Generating models for performing inline malware detection

A method for providing information to a data appliance that includes a firewall for blocking traffic determined to be malicious using the information, comprising:

• receiving a set of features, including a first plurality of n-grams, extracted froma set of files comprising a first plurality of known malicious files and a second plurality of known non-malicious files, wherein, for each file included in the set of files, respective histograms of n-grams present in the respective each file were previously generated during static analysis performed on the respective each file;
• determining, using a mutual information technique and from the received set of features, a reduced set of features that includes a reduced set of the n-grams included in the first plurality of n-grams, wherein determining the reduced set of features includes preferentially including in the reduced set of features a first n-gram that is more indicative of maliciousness, because the first n-gram is present in the first plurality of known malicious files and is not present in the second plurality of known non-malicious files, than a second n-gram that is not preferentially included in the reduced set of features, because the second n-gram is present in the first plurality of known malicious files and is also present in the second plurality of known non-malicious files;
• and
• using the reduced set of features to generate a model us able by the data appliance to perform in line malware analysis of samples received by the data appliance;
• wherein:
• the generated model includes the first n-gram and the generated model does not include the second n-gram;
• performing the inline malware analysis includes detecting as malicious a first sample, by the data appliance performing n-gram analysis on a sequence of packets of the first sample, received by the data appliance, wherein a maliciousness signature for the first sample is not present on the data appliance;
• and
• using the first plurality of n-grams extracted from the set of known malicious and known non-malicious files in the inline malware analysis would render the data appliance inoperable.

A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• receiving a set of features, including a first plurality of n-grams, extracted from a set of files comprising a first plurality of known malicious files and a second plurality of known non-malicious files, wherein, for each file included in the set of files, respective histograms of n-grams present in the respective each file were previously generated during static analysis performed on the respective each file;
• determining, using a mutual information technique and from the received set of features, a reduced set of features that includes a reduced set of the n-grams included in the first plurality of n-grams, wherein determining the reduced set of features includes preferentially including in the reduced set of features a first n-gram that is more indicative of maliciousness, because the first n-gram is present in the first plurality of known malicious files and is not present in the second plurality of known non-malicious files, than a second n-gram that is not preferentially included in the reduced set of features, because the second n-gram is present in the first plurality of known malicious files and is also present in the second plurality of known non-malicious files;
• and
• using the reduced set of features to generate a model us able by the data appliance to perform in line malware analysis of samples received by the data appliance;
• wherein:
• the generated model includes the first n-gram and the generated model does not include the second n-gram;
• performing the inline malware analysis includes detecting as malicious a first sample, by the data appliance performing n-gram analysis on a sequence of packets of the first sample, received by the data appliance, wherein a maliciousness signature for the first sample is not present on the data appliance;
• and
• using the first plurality of n-grams extracted from the set of known malicious and known non-malicious files in the inline malware analysis would render the data appliance inoperable.