Methods and systems for identifying potential enterprise software threats based on visual and non-visual data
Visual and non-visual elements associated with the candidate files are analyzed to determine whether the candidate files are malware. A visual element (e.g., icon) is extracted from the candidate file, and the icon's image is compared to a group of reference images associated with trusted entities. If the icon's image matches a reference image, the candidate file may be malware masquerading as trusted software. The non-visual elements associated with the candidate file are used, in combination with the visual elements, to determine whether the candidate file is malware.
1. A malware detection apparatus comprising:
a memory storing processor-executable instructions; and
a processing device configured to execute the processor-executable instructions to perform operations including:
using a malware detection component to scan for malware disguised as trusted software, including:
identifying visual and non-visual data of a first software package being presented for an action on a computing device, the visual data comprising a first icon image;
for each of a plurality of reference images including a first reference image, comparing a measure of similarity between the first icon image and the reference image to a similarity threshold associated with the reference image, the reference images and the associated similarity thresholds being managed by the malware detection component; and
determining, based at least in part on one or more of the non-visual data of the first software package, whether the first software package comprises a legitimate software package or a potential threat;
adapting the malware detection component, including:
determining that the measure of similarity between the first icon image and the first reference image is greater than the similarity threshold associated with the first reference image and the first software package is legitimate;
based, at least in part, on the measure of similarity between the first icon image and the first reference image, selecting a threat-detection adaptation from a group of adaptations comprising removing the first reference image from the plurality of reference images and increasing the similarity threshold associated with the first reference image; and
performing the selected threat-detection adaptation; and
using the adapted malware detection component to scan for malware disguised as trusted software, including: determining, based at least in part on a measure of similarity between at least one of the references images and a second icon image included in a second software package, whether the second software package is a legitimate software package or a potential threat.
2. The apparatus of claim 1 , wherein the selected thread-detection adaptation is a first threat-detection adaptation, and wherein the operations further include:
based, at least in part, on the measure of similarity between the at least one reference image and the second icon image and on the determination of whether the second software package comprises a legitimate software package or a potential threat, performing a second threat-detection adaptation selected from the group consisting of removing the at least one reference image from the plurality of reference images, and adding the second icon image to the plurality of reference images, increasing a similarity threshold associated with the at least one reference image.
3. The apparatus of claim 2 , wherein performing the second threat-detection adaptation comprises adding the second icon image to the plurality of reference images based, at least in part, on a determination that the second icon image is not substantially similar to any of the reference images in the plurality of reference images and a determination that the software package comprises a potential threat to the enterprise.
4. The apparatus of claim 1 , wherein the computing device comprises an endpoint device within an enterprise.
5. The apparatus of claim 1 , wherein the non-visual data include authentication credentials of the first software package, and wherein determining whether the first software package comprises a legitimate software package or a potential threat comprises:
determining that the measure of similarity between the first icon image and the first reference image exceeds the similarity threshold associated with the first reference image; and
determining whether the authentication credentials of the first software package are provided by a publisher of the first reference image.
6. The apparatus of claim 1 , wherein the non-visual data include a type of the first software package, and wherein determining whether the first software package comprises a legitimate software package or a potential threat comprises determining whether the first icon image is consistent with the type of the first software package.
7. The apparatus of claim 6 , wherein determining whether the first icon image is consistent with the type of the first software package comprises:
determining that the first icon image is associated with a non-executable file type;
determining that the first software package is executable; and
determining that the first icon image is not consistent with the type of the first software package.
8. The apparatus of claim 6 , wherein determining whether the first icon image is consistent with the type of the first software package comprises:
determining that the first icon image is associated with a function of an operating system;
determining that the first software package is executable; and
determining that the first icon image is not consistent with the type of the first software package.
