MALWARE DETECTION USING MULTIPLE CLASSIFIERS
A method of identifying a malware file using multiple classifiers is disclosed. The method includes receiving a file at a client computer. The file includes static metadata. A set of metadata classifier weights are applied to the static metadata to generate a first classifier output. A dynamic classifier is initiated to evaluate the file and to generate a second classifier output. The method includes automatically identifying the file as potential malware based on at least the first classifier output and the second classifier output.
1 . A method of identifying a malware file using multiple classifiers, the method comprising:
receiving a file at a client computer, wherein the file includes static metadata;
applying a set of metadata classifier weights to the static metadata to generate a first classifier output;
initiating a dynamic classifier to evaluate the file and to generate a second classifier output;
automatically identifying the file as potential malware based on at least the first classifier output and the second classifier output.
2 . The method of claim 1 , wherein the dynamic classifier includes an emulation classifier.
3 . The method of claim 2 , wherein the emulation classifier simulates execution of the file in an emulation environment.
4 . The method of claim 3 , wherein the emulation environment protects the client computer from being infected while the file is tested in the emulation environment.
5 . The method of claim 3 , further comprising:
determining a set of application programming interfaces invoked at the emulation environment; and
determining that at least one application programming interface of the set of application programming interfaces is associated with malware.
6 . The method of claim 1 , wherein the dynamic classifier includes a behavioral classifier.
7 . The method of claim 6 , wherein the behavioral classifier analyzes the file during installation to identify one or more installation behavioral features associated with malware.
8 . The method of claim 6 , wherein the behavioral classifier analyzes the file during run-time to identify one or more run-time behavioral features associated with malware.
9 . The method of claim 1 , wherein the set of metadata classifier weights is used to produce a statistical likelihood that particular metadata is associated with malware.
10 . The method of claim 1 , wherein the static metadata is represented as a feature vector, and wherein the first classifier output is determined, at least in part, based on a dot product of the set of metadata classifier weights and the feature vector.
11 . A method of classifying a file, the method comprising:
receiving a file at a client computer;
initiating a static type of classification analysis on the file;
initiating an emulation type of classification analysis on the file;
initiating a behavioral type of classification analysis on the file;
taking an action with respect to the file based on a result of at least one of the static type of classification analysis, the emulation type of classification analysis, and the behavioral type of classification analysis.
12 . The method of claim 11 , wherein the action includes at least one of blocking execution of the file and blocking installation of the file.
13 . The method of claim 11 , wherein the file is an unknown file, and wherein the action includes providing an indication that the unknown file includes potential malware, wherein the indication is provided via a user interface.
14 . The method of claim 11 , wherein the action includes querying a web service for additional information about the file.
15 . The method of claim 11 , wherein the action includes submitting the file for additional emulation type classification analysis to determine whether the file includes malware.
16 . A system to classify a file, the system comprising:
a classifier report evaluation component to receive and evaluate a plurality of classifier reports from a set of client computers; and
a hierarchical classifier component, comprising:
a metadata classifier to evaluate metadata of a file sampled by at least one of the client computers to generate a first classifier output;
a dynamic classifier to generate a second classifier output; and
a classifier results output to provide an aggregated output related to predicted malware content of at least one file associated with at least one of the plurality of classifier reports.
17 . The system of claim 16 , wherein the dynamic classifier includes an emulation classifier and a behavioral classifier.
18 . The system of claim 16 , wherein an output from the metadata classifier determines a length of time that the dynamic classifier is run.
19 . The system of claim 16 ,
wherein the classifier report evaluation component identifies and prioritizes a set of classifier reports from the plurality of classifier reports and requests sample files associated with the set of classifier reports from at least one of the client computers;
wherein the hierarchical classifier component evaluates each of the set of classifier reports to determine an estimated likelihood that the requested sample files include malware content; and
wherein the classifier report evaluation component ranks the set of classifier reports based on the estimated likelihood that the requested sample files include malware content.
20 . A computer-readable medium comprising instructions that, when executed by a computer, cause the computer to:
receive a plurality of files at a client computer;
initiate a static type of classification analysis on the plurality of files;
initiate an emulation type of classification analysis on the plurality of files;
initiate a behavioral type of classification analysis on the plurality of files; and
take an action with respect to the plurality of files based on a result of at least one of the static type of classification analysis, the emulation type of classification analysis, and the behavioral type of classification analysis.