Multi-dimensional malware analysis
AssigneeMcAfee, Inc.
InventorsSteven Grobman, Jonathan B. King, Yonghong Huang, Amit Kumar
Life of this patent
Estimating the term…
Abstract
There is disclosed a computer-implemented system and method of analyzing a batch of objects, including bucketizing the batch of objects into a plurality of buckets according to a feature of the objects; for objects within a batch, performing malware analysis on the objects to assign a malware analysis score, and adjusting the malware analysis score based on the batch; and performing respective security actions on the objects within the batch, based on the adjusted malware analysis score.
Claims20
A computer-implemented method of generating a multi-dimensional malware detection model, comprising:
- collecting data sources associated with a set of objects, the data sources including at least feature-based analysis results and respective complementary properties for the objects;
- bucketizing the complementary properties into a plurality of reputation buckets based on a range of values for the complementary properties;
- training a machine learning fusion model using the feature-based analysis results and the bucketized complementary properties to generate probabilistic curves for the reputation buckets, wherein the probabilistic curves represent a likelihood of maliciousness;
- deriving a set of reputation adjustment factors from the probabilistic curves, wherein a reputation adjustment factor corresponds to a respective reputation bucket;
- and
- providing the set of reputation adjustment factors to a client device for use in malware detection.
One or more tangible, non-transitory computer-readable media having stored thereon executable instructions to instruct a processor to:
- collect data sources associated with a set of objects, the data sources including at least feature-based analysis results and a complementary property for each object;
- bucketize the complementary properties into a plurality of reputation buckets based on a range of values for the complementary properties;
- train a machine learning fusion model using the feature-based analysis results and the bucketized complementary property to generate probabilistic curves for the reputation buckets, wherein the probabilistic curves represent a likelihood of maliciousness;
- derive a set of reputation adjustment factors from the probabilistic curves, wherein a reputation adjustment factor corresponds to a respective reputation bucket;
- and
- transmit the set of reputation adjustment factors to a remote device for use in malware classification.
A computing apparatus, comprising:
- a hardware platform including a processor circuit and a memory;
- and
- instructions encoded within the memory to instruct the processor circuit to:
- aggregate feature-based analysis data and complementary property data for a plurality of objects;
- categorize the complementary property data into discrete buckets based on value ranges;
- generate a multi-factor fusion model by training on the feature-based analysis data and the categorized complementary property data to produce bucket-specific probabilistic outputs;
- extract reputation modifiers from the bucket-specific probabilistic outputs;
- and
- electronically transmit the reputation modifiers to an endpoint device for integration into a malware detection process.
Dependencies are inferred from the claim text.