US 8,479,296 B2Granted

System and method for detecting unknown malware

AssigneeKaspersky Lab ZAO

InventorsYury V. Mashevsky, Roman S. Vasilenko

Life of this patent

Estimating the term…

Loading patent…

Abstract

The present disclosure relates generally to the field of computer security and, in particular, to systems for detecting unknown malware. A method comprises generating genes for known malicious and clean objects; analyzing object genes using different malware analysis methods; computing a level of successful detection of malicious objects by one or a combination of malware analysis methods based on analysis of genes of the known malicious objects; computing a level of false positive detections of malicious objects by one or a combination of malware analysis methods based on analysis of genes of known clean objects; measuring effectiveness of each one or the combination of malware analysis methods as a function of the level of successful detections and the level of false positive detections; and selecting one or a combination of the most effective malware analysis methods for analyzing unknown object for malware.

Claims18

Dependent claims

A computer-implemented method for detecting unknown malware, the method comprising:

generating, by a hardware processor, one or more different object genes for a plurality of known clean objects (W) and known malicious objects (B) of a plurality of different file types, wherein an object gene is a data structure containing a plurality of information elements retrieved from or associated with one or more objects and wherein different object genes contain different types of information elements characteristic of each of the plurality of different file types;
analyzing, by the hardware processor, the one or more different objects genes of the plurality of known clean and malicious objects using one or more malware analysis methods;
determining a level of successful malware detections of known malicious objects
(

X
b

B
)
,
wherein |Xb| is the number of known malicious objects (B) identified as malicious, for the plurality of different file types using one or more combinations of malware analysis methods, wherein a combination includes at least two different malware analysis methods;
determining a level of false positive detections of known clean objects
(

X
w

W
)
,
wherein |Xw| is the number of known clean objects (W) identified as malicious, for each of the plurality of different file types using said one or more combinations of malware analysis methods;
determining effectiveness (k) of the one or more combinations of malware analysis methods for each of the plurality of different file types using the following equation:
k
=
{

X
b

B
-

X
w

W
,
if
⁢
⁢

X
b

B
-

X
w

W
≥
0
,
0
,
otherwise
determining a most effective combination of malware analysis methods for each of the plurality of different file types;
selecting, based on a file type of an unknown object, a most effective combination of malware analysis methods, for analyzing the unknown object for presence of malware;
generating one or more different object genes of the unknown object for each of the selected malware analysis methods;
and
analyzing each one of the generated object genes of the unknown object using the selected most effective combination of malware analysis methods to determine whether the unknown object is clean or malicious.

60 more elements

A computer-based system for detecting unknown malware, the system comprising:

a memory configured to store an unknown software object;
and
a processor coupled to the memory and configured to:
generate one or more different object genes for a plurality of known clean objects (W) and known malicious objects (B) of a plurality of different file types, wherein an object gene is a data structure containing a plurality of information elements retrieved from or associated with one or more objects and wherein different object genes contain different types of information elements characteristic of each of the plurality of different file types;
analyze the one or more different objects genes of the plurality of known clean and malicious objects using one or more malware analysis methods;
determine a level of successful malware detections of known malicious objects
(

X
b

B
)
,
wherein |Xb| is the number of known malicious objects (B) identified as malicious, for the plurality of different file types using one or more combinations of malware analysis methods, wherein a combination includes at least two different malware analysis methods;
determine a level of false positive detections of known clean objects
(

X
w

W
)
,
wherein |Xw| is the number of known clean objects (W) identified as malicious, for each of the plurality of different file types using said one or more combinations of malware analysis methods;
determine effectiveness (k) of the one or more combinations of malware analysis methods for each of the plurality of different file types using the following equation:
k
=
{

X
b

B
-

X
w

W
,
if
⁢
⁢

X
b

B
-

X
w

W
≥
0
,
0
,
otherwise
determine a most effective combination of malware analysis methods for each of the plurality of different file types;
select, based on a file type of an unknown object, a most effective combination of malware analysis methods, for analyzing the unknown object for presence of malware;
generate one or more different object genes of the unknown object for each of the selected malware analysis methods;
and
analyze each one of the generated object genes of the unknown object using the selected most effective combination of malware analysis methods to determine whether the unknown object is clean or malicious.

63 more elements

A computer program product embedded in a non-transitory computer-readable storage medium, the computer-readable storage medium comprising computer-executable instructions for detecting unknown malware, the medium comprises instructions for:

generating one or more different object genes for a plurality of known clean objects (W) and known malicious objects (B) of a plurality of different file types, wherein an object gene is a data structure containing a plurality of information elements retrieved from or associated with one or more objects and wherein different object genes contain different types of information elements characteristic of each of the plurality of different file types;
analyzing the one or more different objects genes of the plurality of known clean and malicious objects using one or more malware analysis methods;
determining a level of successful malware detections of known malicious objects
(

X
b

B
)
,
wherein |Xb| is the number of known malicious objects (B) identified as malicious, for plurality of different file types using one or more combinations of malware analysis methods, wherein a combination includes at least two different malware analysis methods;
determining a level of false positive detections of known clean objects
(

X
w

W
)
,
wherein |Xw| is the number of known clean objects (W) identified as malicious, for each of the plurality of different file types using said one or more combinations of malware analysis methods;
determining effectiveness (k) of the one or more combinations of malware analysis methods for each of the plurality of different file types using the following equation:
k
=
{

X
b

B
-

X
w

W
,
if
⁢
⁢

X
b

B
-

X
w

W
≥
0
,
0
,
otherwise
determining a most effective combination of malware analysis methods for each of the plurality of different file types;
selecting, based on a file type of an unknown object, a most effective combination of malware analysis methods, for analyzing the unknown object for presence of malware;
generating one or more different object genes of the unknown object for each of the selected malware analysis methods;
and
analyzing each one of the generated object genes of the unknown object using the selected most effective combination of malware analysis methods to determine whether the unknown object is clean or malicious.

60 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/190,601Filed 26 Jul 2011
Priority: RU 201015452830 Dec 2010
Published: US 2012/0174227 A15 Jul 2012
Granted: 2 Jul 2013
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

G06F 21/562
Computer malware detection or handling, e.g. anti-virus arrangements: static detection
G06F 21/561
Computer malware detection or handling, e.g. anti-virus arrangements: virus type analysis
H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
G06F
Computing and data processing