US 9,288,220 B2Granted

Methods and systems for malware detection

AssigneeCyberpoint International LLC

InventorsMark V. Raugas, Rebecca A. Borbely, Michael W. West, James L. Ulrich

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods, system, and media for detecting malware are disclosed. A network may be monitored to collect samples of the network traffic. Feature vectors may be extracted from the sampled network traffic. One or more machine learning models may be applied to the feature vectors to produce a score indicative of the presence of a particular type of malware. One or more scores obtained by applying the machine learning models may be fused by another machine learning model into a resulting score. A threshold value may be calculated to accompany a score indicating the likelihood that the traffic sample indicates the presence of malware and the likely effectiveness of planned remediation effort. An alert may be generated from the score and the threshold when the threshold is acceded.

Claims23

Dependent claims

A computer-implemented method for detecting malware executed by one or more processors, the method comprising:

monitoring, by the one or more processors, network traffic transmitted on a computer network during a time interval;
obtaining, by the one or more processors, a plurality of samples of the network traffic during the time interval;
extracting, by the one or more processors, a set of features from the samples of the network traffic;
training, by the one or more processors, at least one machine learning model, wherein training the at least one machine learning model comprises:
generating a first machine learning model configured to detect malware associated with a plurality of malware classes and to classify network traffic executed on a network-connected host system that is similar to malicious behavior associated with any one of the plurality of malware classes;
generating a second machine learning model configured to classify, as benign traffic, network traffic executed on a network-connected host system that is similar to benign software behavior;
and
generating a third machine learning model configured to detect a particular class of malware and to classify network traffic executed on the network-connected host system that is similar to malicious behavior associated with the particular class of malware;
generating, by the one or more processors, a normalized score based on applying the at least one trained machine learning model to the extracted set of features, wherein generating the normalized score comprises:
applying the first machine learning model to the extracted set of features to generate a first score;
applying the second machine learning model to the extracted set of features to generate a second score;
applying the third machine learning model to the extracted set of features to generate a third score;
and
generating the normalized score associated with the time interval based on a combination of the first score, the second score, and the third score;
determining, by the one or more processors and from the normalized score, a likelihood that a particular network component is infected with malware;
and
storing, by the one or more processors, data indicating the likelihood that the particular network component is infected with malware.

14 more elements

A system comprising:

one or more processors;
and
a non-transitory computer-readable medium coupled to the one or more processors having instructions stored thereon which, when executed by the one or more processors, causes the one or more processors to perform operations comprising:
monitoring, by the one or more processors, network traffic transmitted on a computer network during a time interval;
obtaining, by the one or more processors, a plurality of samples of the network traffic during the time interval;
extracting, by the one or more processors, a set of features from the samples of the network traffic;
training, by the one or more processors, at least one machine learning model, wherein training the at least one machine learning model comprises:
generating a first machine learning model configured to detect malware associated with a plurality of malware classes and to classify network traffic executed on a network-connected host system that is similar to malicious behavior associated with any one of the plurality of malware classes;
generating a second machine learning model configured to classify, as benign traffic, network traffic executed on a network-connected host system that is similar to benign software behavior;
and
generating a third machine learning model configured to detect a particular class of malware and to classify network traffic executed on the network-connected host system that is similar to malicious behavior associated with the particular class of malware;
generating, by the one or more processors, a normalized score based on applying the at least one trained machine learning model to the extracted set of features, wherein generating the normalized score comprises:
applying the first machine learning model to the extracted set of features to generate a first score;
applying the second machine learning model to the extracted set of features to generate a second score;
applying the third machine learning model to the extracted set of features to generate a third score;
and
generating the normalized score associated with the time interval based on a combination of the first score, the second score, and the third score;
determining, by the one or more processors and from the normalized score, a likelihood that a particular network component is infected with malware;
and
storing, by the one or more processors, data indicating the likelihood that the particular network component is infected with malware.

17 more elements

A non-transitory computer-readable medium encoded with a computer program comprising instructions that, when executed, operate to cause one or more processors to perform operations comprising:

monitoring, by the one or more processors, network traffic transmitted on a computer network during a time interval;
obtaining, by the one or more processors, a plurality of samples of the network traffic during the time interval;
extracting, by the one or more processors, a set of features from the samples of the network traffic;
training, by the one or more processors, at least one machine learning model, wherein training the at least one machine learning model comprises:
generating a first machine learning model configured to detect malware associated with a plurality of malware classes and to classify network traffic executed on a network-connected host system that is similar to malicious behavior associated with any one of the plurality of malware classes;
generating a second machine learning model configured to classify, as benign traffic, network traffic executed on a network-connected host system that is similar to benign software behavior;
and
generating a third machine learning model configured to detect a particular class of malware and to classify network traffic executed on the network-connected host system that is similar to malicious behavior associated with the particular class of malware;
generating, by the one or more processors, a normalized score based on applying the at least one trained machine learning model to the extracted set of features, wherein generating the normalized score comprises:
applying the first machine learning model to the extracted set of features to generate a first score;
applying the second machine learning model to the extracted set of features to generate a second score;
applying the third machine learning model to the extracted set of features to generate a third score;
and
generating the normalized score associated with the time interval based on a combination of the first score, the second score, and the third score;
determining, by the one or more processors and from the normalized score, a likelihood that a particular network component is infected with malware;
and
storing, by the one or more processors, data indicating the likelihood that the particular network component is infected with malware.

14 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/998,513Filed 7 Nov 2013
Published: US 2015/0128263 A17 May 2015
Granted: 15 Mar 2016
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06N 7/01
Computing arrangements based on specific mathematical models: probabilistic graphical models, e.g. probabilistic networks
G06N 20/00
Machine learning