System And Method For Host-Level Malware Detection

A computer-implemented method, comprising:

• accessing a set of identifiers of files known not to be malware;
• accessing a set of identifiers of files known to be malware;
• generating at least one hash of at least one file associated with a first process running on a host of a plurality of hosts;
• determining that the at least one hash is not in the set of identifiers of files known not to be malware and that the at least one hash is not in the set of identifiers of files known to be malware;
• monitoring the first process in response to determining that the at least one hash is not in the set of identifiers of files known not to be malware and that the at least one hash is not in the set of identifiers of files known to be malware;
• sending the at least one file, information related to the at least one file, and information related to the first process to be analyzed for malware in response to comparing a system call associated with the first process to a set of rules.

A system for malware detection, comprising:

• at least one computer-readable, non-transitory storage medium comprising instructions that, when executed by at least one processor, are operable to:
• access a set of configuration parameters;
• access a set of identifiers of files known not to be malware;
• access a set of identifiers of files known to be malware;
• determine that a first file in a first host of a plurality of hosts should be analyzed by comparing the first file to the set of configuration parameters;
• generate a first hash of the first file in response to determining that a first file should be analyzed;
• determine that the first hash is not in the set of identifiers of files known not to be malware and that the first hash is not in the set of identifiers of files known to be malware;
• determine a statistical variance with respect to the first file in response to determining that the first hash is not in the set of identifiers of files known not to be malware and is not in the set of identifiers of files known to be malware;
• send the first file and information related to the first file to be analyzed for malware in response to determining the statistical variance;
• and
• delete the set of configuration parameters, the set of identifiers of files known not to be malware, and the set of identifiers of files known to be malware after sending the first file.

A system for malware detection, comprising:

• at least one computer-readable, non-transitory storage medium comprising instructions that, when executed by at least one processor, are operable to:
• access a set of identifiers of files known not to be malware;
• access a set of identifiers of files known to be malware;
• generate at least one hash of at least one file associated with a first process running on a host of a plurality of hosts;
• determine that the at least one hash is not in the set of identifiers of files known not to be malware and that the at least one hash is not in the set of identifiers of files known to be malware;
• monitor the first process in response to determining that the at least one hash is not in the set of identifiers of files known not to be malware and that the at least one hash is not in the set of identifiers of files known to be malware;
• send the at least one file, information related to the at least one file, and information related to the first process to be analyzed for malware in response to comparing a system call associated with the first process to a set of rules.