9. A malware detection method comprising:
performing, by a processing device:
using a malware detection component to scan for malware disguised as trusted software, including:
identifying visual and non-visual data of a first software package being presented for an action on a computing device, the visual data comprising a first icon image;
for each of a plurality of reference images including a first reference image, comparing a measure of similarity between the first icon image and the reference image to a similarity threshold associated with the reference image, the reference images and the associated similarity thresholds being managed by the malware detection component; and
determining, based at least in part on one or more of the non-visual data of the first software package, whether the first software package comprises a legitimate software package or a potential threat;
adapting the malware detection component, including:
determining that the measure of similarity between the first icon image and the first reference image is greater than the similarity threshold associated with the first reference image and the first software package is legitimate;
based, at least in part, on the measure of similarity between the first icon image and the first reference image, selecting a threat-detection adaptation from a group of adaptations comprising removing the first reference image from the plurality of reference images and increasing the similarity threshold associated with the first reference image; and
performing the selected threat-detection adaptation; and
using the adapted malware detection component to scan for malware disguised as trusted software, including: determining, based at least in part on a measure of similarity between at least one of the references images and a second icon image included in a second software package, whether the second software package is a legitimate software package or a potential threat.
10. The method of claim 9 , wherein the selected threat-detection adaptation is a first threat-detection adaptation, and wherein the method further comprises:
based, at least in part, on the measure of similarity between the at least one reference image and the second icon image and on the determination of whether the second software package comprises a legitimate software package or a potential threat, performing a second threat-detection adaptation selected from the group consisting of removing the at least one reference image from the plurality of reference images, and adding the second icon image to the plurality of reference images, increasing a similarity threshold associated with the at least one reference image.
11. The method of claim 10 , wherein performing the second threat-detection adaptation comprises adding the second icon image to the plurality of reference images based, at least in part, on a determination that the second icon image is not substantially similar to any of the reference images in the plurality of reference images and a determination that the software package comprises a potential threat to the enterprise.
12. The method of claim 9 , wherein the non-visual data include authentication credentials of the first software package, and wherein determining whether the first software package comprises a legitimate software package or a potential threat comprises:
determining that the measure of similarity between the first icon image and the first reference image exceeds the similarity threshold associated with the first reference image; and
determining whether the authentication credentials of the first software package are provided by a publisher of the first reference image.
13. The method of claim 9 , wherein the non-visual data include a type of the first software package, and wherein determining whether the first software package comprises a legitimate software package or a potential threat comprises determining whether the first icon image is consistent with the type of the first software package.
14. The method of claim 13 , wherein determining whether the first icon image is consistent with the type of the first software package comprises:
determining that the first icon image is associated with a non-executable file type;
determining that the first software package is executable; and
determining that the first icon image is not consistent with the type of the first software package.
15. The method of claim 13 , wherein determining whether the first icon image is consistent with the type of the first software package comprises:
determining that the first icon image is associated with a function of an operating system;
determining that the first software package is executable; and
determining that the first icon image is not consistent with the type of the first software package.
16. A non-transitory computer-readable storage device having instructions stored thereon that, when executed by a processing device, cause the processing device to perform malware detection operations comprising:
using a malware detection component to scan for malware disguised as trusted software, including:
identifying visual and non-visual data of a first software package being presented for an action on a computing device, the visual data comprising a first icon image;
for each of a plurality of reference images including a first reference image, comparing a measure of similarity between the first icon image and the reference image to a similarity threshold associated with the reference image, the reference images and the associated similarity thresholds being managed by the malware detection component; and
determining, based at least in part on one or more of the non-visual data of the first software package, whether the first software package comprises a legitimate software package or a potential threat;
adapting the malware detection component, including:
determining that the measure of similarity between the first icon image and the first reference image is greater than the similarity threshold associated with the first reference image and the first software package is legitimate;
based, at least in part, on the measure of similarity between the first icon image and the first reference image, selecting a threat-detection adaptation from a group of adaptations comprising removing the first reference image from the plurality of reference images and increasing the similarity threshold associated with the first reference image; and
performing the selected threat-detection adaptation; and
using the adapted malware detection component to scan for malware disguised as trusted software, including: determining, based at least in part on a measure of similarity between at least one of the references images and a second icon image included in a second software package, whether the second software package is a legitimate software package or a potential threat.