US 11,379,581 B2 · System and method for detection of malicious files

Abstract

A method for detection of malicious files includes training a mapping model for mapping files in a probability space. A plurality of characteristics of an analyzed file is determined based on a set of rules. A mapping of the analyzed file in probability space is generated based on the determined plurality of characteristics. A first database is searched using the generated mapping of the analyzed file to determine whether the analyzed file is associated with a family of malicious files. The first database stores mappings associated with one or more families of malicious files. In response to determining that the analyzed file is associated with the family of malicious files, a selection of one or more methods of malware detection is made from a second database. The second database stores a plurality of malware detection methods. The selected method is used to detect the associated family.

Claims20

Dependent claims

A method for detection of malicious files, the method comprising:

training a mapping model for mapping files in a probability space characterizing one or more families of malicious files;
determining a plurality of characteristics of an analyzed file based on a set of rules;
generating, using the mapping model, a mapping of the analyzed file in the probability space based on the determined plurality of characteristics;
searching a first database using the generated mapping of the analyzed file, wherein the first database stores mappings associated with one or more families of malicious files;
determining whether the analyzed file is associated with a family of malicious files,;
and
in response to determining that the analyzed file is associated with the family of malicious files, selecting one or more methods of malware detection from a second database, wherein the second database stores a plurality of malware detection methods;
and
detecting the associated family of malicious files using the selected one or more methods.

6 more elements

A system for detection of malicious files, the system comprising:

a hardware processor and a memory storing instructions for execution by the hardware processor, wherein the hardware processor and the memory are configured to:
train a mapping model for mapping files in a probability space characterizing one or more families of malicious files;
determine a plurality of characteristics of an analyzed file based on a set of rules;
generate a mapping of the analyzed file in the probability space based on the determined plurality of characteristics;
search a first database using the generated mapping of the analyzed file, wherein the first database stores mappings associated with one or more families of malicious files;
determine whether the analyzed file is associated with a family of malicious files,;
and
in response to determining that the analyzed file is associated with the family of malicious files, select one or more methods of malware detection from a second database, wherein the second database stores a plurality of detection methods;
and
detect the associated family of malicious files using the selected one or more methods.

7 more elements

A non-transitory computer readable medium storing thereon computer executable instructions for detection of malicious files, including instructions for:

training a mapping model for mapping files in a probability space characterizing one or more families of malicious files;
determining a plurality of characteristics of an analyzed file based on a set of rules;
generating a mapping of the analyzed file in the probability space based on the determined plurality of characteristics;
searching a first database using the generated mapping of the analyzed file, wherein the first database stores mappings associated with one or more families of malicious files;
determining whether the analyzed file is associated with a family of malicious files,;
and
in response to determining that the analyzed file is associated with the family of malicious files, selecting one or more methods of malware detection from a second database, wherein the second database stores a plurality of malware detection methods;
and
detecting the associated family of malicious files using the selected one or more methods.

6 more elements

Dependencies are inferred from the claim text.

System and method for detection of malicious files

Life of this patent

System and method for detection of malicious files

Life of this patent

Abstract

Claims20