Method and product for providing a predictive security product and evaluating existing security products

A method for effecting an Evolutionary Process on malware, the method comprising:

• receiving a malware specimen;
• generating variants of said malware specimen;
• evaluating an evasiveness and a maliciousness of said variants and awarding each of said variants a fitness score,
• wherein said evasiveness is measured for a variant by scanning the variant with a selected group of security products and awarding an evasiveness score based on an inability of the security products to detect the variant, and
• wherein said maliciousness is measured for the variant by determining whether the variant causes malicious activity and awarding a maliciousness score based on said determining;
• selecting said variants having at least a predefined said fitness score;
• using said selected variants to generate a new generation of said variants;
• the method further comprising:
• selecting, from among a plurality of detectors capable of detecting malicious characteristics and non-malicious characteristics of the variants, at least one detector having a rating above a predetermined level, the rating based on a number of said malicious characteristics correctly detected, a number of said non-malicious characteristics incorrectly detected, and a length of at least one of the malicious characteristics correctly detected.

A method comprising:

• receiving a malware specimen;
• generating variants of said malware specimen;
• scanning each said variant with a selected group of security products and awarding an evasiveness Score, based on an inability of said security products to detect said variant;
• determining, for each said variant, whether said variant causes malicious activity and awarding a maliciousness score based on said determination;
• awarding each said variant a fitness score based on the variant's said evasiveness score and said maliciousness score;
• the method further comprising:
• selecting, from among a plurality of detectors capable of detecting malicious characteristics and non-malicious characteristics of the variants, at least one detector having a rating above a predetermined level, the rating based on a number of said malicious characteristics correctly detected, a number of non-malicious characteristics incorrectly detected, and a length of at least one of the malicious characteristics correctly detected.

A method for generating malware variants from a malware specimen, the method comprising:

• generating the malware variants by performing at least one action selected from the group consisting of applying mutations to executable code of said malware specimens, applying mutations to malware emitted network traffic, and cross-merging said malware variants;
• evaluating an evasiveness and a maliciousness of the malware variants and awarding each of the malware variants a fitness score,
• wherein the evasiveness is measured for a malware variant by scanning the malware variant with a selected group of security products and awarding an evasiveness score based on an inability of the security products to detect the malware variant, and
• wherein said maliciousness is measured by determining whether the malware variant causes malicious activity and awarding a maliciousness score based on the determination;
• the method further comprising:
• selecting, from among a plurality of detectors capable of detecting malicious characteristics and non-malicious characteristics of the malware variants, a Detector having a rating above a predetermined level, the rating based on a number of the malicious characteristics correctly detected, a number of the non-malicious characteristics incorrectly detected, and a length of at least one of the malicious characteristics correctly detected.