Malware detection based on training using automatic feature pruning with anomaly detection of execution graphs
A threat detection system for detecting malware can automatically decide, without manual expert-level interaction, the best set of features on which to train a classifier, which can result in the automatic creation of a signature-less malware detection engine. The system can use a combination of execution graphs, anomaly detection and automatic feature pruning. Execution graphs can provide a much richer structure of runtime execution behavior than conventional flat execution trace files, allowing the capture of interdependencies while preserving attribution (e.g., D happened because of A followed by B followed by C). Performing anomaly detection on this runtime execution behavior can provide higher order knowledge as to what behaviors are anomalous or not among the sample files. During training the system can automatically prune the features on which a classifier is trained based on this higher order knowledge without any manual intervention until a desired level of accuracy is achieved.
1. A computer system comprising:
one or more memories storing instructions; and
one or more processors configured to execute the instructions to cause the system to:
receive multiple files each labeled as a threat or non-threat,
generate an execution graph of each of the received files,
identify behaviors of the multiple files from the execution graph;
perform anomaly detection on the identified behaviors to classify the identified behaviors as anomalous or non-anomalous based on the execution graphs,
iteratively generate one or more classifiers using different feature sets of classified behaviors per iteration until an accuracy threshold is met or exceeded, wherein if the one or more classifiers of a particular feature set do not meet or exceed the accuracy threshold, membership of the particular feature set is iteratively pruned until the accuracy threshold is met to provide a modified feature set and the one or more classifiers are generated again based on the modified feature set, and
output the one or more classifiers and a corresponding feature set of classified behaviors that met or exceeded the accuracy threshold for classification of the multiple files as either an actual threat or an actual non-threat.
2. The computer system of claim 1 , wherein the multiple files labeled as threat comprise malware and the multiple files labeled as non-threats do not comprise malware.
3. The computer system of claim 1 , wherein the files comprise executable files.
4. The computer system of claim 1 , wherein the files comprise word processing documents.
5. The computer system of claim 1 , wherein the files comprise PDF files.
6. The computer system of claim 1 , wherein the generation of the execution graph comprises, for each of the received file:
running the received file in a sandbox,
collecting an execution trace of the received file while running in the sandbox, and generating the execution graph based on the collected execution trace.
7. The computer system of claim 1 , wherein the generation of the execution graph comprises, for each of the received files:
running the received file in a sandbox,
monitoring the received file while running in the sandbox, and
generating the execution graph based on the monitoring of the received file.
8. The computer system of claim 1 , wherein the identification of the behaviors comprises generating frequency metrics.
9. The computer system of claim 1 , wherein the identification of the behaviors comprises generating volumetric metrics.
10. The computer system of claim 1 , wherein the identification of the behaviors comprises generating pattern metrics.
11. A computer-implemented method comprising:
receiving, by one or more processors, multiple files each labeled as a threat or non-threat,
generating, by one or more processors, an execution graph of each of the received files,
identifying, by one or more processors, behaviors of the multiple files from the execution graph;
performing anomaly detection on the identified behaviors to classify the behaviors as anomalous or non-anomalous based on the execution graphs,
iteratively generating, by one or more processors, one or more classifiers using different feature sets of classified behaviors per iteration until an accuracy threshold is met or exceeded, wherein if the one or more classifiers of a particular feature set do not meet or exceed the accuracy threshold, membership of the particular feature set is iteratively pruned until the accuracy threshold is met to provide a modified feature set and the one or more classifiers are generated again based on the modified feature set, and
outputting, by one or more processors, the one or more classifiers and a corresponding feature set of classified behaviors that met or exceeded the accuracy threshold for classification of the multiple files as either an actual threat or an actual non-threat.
12. The method of claim 11 , wherein the multiple files labeled as threat comprise malware and the multiple files labeled as non-threats do not comprise malware.
13. The method of claim 11 , wherein the generation of the execution graph comprises, for each of the received files:
running the received file in a sandbox,
collecting an execution trace of the received file while running in the sandbox, and generating the execution graph based on the collected execution trace.
14. The method of claim 11 , wherein the generation of the execution
graph comprises, for each of the received files:
running the received file in a sandbox,
monitoring the received file while running in the sandbox, and
generating the execution graph based on the monitoring of the received file.
15. A computer system comprising:
one or more memories storing instructions;
a training engine comprising one or more processors configured to execute the stored instructions to cause the training engine to:
receive multiple files each labeled as a threat or non-threat,
generate an execution graph of each of the received files,
identify behaviors of the multiple files;
performing anomaly detection on the behaviors to classify the behaviors as anomalous or non-anomalous based on the execution graphs,
iteratively generate one or more classifiers using different feature sets of classified behaviors per iteration until an accuracy threshold is met or exceeded, wherein if the one or more classifiers of a particular feature set do not meet or exceed the accuracy threshold, membership of the particular feature set is iteratively pruned until the accuracy threshold is met to provide a modified feature set and the one or more classifiers are generated again based on the modified feature set, and
output the one or more classifiers and a corresponding feature set of classified behaviors that met or exceeded the accuracy threshold for classification of the multiple files as an actual threat or an actual non-threat; and
a runtime detection engine comprising one or more processors configured to execute the stored instructions to cause the runtime detection engine to:
load the outputted one or more classifiers and the corresponding feature set of behaviors,
receive a file,
identify, from an execution graph of the received file, the behaviors corresponding to the loaded feature set, by generating the execution graph of the received file, and extracting the behaviors from the execution graph corresponding to the loaded feature set;
apply the loaded one or more classifiers to the extracted behaviors, and
output the received file with a label of threat or non-threat based on the application of the loaded one or more classifiers to the extracted behaviors.
16. A computer system comprising:
one or more memories storing instructions; and
one or more processors configured to execute the instructions to cause the system to:
receive multiple e-mails each labeled as a threat or non-threat,
receive network data associated with each of the multiple e-mails,
identify behaviors of the multiple e-mails;
perform anomaly detection on the behaviors to classify the behaviors as anomalous or non-anomalous based on the network data,
iteratively generate one or more classifiers using different feature sets of
classified behaviors per iteration until an accuracy threshold is met or exceeded, wherein if one or more classifiers of a particular feature set do not meet or exceed the accuracy threshold, membership of the particular feature set is iteratively pruned until the accuracy threshold is met to provide a modified feature set and one or more classifiers are generated again based on the modified feature set, and
output one the or more classifiers and a corresponding feature set of classified behaviors that met or exceeded the accuracy threshold for classification of e-mails as a threat or non-threat.
17. The computer system of claim 16 , wherein the network data comprises network paths associated with the received emails.