Method and system for detecting and classifying malware based on families
AssigneeCheckpoint Software Technologies Ltd.
InventorsIvan KOSAREV, Lotem FINKELSTEIN
Life of this patent
Estimating the term…
Abstract
Methods and systems utilizing sandbox outputs for files, such as dynamic file analysis (DFA) reports, regardless of size, to automatically create rules. From these rules, the maliciousness of the file is determined, and if the file is malicious, i.e., malware, the malware is classified into malware families.
Claims20
A method of using a particular computer to classify malware, comprising:
- using the particular computer to represent a report of a sandbox emulation of a file with one or more first fuzzy hashes;
- using the particular computer to compare the one or more first fuzzy hashes of the represented report with second fuzzy hashes of one or more files of known malware, to determine malware candidate files;
- and,
- using the particular computer to analyze each said malware candidate file for artifact matches with artifacts extracted from the representation of the sandbox emulation report.
A computer system for classifying malware, comprising:
- a non-transitory storage medium for storing computer components;
- and,
- a computerized processor for executing the computer components comprising:
- a module for representing a report of a sandbox emulation of a file with one or more first fuzzy hashes;
- a module for comparing the one or more first fuzzy hashes of the represented report with second fuzzy hashes of one or more files of known malware, to determine malware candidate files;
- and,
- a module for analyzing each said malware candidate file for artifact matches with artifacts extracted from the representation of the sandbox emulation report.
A computer usable non-transitory storage medium having a computer program embodied thereon for causing a suitably programmed system to classify malware, by performing the following steps when such program is executed on the system, the steps comprising:
- representing a report of a sandbox emulation of a file with one or more first fuzzy hashes;
- comparing the one or more first fuzzy hashes of the represented report with second fuzzy hashes of one or more files of known malware, to determine malware candidate files;
- and,
- analyzing each said malware candidate file for artifact matches with artifacts extracted from the representation of the sandbox emulation report.
Dependencies are inferred from the claim text.