System and method for detecting malware by transforming objects and analyzing different views of objects

One or more non-transitory computer readable storage media that includes code for execution and when executed by at least one processor is operable to perform operations comprising:

• generating a plurality of transformed views of an object in a network environment;
• generating a plurality of filtered information sets corresponding respectively to the plurality of transformed views, each of the filtered information sets including particular location data indicating one or more locations in the object corresponding to at least one obfuscation element, wherein a first filtered information set of the plurality of filtered information sets includes a first location data indicating one or more locations in the object corresponding to a first obfuscation element, and wherein a second filtered information set of the plurality of filtered information sets includes a second location data indicating one or more locations in the object corresponding to a second obfuscation element;
• and
• detecting a suspect correlation based on an analysis of at least some of the plurality of transformed views and of at least some of the plurality of filtered information sets, wherein the analysis includes:
• identifying a construct in first and second transformed views of the plurality of transformed views;
• and
• determining whether one or more criteria are satisfied based on first and second location data relative to the construct in the first and second transformed views, respectively.

An apparatus, comprising:

• a malware detection module;
• an object;
• and
• at least one processor operable to execute operations associated with the object, wherein the malware detection module, the object, and the processor cooperate such that the apparatus is configured for:
• generating a plurality of transformed views of an object in a network environment;
• generating a plurality of filtered information sets corresponding respectively to the plurality of transformed views, each of the filtered information sets including particular location data indicating one or more locations in the object corresponding to at least one obfuscation element, wherein a first filtered information set of the plurality of filtered information sets includes a first location data indicating one or more locations in the object corresponding to a first obfuscation element, and wherein a second filtered information set of the plurality of filtered information sets includes a second location data indicating one or more locations in the object corresponding to a second obfuscation element;
• and
• detecting a suspect correlation based on an analysis of at least some of the plurality of transformed views and of at least some of the plurality of filtered information sets, wherein the analysis includes determining whether one or more criteria are satisfied based on a first frequency of the first filtered obfuscation element and a second frequency of the second filtered obfuscation element.

One or more non-transitory computer readable storage media that includes code for execution and when executed by at least one processor is operable to perform operations comprising:

• generating a plurality of transformed views of an object in a network environment;
• generating a plurality of filtered information sets corresponding respectively to the plurality of transformed views, each of the filtered information sets including particular location data indicating one or more locations in the object corresponding to at least one obfuscation element, wherein a first filtered information set of the plurality of filtered information sets includes a first location data indicating one or more locations in the object corresponding to a first obfuscation element, wherein one or more occurrences of the first obfuscation element in the object are transformed in the first transformed view, wherein a second filtered information set of the plurality of filtered information sets includes a second location data indicating one or more locations in the object corresponding to a second obfuscation element, and wherein one or more occurrences of the second obfuscation element in the object are transformed in the second transformed view;
• and
• detecting a suspect correlation based on an analysis of at least some of the plurality of transformed views and of at least some of the plurality of filtered information sets.

One or more non-transitory computer readable storage media that includes code for execution and when executed by at least one processor is operable to perform operations comprising:

• generating a plurality of transformed views of an object in a network environment;
• generating a plurality of filtered information sets corresponding respectively to the plurality of transformed views, each of the filtered information sets including particular location data indicating one or more locations in the object corresponding to at least one obfuscation element, wherein a first filtered information set of the plurality of filtered information sets includes a first location data indicating one or more locations in the object corresponding to a first obfuscation element, wherein each of the one or more locations of the first location data corresponds to a single occurrence of the first obfuscation element in the object, wherein a second filtered information set of the plurality of filtered information sets includes a second location data indicating one or more locations in the object corresponding to a second obfuscation element, and wherein each of the one or more locations of the second location data corresponds to a single occurrence of the second obfuscation element in the object;
• and
• detecting a suspect correlation based on an analysis of at least some of the plurality of transformed views and of at least some of the plurality of filtered information sets.

One or more non-transitory computer readable storage media that includes code for execution and when executed by at least one processor is operable to perform operations comprising:

• generating a plurality of transformed views of an object in a network environment;
• generating a plurality of filtered information sets corresponding respectively to the plurality of transformed views, each of the filtered information sets including particular location data indicating one or more locations in the object corresponding to at least one obfuscation element, wherein a first filtered information set of the plurality of filtered information sets includes a first location data indicating one or more locations in the object corresponding to a first obfuscation element, wherein each of the one or more locations of the first location data corresponds to one or more successive occurrences of the first obfuscation element in the object, wherein a second filtered information set of the plurality of filtered information sets includes a second location data indicating one or more locations in the object corresponding to a second obfuscation element, and wherein each of the one or more locations of the second location data corresponds to one or more successive occurrences of the second obfuscation element in the object;
• and
• detecting a suspect correlation based on an analysis of at least some of the plurality of transformed views and of at least some of the plurality of filtered information sets.