Systems and methods for inference of malware labels in a graph database
AssigneeAvast Software s.r.o.
InventorLibor Morkovský
Life of this patent
Estimating the term…
Abstract
Systems and methods are described which integrate file properties that in conventional systems has been considered weaker evidence of malware and analyzes the information to produce reliable results. Properties such as file paths, file names, source domains, IP protocol ASNs, section checksums, digital signatures that are not always present and not always reliable can be integrated into the classification process using a graph. A 1-neighborhood of object values in the graph may be created and analyzed to suggest a malware family label based on files having similar properties.
Claims10
A system for inferring a malware label comprising:
- a seed object database storage device including a seed object database which receives and stores a seed set of objects, the objects representing one or more files;
- a graph analyzer, coupled to the seed data storage device and to a user interface, which determines a graph from a plurality of values in the seed set of objects, the graph including a subject identifying an object of the seed set of objects linked to a value of the plurality of values by an predicate, determines a set of values that are linked by any predicate, traverses to the subject of the values in the sets of values to determine a set of 1-neighbors, for each subject that is a 1-neighbor to a value, determines a first count of the number of links indicating a detected malware value, and for each combination of predicate and value determines a second count of a number of subjects that share the value in the seed set of objects and determines a third count of a number of subjects that share the value in the 1-neighbor set of values;
- a user interface device that presents the first count, the second count, the third count and the value;
- and
- a communication link that couples a selection of a new object to the seed object database from the user interface to add to the seed set of objects.
A method for inferring a malware label, the method comprising:
- receiving and storing a seed set of objects in a seed object database, the objects representing one or more files;
- determining in a graph analyzer a graph from a plurality of values in the seed set of objects, the graph including a subject identifying an object of the seed set of objects linked to a value of the plurality of values by a predicate;
- determining by the graph analyzer a set of values that are linked by any predicate, the graph analyzer traversing to the subjects of the values in the set of values to determining a set of 1-neighbors;
- for each subject that is a 1-neighbor to a value, the graph analyzer determining a first count of the number of links indicating a detected malware value;
- for each combination of predicate and value, the graph analyzer determining a second count of a number of subjects that share the value in the seed set of objects;
- for each combination of predicate and values, the graph analyzer determining a third count of a number of subjects that share the value in the 1-neighbor set of the value;
- presenting the subject, the first count, the second count, the third count, and the value on a user interface;
- and
- receiving from the user interface a selection of a new object at the seed object database to add to the seed set of objects.
Dependencies are inferred from the claim text.