System and method for protecting computer against remote malware downloads
A system for protecting computers against remote malware downloads includes a malware download detection system and participating client computers that provide download event information to the malware download detection system. A download event information identifies a file, a network address (e.g., uniform resource locator) from which the file was downloaded, and an identifier of the client computer that downloaded the file. The malware download detection system uses the download event information to build and update a tripartite download graph, and uses the download graph to train one or more classifiers. The malware download detection system consults the one or more classifiers to classify a download event. The download event is classified as malicious if either the file or the network address is classified as malicious.
1. A computer-implemented method comprising:
detecting a download event in a client computer, the download event involving download of a file into the client computer;
forwarding a download event information from the client computer to a malware download detection system, the download event information comprising a source uniform resource locator (URL) from which the file was downloaded by the client computer, an identifier of the client computer, and an identifier of the file;
performing, by the malware download detection system, the steps of:
updating a download graph using the download event information,
training one or more classifiers using information from the download graph,
consulting the one or more classifiers to concurrently classify the file and the source URL,
classifying the download event as malicious if either the file or the source URL is classified as malicious, and
providing the client computer a result of classifying the download event,
wherein the download graph comprises a tripartite download graph, and wherein the download graph further comprises a set of nodes of source URLs, a set of nodes of client computers that provide download event information to the malware download detection system, and a set of nodes of files; and
preventing execution of the file at the client computer upon receiving from the malware download detection system the result indicating the download event is malicious.
2. The computer-implemented method of claim 1 , further comprising:
forwarding from the malware download detection system to the client computer a result of classifying the download event.
3. The computer-implemented method of claim 2 , further comprising:
quarantining the file to prevent the file from being executed before receiving the result of classifying the download event in the client computer.
4. The computer-implemented method of claim 1 , wherein each file in the set of nodes of files is identified by a hash.
5. The computer-implemented method of claim 4 , wherein the hash comprises a Secure Hash Algorithm 1 (SHA1).
6. The computer-implemented method of claim 1 , wherein each client computer in the set of nodes of client computers is identified by a globally unique identifier (GUID).
7. A system comprising:
a plurality of client computers, and
a malware download detection system;
each client computer of the plurality of client computers, comprising one or more hardware processor, is configured to:
detect a download event involving download of a file into the client computer,
forward, from the client computer to the malware download detection system, a download event information comprising a source uniform resource locator (URL) from which the file was downloaded by the client computer, an identifier of the client computer, and an identifier of the file;
the malware download detection system, comprising one or more computers, is configured to:
update a download graph using download event information received from the plurality of client computers,
train one or more classifiers using information from the download graph,
consult the one or more classifiers to classify the file and the source URL,
classify the download event as malicious if either the file or the source URL is classified as malicious, and
provide the client computer a result of classifying the download event,
wherein the download graph comprises a tripartite download graph, and wherein the download graph further comprises a set of nodes of source URLs, a set of nodes of the plurality of client computers, and a set of nodes of files; and
each client computer of the plurality of client computers further configured to:
preventing execution of the file at the client computer upon receiving from the malware download detection system the result indicating the download event is malicious.
8. The system of claim 7 , wherein the client computer is further configured to quarantine the file to prevent the file from being executed before receiving the result of classifying the download event in the client computer.
9. The system of claim 7 , wherein each file in the set of nodes of files is identified by a hash.
10. The system of claim 9 , wherein the hash comprises a Secure Hash Algorithm 1 (SHA1).
11. The system of claim 7 , wherein the plurality of client computers are each identified by a globally unique identifier (GUID).
12. A non-transitory computer-readable storage medium comprising instructions stored thereon, that when executed by a processor, perform the steps of:
detecting a download event in a client computer, the download event involving download of a file into the client computer;
forwarding a download event information from the client computer to a malware download detection system, the download event information comprising a source uniform resource locator (URL) from which the file was downloaded by the client computer, an identifier of the client computer, and an identifier of the file;
performing, by the malware download detection system, the steps of:
updating a download graph using the download event information,
training one or more classifiers using information from the download graph,
consulting the one or more classifiers to concurrently classify the file and the source URL,
classifying the download event as malicious if either the file or the source URL is classified as malicious, and
providing the client computer a result of classifying the download event,
wherein the download graph comprises a tripartite download graph, and wherein the download graph further comprises a set of nodes of source URLs, a set of nodes of client computers that provide download event information to the malware download detection system, and a set of nodes of files; and
preventing execution of the file at the client computer upon receiving from the malware download detection system the result indicating the download event is malicious.