US 9,237,161 B2Granted

Malware detection and identification

AssigneeMorphick, Inc.

InventorsJeremy Richard Humble, Cole Robinette

Life of this patent

Estimating the term…

Loading patent…

Abstract

A malware detection/identification system scores each subject file and/or scores ‘tags’ obtained from the subject file to determine the potential that the file contains malicious components. A file or tag score tending to indicate that the subject file may contain malicious components/properties/attributes, may be used to notify the system (and a user of the system) that the file may be potentially malicious, so that the file may be quarantined and subject to further analysis. Embodiments of the current disclosure utilize a database structure that contains multitudes (e.g., hundreds, thousands, or even millions) of “tags” that have been pulled from known malicious and known benign sample files, where the database provides many-to-many relations between the known sample files and the tags.

Claims22

Dependent claims

A system for malware file detection and identification, comprising:

(A) one or more databases containing a multitude of tags, each tag associated with at least one of (i) one or more of a plurality of known malicious files and (ii) one or more of a plurality of known benign files, each of the plurality of known malicious files having a plurality of the tags respectively associated with that known malicious file and each of the plurality of known benign files having a plurality of the tags respectively associated with that known benign file, the tags including,
a tag identification code,
a tag type corresponding to the type of information held by the tag, and
a tag value corresponding to the value of the information held by the tag,
the one or more databases including a many-to-many relational structure relating each known benign file to the plurality of tags respectively associated with that known benign file, and relating each known malicious file with the plurality of tags respectively associated with that known malicious file;
and
(B) at least one computer, having access to the one or more databases, and being programmed to perform the steps of:
receiving a file,
analyzing the received file to generate a plurality of tags associated with the received file,
comparing the tags generated from the received file with the tags in the one or more databases to identify tags in the one or more databases that match tags generated from the received file,
calculating a tag score for a tag generated from the received file based upon the number of malicious files associated with a matching tag from the one or more databases and the number of benign files associated with the matching tag from the one or more databases, and
rendering a notification that the received file is potentially malicious based upon a comparison of the tag score to a predetermined value and displaying to a user information regarding one or more of the known malicious files to which the received file is determined by the computer to be similar.

9 more elements

A system for malware file detection and identification, comprising:

(A) one or more databases containing a multitude of tags, each tag associated with at least one of (i) one or more of a plurality of known malicious files and (ii) one or more of a plurality of known benign files, each of the plurality of known malicious files having a plurality of the tags respectively associated with that known malicious file and each of the plurality of known benign files having a plurality of the tags respectively associated with that known benign file, the tags including,
a tag identification code,
a tag type corresponding to the type of information held by the tag, and
a tag value corresponding to the value of the information held by the tag,
the one or more databases including a many-to-many relational structure relating each known benign file to the plurality of tags respectively associated with that known benign file, and relating each known malicious file with the plurality of tags respectively associated with that known malicious file;
and
(B) at least one computer, having access to the one or more databases, and being programmed to perform the steps of:
receiving a file,
analyzing the received file to generate a plurality of tags associated with the received file,
comparing the tags generated from the received file with the tags in the one or more databases to identify tags in the one or more databases that match tags generated from the received file,
calculating a similarity score for the received file versus one or more known malicious files based upon the tags generated from the received file and the tags in the one or more databases associated with the one or more known malicious files, and
displaying to a user information regarding one or more of the known malicious files having the highest similarity scores with the received file.

9 more elements

Dependencies are inferred from the claim text.