US 9,852,297 B1 · Methods and apparatus for detecting malware samples with similar image sets

Abstract

An apparatus can include a processor that can extract, from an input binary file, an image data structure, and can scale the image data structure to a predetermined size, and/or modify the image data structure to represent a grayscale image. The processor can calculate a modified pixel value for each pixel in the image data structure, and can define a binary vector based on the modified pixel value for each pixel in the image data structure. The processor can also identify a set of nearest neighbor binary vectors for the binary vector based on a comparison between the binary vector and a set of reference binary vectors stored in a malware detection database. The processor can then determine a malware status of the input binary file based on the set of nearest neighbor binary vectors satisfying a similarity criterion associated with a known malware image from a known malware file.

Claims20

Dependent claims

An apparatus, comprising:

a memory;
and
a processor operatively coupled to the memory, the processor configured to extract, from an input binary file, an image data structure representative of an image associated with the input binary file, the processor configured to define a binary vector based on a plurality of pixel values in the image data structure,
the processor configured to identify, from a plurality of reference binary vectors stored in a malware detection database, a subset of reference binary vectors based on a similarity of the subset of reference binary vectors with the binary vector, the processor configured to determine a malware status of the input binary file based on the subset of reference binary vectors satisfying a similarity criterion associated with a known malware image from a known malware file.

1 more element

A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

extract an image from an input binary file;
generate a binary vector based on a set of pixel values of the image;
identify a set of reference binary vectors in a malware detection database based on a similarity between the binary vector and the set of reference binary vectors;
calculate a threat score for the input binary file based on the set of reference binary vectors;
and
identify the input binary file as a malware file when the threat score satisfies a predetermined criterion.

3 more elements

A method, comprising:

receiving an input binary file including an image;
defining a pixel vector for the image based on a set of pixels of the image;
defining a set of pixel vector groups for a plurality of pixel vectors stored in a malware detection database, each pixel vector group from the set of pixel vector groups being associated with a known malware sample;
for each pixel vector group from the set of pixel vector groups:
calculating a distance between each pixel vector in that pixel vector group and the pixel vector for the image, and
calculating a similarity score for that pixel vector group based on the distance between each pixel vector from that pixel vector group and the pixel vector for the image;
calculating a threat score for the input binary file based on the similarity score for each pixel vector group from the set of pixel vector groups;
and
identifying the input binary file as a malware file when the threat score satisfies a predetermined criterion.

6 more elements

Dependencies are inferred from the claim text.

Methods and apparatus for detecting malware samples with similar image sets

Life of this patent

Methods and apparatus for detecting malware samples with similar image sets

Life of this patent

Abstract

Claims20