US 2018/0293381 A1 · SYSTEM AND METHOD FOR MALWARE DETECTION ON A PER PACKET BASIS

Abstract

Disclosed is a computer implemented method for malware detection that analyses a file on a per packet basis. The method receives a packet of one or more packets associated a file, and converting a binary content associated with the packet into a digital representation and tokenizing plain text content associated with the packet. The method extracts one or more n-gram features, an entropy feature, and a domain feature from the converted content of the packet and applies a trained machine learning model to the one or more features extracted from the packet. The output of the machine learning method is a probability of maliciousness associated with the received packet. If the probability of maliciousness is above a threshold value, the method determines that the file associated with the received packet is malicious.

Claims20

Dependent claims

A computer implemented method for malware detection, the method comprising:

receiving a packet of two or more packets associated with a file, the packet comprising a content, and a source domain;
converting the content of the received packet into a decimal representation;
extracting one or more features from the converted content of the packet wherein the one or more features include one or more n-gram features, an entropy feature, and a domain feature;
applying a trained machine learning model to the extracted one or more features to determine a probability of maliciousness associated with the packet;
and
responsive to determining that the probability maliciousness of the packet is above a threshold value, labeling the file associated with the received packet as malicious.

3 more elements

A system comprising:

a processor;
and
a memory comprising stored instructions, the instructions executable by the processor and causing the processor to:
receive a packet of two or more packets associated with a file, the packet comprising a content, and a source domain;
convert the content of the received packet into a decimal representation;
extract one or more features from the converted content of the packet wherein the one or more features include one or more n-gram features, an entropy feature, and a domain feature;
apply a trained machine learning model to the extracted one or more features to determine a probability of maliciousness associated with the packet;
and
responsive to determining that the probability maliciousness of the packet is above a threshold value, label the file associated with the received packet as malicious.

6 more elements

A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions that when executed by a processor cause the processor to:

receive a packet of two or more packets associated with a file, the packet comprising a content, and a source domain;
convert the content of the received packet into a decimal representation;
extract one or more features from the converted content of the packet wherein the one or more features include one or more n-gram features, an entropy feature, and a domain feature;
apply a trained machine learning model to the extracted one or more features to determine a probability of maliciousness associated with the packet;
and
responsive to determining that the probability maliciousness of the packet is above a threshold value, label the file associated with the received packet as malicious.

3 more elements

Dependencies are inferred from the claim text.

System and method for malware detection on a per packet basis

Life of this patent

System and method for malware detection on a per packet basis

Life of this patent

Abstract

Claims20