Graph-based malware classification based on file relationships
AssigneeMicrosoft Corporation
InventorsJack W. Stokes, Nikos Karampatziakis, John C. Platt, Anil Francis Thomas, Adrian M. Marinescu
Life of this patent
Estimating the term…
Abstract
A reliable automated malware classification approach with substantially low false positive rates is provided. Graph-based local and/or global file relationships are used to improve malware classification along with a feature selection algorithm. File relationships such as containing, creating, copying, downloading, modifying, etc. are used to assign malware probabilities and simultaneously reduce the false positive and false negative rates on executable files.
Claims18
A method executed on a computing device for graph-based classification using entity relationships, the method comprising:
- determining one or more relationships of an entity with other related entities in a hierarchical structure;
- updating a graph structure representing a group of entities including the entity and relationships between the entities;
- computing an improved classification for the entity based on the updated graph structure;
- computing an improved classification for another entity that includes the entity based on the updated graph structure and the entity's improved classification;
- and
- updating global model parameters based on the inferred classifications in an iterative manner until a performance change from one iteration to a next iteration is less than a predefined threshold.
A computing device for performing graph-based malware classification using file relationships, the computing device comprising:
- a memory storing instructions;
- and
- a processor executing a malware detection application in conjunction with the stored instructions, the malware detection application configured to:
- assign a baseline malware classification probability to one or more files;
- determine one or more relationships of the one or more files with other related files;
- update a graph structure representing the one or more files and other related files based on their relationships;
- if the graph structure is for local file relationships:
- compute an improved classification for the one or more files based on the updated graph structure;
- compute an improved classification for a container that includes the one or more files based on the updated graph structure and the files' improved classification;
- and
- update global model parameters based on the inferred classifications in an iterative manner until a performance change from one iteration to a next iteration is less than a predefined threshold.
A method for performing graph-based malware classification using file relationships, the method comprising:
- assigning a baseline malware classification probability to one or more files;
- determining one or more relationships of the one or more files with other related files, the relationships comprising at least one from a set of:
- containing, creating, copying, downloading, and modifying;
- constructing labeled datasets based on logs extracted from an instrumented virtual machine;
- constructing a training vector whose label is determined based on selected features for each file;
- training a classifier using the labeled datasets employing multi-class logistic regression;
- updating a graph structure representing the one or more files and other related files based on their relationships;
- if the graph structure is for local file relationships:
- computing an improved classification for the one or more files based on the updated graph structure;
- and
- computing an improved classification for a container that includes the one or more files based on the updated graph structure and the files' improved classification;
- and
- if the graph structure is for global file relationships:
- inferring an improved classification for the one or more files based on the updated graph structure;
- and
- inferring an improved classification for the container that includes the one or more files based on the updated graph structure and the files' improved classification based on a conditional random field.
Dependencies are inferred from the claim text.