Method and apparatus for detecting malicious software using machine learning techniques
Novel methods, components, and systems for detecting malicious software in a proactive manner are presented. More specifically, we describe methods, components, and systems that leverage machine learning techniques to detect malicious software. The disclosed invention provides a significant improvement with regard to detection capabilities compared to previous approaches.
1. A computer implemented method for determining whether a software application is malicious, comprising:
accessing in a training phase, using a server application, a body of training data comprising a set of software applications, said server application configured to derive during said training phase a classification algorithm for determining whether software applications are likely benign or malicious;
before execution of a software application of interest, extracting, using a client or server application, a feature vector from the software application of interest by applying a mathematical transformation operation to the software application of interest to generate a series of values that represents features of the software application of interest and that is indicative of whether or not the software application of interest is likely to be benign or malicious;
applying the feature vector to the classification algorithm;
using the results of the classification algorithm to determine how to treat the software application of interest.
2. A computer implemented method for determining whether a software application is malicious, comprising:
accessing in a training phase a body of training data comprising a set of software applications to derive during said training phase a classification algorithm for determining whether selected software applications are likely benign or malicious;
before execution of a software application of interest, receiving from a client application a feature vector relating to the software application of interest, wherein the feature vector is generated by applying a mathematical transformation operation to the software application of interest and comprises a series of values that represents features of the software application of interest and that is indicative of whether or not the software application of interest is likely to be benign or malicious;
applying the feature vector to the classification algorithm;
transmitting information indicative of a maliciousness of the software application of interest to the client application based on the results of the application of the feature vector to the classification algorithm.
3. A computer implemented method for determining whether a software application is malicious, comprising:
before execution of a software application, extracting a feature vector from the software application by applying a mathematical transformation operation to the software application to generate a series of values that represents features of the software application and that is indicative of whether or not the software application is likely to be benign or malicious;
transmitting said feature vector to a server application;
receiving information indicative of a maliciousness of the software application from said server application relating to results of applying said feature vector to a classification algorithm concerning whether said software application is benign or potentially malicious.
4. A method according to claim 1 , wherein the classification algorithm produces a score that represents confidence in its determination as to whether the software application is benign or malicious.
5. A method according to claim 1 , wherein the data used to derive the classification algorithm is can be taken directly from transaction logs of actual client systems that communicate with the server side component.
6. A method according to claim 1 , wherein the classification algorithm is developed using a machine learning method selected from the group consisting of Support Vector Machines, Neural Networks, Decision Trees, naive Bayes, Logistic Regression.
7. A method according to claim 1 , wherein the feature vector is encoded.
8. A method according to claim 1 , wherein the feature vector is compressed.
9. A method according claim 1 , wherein, following application of the feature vector to the classification algorithm, the application is transmitted to a server for further processing.
10. A method according to claim 1 , wherein the body of training data includes actual in-field usage data.
11. A method according to claim 1 , wherein the output of the classification algorithm is compared to results from another method for identifying malicious software.
12. A method according to claim 1 , wherein the body of training data comprises a set of software applications.
13. A method according to claim 12 , wherein software applications in the body of training data are associated with a disposition label.