Apparatus for selecting representative token from detection names of multiple vaccines, method therefor, and computer readable recording medium storing program for performing the method
AssigneeEstsecurity Corp.
InventorsSang Won Kim, Eui Tak Kim, Wook Hyun Jung
Life of this patent
Estimating the term…
Abstract
An apparatus for selecting a representative token of the present invention includes a token graph generation unit configured to extract a plurality of tokens from a plurality of detection names for malicious files and generate a detection name token graph representing a relationship between the extracted plurality of tokens, and a representative token selection unit configured to select a representative detection name token for the input file based on the detection name token graph.
Claims10
An apparatus for selecting a representative token, comprising:
- a token graph generation processor;
- a representative token selection processor;
- and
- a memory with instructions executable by the token graph generation and representative token selection processor,
- the token graph generation processor configured to extract a plurality of tokens from a plurality of different detection names for a malicious file and generate a detection name token graph representing a relationship between the extracted plurality of tokens;
- and
- the representative token selection processor configured to select a representative detection name token for the malicious file based on the detection name token graph,
- wherein the representative token selection processor is further configured:
- to receive the plurality of different detection names for the malicious file from a plurality of vaccine servers;
- to extract the plurality of tokens by tokenizing each of the plurality of different detection names for the malicious file, and
- to calculate a common index which represents a frequency in which a token is used in common in a plurality of vaccine engines, and an importance index which represents an importance of the token among the extracted plurality of tokens,
- to select at least one index of the common index and the importance index as a reference and sort the extracted plurality of tokens in the order of the highest index selected as the reference,
- to designate the extracted plurality of tokens to be analyzed one by one in the sorted order, and
- if the number of subsets for a next token to a designated token to be analyzed in the order is less than a predetermined value, to select the designated token as the representative detection name token with reference to the relationship between the plurality of tokens from the detection name token graph.
A method for selecting a representative token, using an apparatus having a token graph generation processor, a representative token selection processor, and a memory with instructions executable by the token graph generation and representative token selection processor, the method comprising:
- extracting, by the token graph generation processor, a plurality of tokens from a plurality of different detection names for a malicious file, and generating a detection name token graph representing a relationship between the extracted plurality of tokens;
- and
- selecting, by the representative token selection processor, a representative detection name token for the malicious file based on the detection name token graph;
- wherein the step of selecting the representative detection name token further comprises:
- receiving the plurality of different detection names for the malicious file from a plurality of vaccine servers;
- extracting the plurality of tokens by tokenizing each of the plurality of different detection names for the malicious file;
- calculating a common index which represents a frequency in which a token is used in common in the plurality of vaccine servers, and an importance index which represents an importance of the token among the extracted plurality of tokens;
- selecting at least one index of the common index and the importance index as a reference and sorting the extracted plurality of tokens in the order of the highest index selected as the reference;
- designating the extracted plurality of tokens to be analyzed one by one in the sorted order;
- and
- making an inquiry of the number of nodes having a subset relationship for a next token to a designated token in the order in the detection name token graph, and if the number of inquired nodes having the subset relationship is less than a predetermined value, selecting the designated token as the representative detection name token.
A non-transitory computer readable recording medium in which a program for performing a method for selecting a representative token using an apparatus having a token graph generation processor, a representative token selection processor, and a memory with instructions executable by the token graph generation and representative token selection processor on a computer is recorded, the method comprising:
- extracting, by the token graph generation processor, a plurality of tokens from a plurality of different detection names for a malicious file, and generating a detection name token graph representing a relationship between the extracted plurality of tokens;
- and
- selecting, by the representative token selection processor, a representative detection name token for the malicious file based on the detection name token graph,
- wherein the step of selecting the representative detection name token further comprises:
- receiving the plurality of different detection names for the malicious file from a plurality of vaccine servers;
- extracting the plurality of tokens by tokenizing each of the plurality of different detection names for the malicious file;
- calculating a common index which represents a frequency in which a token is used in common in the plurality of vaccine servers, and an importance index which represents an importance of the token among the extracted plurality of tokens;
- selecting at least one index of the common index and the importance index as a reference and sorting the extracted plurality of tokens in the order of the highest index selected as the reference;
- designating the extracted plurality of tokens to be analyzed one by one in the sorted order;
- and
- making an inquiry of the number of nodes having a subset relationship for a next token to a designated token in the order in the detection name token graph, and if the number of inquired nodes having the subset relationship is less than a predetermined value, selecting the designated token as the representative detection name token.
Dependencies are inferred from the claim text.