Method and Product for Providing a Predictive Security Product and Evaluating Existing Security Products
AssigneeCyactive Sercurity Ltd.
InventorsShlomi Boutnaru, Liran Tancman, Michael Markzon
Life of this patent
Estimating the term…
Abstract
A method, product and computer program product for effecting an Evolutionary Process on malware, the method including the steps of: (a) receiving a malware specimen; (b) generating variants of the malware specimen; (c) evaluating the variants and awarding each the variant a Fitness Score; (d) selecting the variants having at least a predefined the Fitness Score; and (e) using the selected variants as the malware specimens in step (a) from which to generate a new generation of the variants.
Claims47
A system, comprising:
- (a) a malware evolution engine adapted to generate malware variants of malware specimens;
- and
- (b) an evaluator configured to evaluate said malware variants based on at least one of:
- a maliciousness level and an evasiveness level.
A method for effecting an Evolutionary Process on malware, the method comprising the steps of:
- (a) receiving a malware specimen;
- (b) generating variants of said malware specimen;
- (c) evaluating said variants and awarding each said variant a respective Fitness Score;
- (d) selecting said variants having at least a predefined said respective Fitness Score;
- and
- (e) using said selected variants as said malware specimens in step (a) from which to generate a new generation of said variants.
The method of 28, wherein each said variant is executed on at least one of:
- a virtual machine and a physical machine.
A method comprising the steps of:
- (a) receiving a malware specimen;
- (b) generating variants of said malware specimen;
- (c) scanning each said variant with a selected group of security products and awarding an Evasiveness Score, based on said security products' inability to detect said variant.
A method for training a Malware Detector for a Byte Stream, the method comprising the steps of:
- (a) capturing a Byte stream of a Network session or any other binary data, and representing said byte stream as a linear vector of integers wherein said byte stream includes a trace of malware variants or benign network activity or files.
- (b) reshaping said linear vector into a square matrix, thereby receiving a gray-scale image;
- (c) normalizing said gray-scale image in order to unite resolution;
- (d) extracting features from said normalized image using at least one image processing technique;
- (e) repeating steps (a) to (d) and storing malicious variants in a first database and benign traffic in a second database;
- (f) training the Malware Detector to distinguish between said malware variants and said benign traffic.
A method for generating malware variants from a malware specimen, the method comprising the steps of:
- generating said malware variants by performing at least one action selected from the group consisting of
- applying mutations to executable code of said malware specimens,
- applying mutations to malware emitted network traffic, and
- cross-merging said malware variants.
Dependencies are inferred from the claim text.