Search International and National Patent Collections

1. (WO2015047803) MALWARE DETECTION BASED ON VM BEHAVIORAL ANALYSIS AND MACHINE LEARNING CLASSIFICATION

Pub. No.:    WO/2015/047803    International Application No.:    PCT/US2014/055958
Publication Date: Fri Apr 03 01:59:59 CEST 2015 International Filing Date: Wed Sep 17 01:59:59 CEST 2014
IPC: G06F 21/56
H04L 29/06
Applicants: FIREEYE, INC.
Inventors: MESDAQ, Ali
WESTIN III, Paul L.
Title: MALWARE DETECTION BASED ON VM BEHAVIORAL ANALYSIS AND MACHINE LEARNING CLASSIFICATION
Abstract:
A computerized method is described in which a received object is analyzed by a malicious content detection (MCD) system to determine whether the object is malware or non-malware. The analysis may include the generation of a fuzzy hash based on a collection of behaviors for the received object. The fuzzy hash may be used by the MCD system to determine the similarity of the received object with one or more objects in previously classified/analyzed clusters. Upon detection of a "similar" object, the suspect object may be associated with the cluster and classified based on information attached to the cluster. This similarity matching provides 1) greater flexibility in analyzing potential malware objects, which may share multiple characteristics and behaviors but are also slightly different from previously classified objects and 2) a more efficient technique for classifying/assigning attributes to objects.