Detecting malware using stored patterns
View Patent ↗In one embodiment, a method includes identifying a plurality of portions of a file and comparing the plurality of portions of the file to a plurality of stored patterns. The plurality of stored patterns include portions of known malware. The method also includes determining, from the plurality of portions of the file and based on the comparing of the plurality of portions of the file to the plurality of stored patterns, a set of matching portions. The set of matching portions include one or more of the plurality of portions of the file. In addition, the method includes determining a score for each portion in the set of matching portions and providing information regarding the set of matching portions. The information includes the scores determined for each portion of the set of matching portions.
1. A method comprising:
identifying, by at least one processor, a plurality of portions of a file;
comparing, by the at least one processor, the plurality of portions of the file to a plurality of stored patterns, the plurality of stored patterns comprising portions of known malware;
determining, by at least one processor, from the plurality of portions of the file and based on the comparing of the plurality of portions of the file to the plurality of stored patterns comprising portions of known malware, a set of matching portions, the set of matching portions comprising one or more of the plurality of portions of the file;
determining, by at least one processor, a first score for each portion in the set of matching portions;
determining an overall score for the file as a function of the first scores;
comparing the overall score to a threshold to determine whether the file comprises malware, wherein the threshold is based on the context of how the file was received; and
providing, by at least one processor, information regarding the set of matching portions, the information comprising the first score determined for each portion of the set of matching portions and the overall score;
wherein each first score is determined based on the frequency with which each respective portion in the set of matching portions occurs in the plurality of stored patterns.
2. The method of claim 1 , wherein each first score comprises a ranking of a likelihood that each respective portion in the set of matching portions is associated with malware.
3. The method of claim 1 , wherein comparing the plurality of portions of the file to the plurality of stored patterns comprises comparing byte sequences or text strings.
4. The method of claim 1 , wherein the information is provided to a human analyst to assist in determining whether the file is malware.
5. The method of claim 1 , wherein the information further comprises a description of each portion in the set of matching portions.
6. The method of claim 1 , further comprising:
in response to determining the first score for each portion in the set of matching portions, determining, by the at least one processor, that the file is potential malware; and
in response to determining that the file is potential malware, performing , by the at least one processor, remedial action regarding the file.
7. A system comprising:
at least one computer-readable medium; and
one or more processors configured to:
identify a plurality of portions of a file;
compare the plurality of portions of the file to a plurality of stored patterns, the plurality of stored patterns comprising portions of known malware;
determine, from the plurality of portions of the file and based on the comparing of the plurality of portions of the file to the plurality of stored patterns comprising portions of known malware, a set of matching portions, the set of matching portions comprising one or more of the plurality of portions of the file;
determine a first score for each portion in the set of matching portions;
determine an overall score for the file as a function of the first scores;
compare the overall score to a threshold to determine whether the file comprises malware, wherein the threshold is based on the context of how the file was received; and
provide information regarding the set of matching portions, the information comprising the first score determined for each portion of the set of matching portions and the overall score;
wherein the one or more processors are configured to determine each first score based on the frequency with which each respective portion in the set of matching portions occurs in the plurality of stored patterns.
8. The system of claim 7 , wherein each first score comprises a ranking of a likelihood that each respective portion in the set of matching portions is associated with malware.
9. The system of claim 7 , wherein the one or more processors are configured to compare the plurality of portions of the file to the plurality of stored patterns by comparing byte sequences or text strings.
10. The system of claim 7 , wherein the one or more processors are configured to provide the information to a human analyst to assist in determining whether the file is malware.
11. The system of claim 7 , wherein the information further comprises a description of each portion in the set of matching portions.
12. The system of claim 7 , wherein the one or more processors are further configured to:
determine that the file is potential malware in response to determining the first score for each portion in the set of matching portions; and
perform remedial action regarding the file in response to determining that the file is potential malware, performing remedial action regarding the file.
13. At least one non-transitory computer-readable medium comprising instructions that, when executed by one or more processors, are configured to:
identify a plurality of portions of a file;
compare the plurality of portions of the file to a plurality of stored patterns, the plurality of stored patterns comprising portions of known malware;
determine, from the plurality of portions of the file and based on the comparing of the plurality of portions of the file to the plurality of stored patterns comprising portion of known malware, a set of matching portions, the set of matching portions comprising one or more of the plurality of portions of the file;
determine a first score for each portion in the set of matching portions;
determine an overall score for the file as a function of the first scores;
compare the overall score to a threshold to determine whether the file comprises malware, wherein the threshold is based on the context of how the file was received; and
provide information regarding the set of matching portions, the information comprising the first score determined for each portion of the set of matching portions and the overall score;
wherein the instructions are configured to determine each first score based on the frequency with which each respective portion in the set of matching portions occurs in the plurality of stored patterns.
14. The at least one non-transitory computer-readable medium of claim 13 , wherein each first score comprises a ranking of a likelihood that each respective portion in the set of matching portions is associated with malware.
15. The at least one non-transitory computer-readable medium of claim 13 , wherein the instructions are configured to compare the plurality of portions of the file to the plurality of stored patterns by comparing byte sequences or text strings.
16. The at least one non-transitory computer-readable medium of claim 13 , wherein the instructions are configured to provide the information to a human analyst to assist in determining whether the file is malware.
17. The at least one non-transitory computer-readable medium of claim 13 , wherein the information further comprises a description of each portion in the set of matching portions.
18. The at least one non-transitory computer-readable medium of claim 13 , wherein the instructions are further configured to:
determine that the file is potential malware in response to determining the first score for each portion in the set of matching portions; and
perform remedial action regarding the file in response to determining that the file is potential malware, performing remedial action regarding the file.