Ontology mapping system
An article of manufacture includes a non-transitory medium including machine-readable instructions. The instructions are to be read and executed by a processor. The instructions, when read and executed by the processor, to cause the processor to receive a malware analysis of a malware from a computer security source and receive other malware analyses. Each other malware analysis is of another malware from another computer security source. The instructions may further cause the processor to perform a fuzzy matching algorithm to quantify a similarity of the malware analyses, determine that the malware is a same malware as other malware based upon results of the fuzzy matching algorithm, and later take a same corrective action for malware based upon a receipt of the malware analysis.
1 . An article of manufacture, comprising a non-transitory medium including machine-readable instructions, the instructions to be read and executed by a processor to cause the processor to:
receive a first malware analysis of a first known malware from a first computer security source database or feed, the first malware analysis to include a plurality of characterizations of the first known malware based upon a plurality of attributes of the first known malware, the attributes comprising at least a first key and a first value;
receive at least one other malware analysis, the other malware analysis of another known malware, from a second computer security source database or feed, wherein the other malware analysis to include a plurality of characterizations of the other known malware based upon a plurality of attributes of the other known malware, the attributes comprising at least a further key and a further value;
perform a fuzzy matching algorithm to quantify a similarity of the first malware analysis with the other malware analysis based upon at least the first key, the first value, the further key, and the further value, the fuzzy matching algorithm providing a fuzzy matching score;
determine that the first known malware is a same malware as the another known malware based upon results of the fuzzy matching algorithm including the fuzzy matching score, wherein the similarity is based upon matching one or more of the first key and the first value to one or more of the further key and the further value, wherein the first key and the further key are different; and
designate a smart attribute, the smart attribute configured to map the first malware analysis and the other malware analysis together, the smart attribute configured to indicate that the same corrective action is to be taken upon subsequent receipt of the first malware analysis or the other malware analysis.
2 . The article of claim 1 , further including instructions for causing the processor to designate the other malware analysis as the smart attribute based upon an instance count of the first malware analysis compared to an instance count of the other malware analysis.
3 . The article of claim 2 , further including instructions for causing the processor to designate the other malware analysis as the smart attribute based upon the instance count of the first malware analysis being less than the instance count of the other malware analysis.
4 . The article of claim 1 , further including instructions for causing the processor to, map further instances of the first malware analysis to the second malware based upon the smart attribute.
5 . A method, comprising:
receiving a first malware analysis of a first known malware from a first computer security source database or feed, the first malware analysis to include a plurality of characterizations of the first known malware based upon a plurality of attributes of the first known malware, the attributes comprising at least a first key and a first value;
receiving at least one other malware analysis, the other malware analysis of another known malware, from a second computer security source database of feed, wherein the other malware analysis to include a plurality of characterizations of the other known malware based upon a plurality of attributes of the other known malware, the attributes comprising at least a further key and a further value;
performing a fuzzy matching algorithm to quantify a similarity of the first malware analysis with the other malware analysis based upon at least the first key, the first value, the further key, and the further value, the fuzzy matching algorithm providing a fuzzy matching score;
determining that the first known malware is a same malware as the another known malware based upon results of the fuzzy matching algorithm including the fuzzy matching score, wherein the similarity is based upon matching one or more of the first key and the first value to one or more of the further key and the further value, wherein the first key and the further key are different; and
designating a smart attribute, the smart attribute configured to map the first malware analysis and the other malware analysis together, the smart attribute configured to indicate that the same corrective action is to be taken upon subsequent receipt of the first malware analysis or the other malware analysis.
6 . The method of claim 5 , further comprising designating the other malware analysis as the smart attribute based upon an instance count of the first malware analysis compared to an instance count of the other malware analysis.
7 . The method of claim 6 , further comprising designating the other malware analysis as the smart attribute based upon the instance count of the first malware analysis being less than the instance count of the other malware analysis.
8 . The method of claim 5 , further comprising mapping further instances of the first malware analysis to the other malware based upon the smart attribute.