Systems and methods for determining and detecting malware families

A system for identifying a malware family to which a malware sample belongs, the system comprising:

• a computer system configured to generate malware detection rules for at least one malware family;
• a data store configured to receive and store the malware detection rules generated by the computer system;
• and
• a rule engine configured to retrieve the malware detection rules from the data store and detect, using the retrieved malware detection rules, malware instances in network traffic,
• wherein the computer system comprises processors and memory and is configured to perform operations comprising:
• retrieving, from the data store, a collection of malware signature samples for a malware family;
• identifying a test malware sample, wherein the test malware sample is used, by the computer system, to test whether the collection of malware signature samples includes a malware sample that causes generation of at least one malware detection rule that does not satisfy one or more rule quality criteria;
• injecting the test malware sample into the collection of malware signature samples;
• simulating sequence generation of the collection of malware signature samples based on an iterative, repeatable procedural process comprising:
• applying the at least one malware detection rule to the collection of malware signature samples to cause the collection of malware signature samples to generate a set of malware signature sequences characteristic of the collection of malware signature samples including the injected test malware sample,
• determining a numerical count indicating a quantity of malware signature sequences within the generated set of malware signature sequences, wherein the numerical count serves as a metric reflecting an impact of the injected test malware sample on the characteristic malware signature sequences of the collection, and
• determining whether the numerical count, as the metric, satisfies one or more family inclusion criteria specifically defined by thresholds related to the numerical count, satisfaction of which validates membership of the test malware sample within the malware family;
• adding one or more of the malware to a dictionary of malware signature sequences for the malware family based on a determination that the numerical count satisfies the one or more family inclusion criteria;
• and
• returning the dictionary for the malware family to be used for updating or generating the at least one malware detection rule for the malware family.