Automated malware family signature generation
AssigneePalo Alto Networks, Inc.
InventorsZhi Xu, Jiajie Wang, Xiao Zhang, Wenjun Hu
Life of this patent
Estimating the term…
Abstract
The automatic generation of malware family signatures is disclosed. A set of metadata associated with a plurality of samples is received. The samples are clustered. For members of a first cluster, a set of similarities shared among at least a portion of the members of the first cluster is determined. The similarities are evaluated for suitability as a malware family signature. Suitability is evaluated based on how well the similarities uniquely identify the members of the first cluster. In the event the similarities are determined to be suitable as a malware family signature, a signature is generated.
Claims25
A system, comprising:
- a processor configured to:
- receive a set of metadata associated with a plurality of samples;
- cluster the samples;
- determine, for members of a first cluster, a set of similarities shared among at least a portion of the members of the first cluster;
- evaluate the similarities for suitability as a malware family signature, wherein suitability is evaluated based at least in part on how well the similarities uniquely identify the members of the first cluster;
- and
- generate the malware family signature, including by generating one or more rules using at least a portion of the set of similarities and validating rule quality;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- receiving a set of metadata associated with a plurality of samples;
- clustering the samples;
- determining, for members of a first cluster, a set of similarities shared among at least a portion of the members of the first cluster;
- evaluating the similarities for suitability as a malware family signature, wherein suitability is evaluated based at least in part on how well the similarities uniquely identify the members of the first cluster;
- and
- generating the malware family signature, including by generating one or more rules using at least a portion of the set of similarities and validating rule quality.
A computer program product embodied in a computer readable storage memory and comprising computer instructions for:
- receiving a set of metadata associated with a plurality of samples;
- clustering the samples;
- determining, for members of a first cluster, a set of similarities shared among at least a portion of the members of the first cluster;
- evaluating the similarities for suitability as a malware family signature, wherein suitability is evaluated based at least in part on how well the similarities uniquely identify the members of the first cluster;
- and
- generating the malware family signature, including by generating one or more rules using at least a portion of the set of similarities and validating rule quality.
Dependencies are inferred from the claim text.