Apparatuses and methods for detecting malware
AssigneeHuawei Technologies Co., Ltd.
InventorsMoez DRAIEF, Xiang CHEN, Konstantin KUTZKOV, Kevin SCAMAN, Milan VOJNOVIC
Life of this patent
Estimating the term…
Abstract
Apparatuses and methods for determining if a computer program is malware and to which malware class it belongs to. In the method the behaviour of a computer program is traced by observing the activity of the program. Behaviour sequences comprising API-calls or similar activity of a computer program are then provided into a classifier for classifying the computer program. From the outcome of the classifier a classification result and the portions relevant to decision can be provided to a person for further confirmation.
Claims19
A method for detecting malware, the method comprising
- deriving a behaviour sequence of a computer program, wherein the behaviour sequence is based on the activity of the computer program;
- classifying the derived behaviour sequence of a computer program;
- based on the classification result, determining a need for providing the behaviour sequence to an expert;
- and
- as a response to the positive determination, outputting the classification result and subsequences of the behaviour sequence relevant to the classification result to the expert;
- and
- determining, based on the classification, if the computer program is malware.
An apparatus for determining malware comprising at least one processing circuitry configured to cause performing:
- derive a behaviour sequence of a computer program, wherein the behaviour sequence is based on the activity of the computer program;
- classify the derived behaviour sequence of a computer program;
- based on the classification result, determine a need for providing the behaviour sequence to an expert;
- and
- as a response to the positive determination, output the classification result and subsequences of the behaviour sequence relevant to the classification result to the expert;
- and
- determine, based on the classification, if the computer program is malware.
A non-transitory computer readable storage medium storing computer executable instructions, wherein the computer executable instructions executed by a computing device to:
- derive a behaviour sequence of a computer program, wherein the behaviour sequence is based on the activity of the computer program;
- classify the derived behaviour sequence of a computer program;
- based on the classification result, determine a need for providing the behaviour sequence to an expert;
- and
- as a response to the positive determination, output the classification result and subsequences of the behaviour sequence relevant to the classification result to the expert;
- and
- determine, based on the classification, if the computer program is malware.
Dependencies are inferred from the claim text.