Systems and methods for identifying variants of samples based on similarity analysis

A system for identifying variants of samples based on similarity analysis, the system comprising:

• a collection module, stored in a memory, that:
• collects, from security agents on endpoint computing systems, metadata attributes that describe samples identified by the security agents over an initial period of time to form a data repository;
• and
• collects, from the same security agents on the endpoint computing systems or different security agents on other endpoint computing systems, metadata attributes that describe a current sample identified after the initial period of time and known to comprise malware;
• a comparison module, stored in the memory, that compares, for each sample within the data repository, at least two of the metadata attributes that describe the current sample known to comprise malware with corresponding metadata attributes of the respective sample iteratively in a search, within the data repository, for malware variants of the current sample known to comprise malware, wherein the two metadata attributes comprise at least two of:
• a signature name;
• a file name;
• a file path;
• and
• a download uniform resource locator,
• a designation module, stored in the memory, that designates a sample in the data repository as a malware variant of the current sample known to comprise malware based on the comparison of the two metadata attributes at least in part by determining that a degree of relatedness between the sample in the data repository and the current sample known to comprise malware satisfies a similarity threshold;
• a performance module, stored in the memory, that performs a security action to protect a user from malware based on the designation of the sample in the data repository as the malware variant of the current sample known to comprise malware such that the user is protected from malware;
• and
• at least one physical processor configured to execute the collection module, the comparison module, the designation module, and the performance module.

A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• collect, from security agents on endpoint computing systems, metadata attributes that describe samples identified by the security agents over an initial period of time to form a data repository;
• collect, from the same security agents on endpoint computing systems or different security agents on other endpoint computing systems, metadata attributes that describe a current sample identified after the initial period of time and known to comprise malware;
• compare, for each sample within the data repository, at least two of the metadata attributes that describe the current sample known to comprise malware with corresponding metadata attributes of the respective sample iteratively in a search, within the data repository, for malware variants of the current sample known to comprise malware, wherein the two metadata attributes comprise at least two of:
• a signature name;
• a file name;
• a file path;
• and a download uniform resource locator, and the comparison detecting at least one inexact match;
• designate a sample in the data repository as a malware variant of the current sample known to comprise malware based on the comparison of the two metadata attributes during the search, within the data repository, for malware variants of the current sample known to comprise malware at least in part by determining that a degree of relatedness between the sample in the data repository and the current sample known to comprise malware satisfies a similarity threshold;
• and
• perform a security action to protect a user from malware based on the designation of the sample in the data repository as the malware variant of the current sample known to comprise malware such that the user is protected from malware.