more static data points from the plurality of extracted static data points is within a predetermined range;
- and
- evaluating the feature vector using support vector processing to determine whether the executable file is harmful.
A system comprising:
- at least one memory;
- and
- at least one processor operatively connected with the memory and configured to perform operation of:
- extracting a plurality of predefined character strings from an executable file without decrypting or unpacking the executable file;
- generating a feature vector from the plurality of predefined character strings using a classifier trained to classify the plurality of predefined character strings based on a collection of data comprising known malicious executable files, known benign executable files and known unwanted executable files, wherein the collection of data comprises at least a portion of one or more of the plurality of predefined character strings, and wherein one or more features of the feature vector are selectively turned on or off based on whether a value of one or more predefined character strings from the plurality of predefined character strings is within a predetermined range;
- and
- evaluating the feature vector using support vector processing to determine whether the executable file is harmful.
Dependencies are inferred from the claim text.