System and method for detecting potentially malicious changes in applications
AssigneeAO Kaspersky Lab
InventorsAnton A Kivva, Lev V Pikman, Igor A Golovin
Life of this patent
Estimating the term…
Abstract
Disclosed herein are systems and methods for detecting potentially malicious changes in an application. In one aspect, an exemplary method comprises, selecting a first file to be analyzed and at least one second file similar to the first file, for each of the at least one second file, calculating at least one set of features, identifying a set of distinguishing features of the first file by finding, for each of the at least one second file, a difference between a set of features of the first file and the calculated at least one set of features of the second file, and detecting a presence of potentially malicious changes in the identified set of distinguishing features of the first file.
Claims21
A method for detecting potentially malicious changes in an application, the method comprising:
- selecting a first file to be analyzed and at least one second file similar to the first file, wherein the similarity of the at least one second file with the first file is based on at least one of:
- names of the first file and the at least one second file, and versions of the first file and the at least one second file;
- for each of the at least one second file, calculating at least one set of features;
- identifying a set of distinguishing features of the first file by finding, for each of the at least one second file, a difference between a set of features of the first file and the calculated at least one set of features of the second file;
- and
- detecting a presence of potentially malicious changes in the identified set of distinguishing features of the first file, characterized in that the potentially malicious changes comprise at least a change that indicates a presence of at least one code loader for loading of code from encrypted files or from sections of files not intended for code storage, or from third-party servers.
A system for detecting potentially malicious changes in an application, comprising:
- at least one processor configured to:
- select a first file to be analyzed and at least one second file similar to the first file, wherein the similarity of the at least one second file with the first file is based on at least one of:
- names of the first file and the at least one second file, and versions of the first file and the at least one second file;
- for each of the at least one second file, calculate at least one set of features;
- identify a set of distinguishing features of the first file by finding, for each of the at least one second file, a difference between a set of features of the first file and the calculated at least one set of features of the second file;
- and
- detect a presence of potentially malicious changes in the identified set of distinguishing features of the first file, characterized in that the potentially malicious changes comprise at least a change that indicates a presence of at least one code loader for loading of code from encrypted files or from sections of files not intended for code storage, or from third-party servers.
A non-transitory computer readable medium storing thereon computer executable instructions for detecting potentially malicious changes in an application, including instructions for:
- selecting a first file to be analyzed and at least one second file similar to the first file, wherein the similarity of the at least one second file with the first file is based on at least one of:
- names of the first file and the at least one second file, and versions of the first file and the at least one second file;
- for each of the at least one second file, calculating at least one set of features;
- identifying a set of distinguishing features of the first file by finding, for each of the at least one second file, a difference between a set of features of the first file and the calculated at least one set of features of the second file;
- and
- detecting a presence of potentially malicious changes in the identified set of distinguishing features of the first file, characterized in that the potentially malicious changes comprise at least a change that indicates a presence of at least one code loader for loading of code from encrypted files or from sections of files not intended for code storage, or from third-party servers.
Dependencies are inferred from the claim text.