Using machine infection characteristics for behavior-based detection of malware
AssigneeSymantec Corporation
InventorsVijay Seshardi, Zulfikar Ramzan, Sourabh Satish, Chandrasekhar Kalle
Life of this patent
Estimating the term…
Abstract
One or more behavior-based features describing an execution of an application on a client are generated. One or more client-specific features are generated, wherein the client-specific features describe aspects of the client. A malware score is generated based on the behavior-based features and the client-specific features. Whether the application is a malware threat is determined based on the malware score and a result of the determination is stored.
Claims15
A computer-implemented method of determining whether an application is a malware threat, the method executed by one or more computer systems and comprising:
- generating one or more behavior-based features describing an execution of an application on a client;
- generating one or more client-specific features describing aspects of the client;
- combining the client-specific features and the behavior-based features to generate a combined feature vector;
- receiving a malware classifier from a server, the server receiving a plurality of combined feature vectors associated with a plurality of applications from a plurality of clients and generating the malware classifier based at least in part on the plurality of combined feature vectors, the malware classifier statistically modeling hidden dependencies between the client-specific and the behavior-based features to distinguish between innocuous and malicious applications, the hidden dependencies including a characteristic represented by one of the features having an effect on a characteristic represented by another feature;
- generating a malware score responsive to applying the malware classifier to the combined feature vector;
- determining whether the application is a malware threat based on the malware score;
- and
- storing a result of the determination.
A computer system for generating a malware classifier, the system comprising:
- a processor;
- a memory;
- a classifier generation module stored in the memory and executable by the processor to:
- receive a plurality of combined feature vectors associated with a plurality of applications from a plurality of clients, each combined feature vector received from a client comprising a set of features describing behaviors of an application executed on the client and a set of features describing client-specific aspects of the client on which the application executed;
- identify a subset of the plurality of applications as known goodware applications and a subset of the plurality of applications as known malware threats;
- generate a malware classifier based on the combined feature vectors associated with the subset of applications that are known goodware applications and the subset of applications that are known malware threats, the malware classifier statistically modeling hidden dependencies between client-specific and behavior-based features to distinguish between the goodware applications and the known malware threats, the hidden dependencies including a characteristic represented by one of the features having an effect on a characteristic represented by another feature;
- and
- store the malware classifier.
A non-transitory computer-readable storage medium encoded with executable computer program code for determining whether an application is a malware threat, the program code comprising program code for:
- generating one or more behavior-based features describing an execution of an application on a client;
- generating one or more client-specific features describing aspects of the client;
- combining the client-specific features and the behavior-based features to generate a combined feature vector;
- receiving a malware classifier from a server, the server receiving a plurality of combined feature vectors associated with a plurality of applications from a plurality of clients and generating the malware classifier based at least in part on the plurality of combined feature vectors, the malware classifier statistically modeling hidden dependencies between the client-specific and the behavior-based features to distinguish between innocuous and malicious applications, the hidden dependencies including a characteristic represented by one of the features having an effect on a characteristic represented by another feature;
- generating a malware score responsive to applying the malware classifier to the combined feature vector;
- determining whether the application is a malware threat based on the malware score;
- and
- storing a result of the determination.
Dependencies are inferred from the claim text.