Classifying software modules based on comparisons using a neighborhood distance metric
View Patent ↗A method comprises obtaining at least a first software module not classified as benign or potentially malicious, extracting a set of features associated with the first software module, the set of features comprising static features, behavior features and context features, identifying a first cluster comprising one or more known software modules previously classified as benign, computing distance metrics between the extracted feature set of the first software module and feature sets of respective ones of the known software modules in the first cluster, classifying the first software module as one of benign and potentially malicious based on a comparison between the computed distance metrics and a neighborhood distance metric based on distances between feature sets of the known software modules in the first cluster, and modifying access by a given client device to the first software module responsive to classifying the first software module as potentially malicious.
1. A method comprising:
obtaining at least a first software module not classified as benign or potentially malicious;
extracting a set of features associated with the first software module, the set of features comprising one or more static features, one or more behavior features and one or more context features;
identifying a first cluster, the first cluster comprising one or more known software modules previously classified as benign;
computing distance metrics between the extracted feature set of the first software module and feature sets of respective ones of the known software modules in the first cluster;
classifying the first software module as one of benign and potentially malicious based on a comparison between the computed distance metrics and a neighborhood distance metric, the neighborhood distance metric being based on distances between feature sets of the known software modules in the first cluster; and
modifying access by a given client device to the first software module responsive to classifying the first software module as potentially malicious;
wherein computing the distance metrics comprises assigning penalty values for one or more features missing in the extracted feature set of the first software module;
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.
2. The method of claim 1 wherein the processing device comprises a network security system configured to communicate with a plurality of client devices, including the given client device, over at least one network.
3. The method of claim 1 wherein the first software module comprises one of: an executable module; and a dynamic link library module.
4. The method of claim 1 wherein the one or more static features comprise one or more descriptive features, one or more numerical features and one or more binary features.
5. The method of claim 1 wherein the one or more behavior features comprise one or more file system access features, one or more process access features and one or more network connection features.
6. The method of claim 1 wherein the one or more context features comprise one or more file system path features, one or more path of destination events features, one or more file metadata features and one or more auto-start functionality features.
7. The method of claim 1 wherein extracting the set of features associated with the first software module comprises:
extracting the static features from the first software module; and
extracting the behavior and context features from one or more client devices storing the first software module.
8. The method of claim 1 wherein computing the distance metrics comprises assigning weights to respective ones of the features in the extracted feature set.
9. The method of claim 8 wherein the weight assigned to a given feature in the extracted feature set is proportional to an information gain of the given feature in a plurality of software modules including the first software module and the known software modules in the first cluster.
10. The method of claim 8 wherein the weight assigned to a given feature in the extracted feature set is based on:
a dynamic feature weight based on distances between the value of the given feature for pairs of known software modules in the first cluster; and
a static feature weight set proportional to an information gain of the given feature in a plurality of software modules including the first software module and the known software modules in the first cluster.
11. The method of claim 1 wherein identifying the first cluster comprises matching at least one of:
a filename of the first software module to one or more filenames of the known software modules in the first cluster; and
a file description of the first software module to one or more file descriptions of the known software modules in the first cluster.
12. The method of claim 1 wherein:
a number of known software modules in the first cluster exceeds a first threshold;
a ratio between the number of known software modules to all software modules in the first cluster exceeds a second threshold; and
the average distances between feature sets of known software modules in the first cluster is less than a third threshold.
13. The method of claim 1 wherein classifying the first software module comprises:
computing, for each known software module in the first cluster, a minimum distance between that known software module and other known software modules in the first cluster; and
setting the neighborhood distance metric to a maximum of the minimum distances between known software modules in the first cluster.
14. The method of claim 1 wherein classifying the first software module comprises:
identifying a minimum one of the computed distance metrics between the extracted feature set of the first software module and feature sets of respective ones of the known software modules in the first cluster;
classifying the first software module as benign if a ratio of the identified minimum computed distance metric to the neighborhood distance metric is less than a first threshold; and
otherwise classifying the first software module as potentially malicious.
15. The method of claim 1 wherein modifying access by the given client device to the first software module comprises at least one of:
removing the first software module from a memory or storage of the given client device;
preventing the given client device from obtaining the first software module; and
causing the first software module to be opened in a sandboxed application environment on the given client device.
16. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device cause the at least one processing device:
to obtain at least a first software module not classified as benign or potentially malicious;
to extract a set of features associated with the first software module, the set of features comprising one or more static features, one or more behavior features and one or more context features;
to identify a first cluster, the first cluster comprising one or more known software modules previously classified as benign;
to compute distance metrics between the extracted feature set of the first software module and feature sets of respective ones of the known software modules in the first cluster;
to classify the first software module as one of benign and potentially malicious based on a comparison between the computed distance metrics and a neighborhood distance metric, the neighborhood distance metric being based on distances between feature sets of the known software modules in the first cluster; and
to modify access by a given client device to the first software module responsive to classifying the first software module as potentially malicious;
wherein computing the distance metrics comprises assigning penalty values for one or more features missing in the extracted feature set of the first software module.
17. The computer program product of claim 16 wherein the program code when executed causes the processing device to classify the first software module by:
computing, for each known software module in the first cluster, a minimum distance between that known software module and other known software modules in the first cluster;
setting the neighborhood distance metric to a maximum of the minimum distances between known software modules in the first cluster;
identifying a minimum one of the computed distance metrics between the extracted feature set of the first software module and feature sets of respective ones of the known software modules in the first cluster;
classifying the first software module as benign if a ratio of the identified minimum computed distance metric to the neighborhood distance metric is less than a first threshold; and
otherwise classifying the first software module as potentially malicious.
18. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured:
to obtain at least a first software module not classified as benign or potentially malicious;
to extract a set of features associated with the first software module, the set of features comprising one or more static features, one or more behavior features and one or more context features;
to identify a first cluster, the first cluster comprising one or more known software modules previously classified as benign;
to compute distance metrics between the extracted feature set of the first software module and feature sets of respective ones of the known software modules in the first cluster;
to classify the first software module as one of benign and potentially malicious based on a comparison between the computed distance metrics and a neighborhood distance metric, the neighborhood distance metric being based on distances between feature sets of the known software modules in the first cluster; and
to modify access by a given client device to the first software module responsive to classifying the first software module as potentially malicious;
wherein computing the distance metrics comprises assigning penalty values for one or more features missing in the extracted feature set of the first software module.
19. The apparatus of claim 18 wherein the at least one processing device is further configured to classify the first software module by:
computing, for each known software module in the first cluster, a minimum distance between that known software module and other known software modules in the first cluster;
setting the neighborhood distance metric to a maximum of the minimum distances between known software modules in the first cluster;
identifying a minimum one of the computed distance metrics between the extracted feature set of the first software module and feature sets of respective ones of the known software modules in the first cluster;
classifying the first software module as benign if a ratio of the identified minimum computed distance metric to the neighborhood distance metric is less than a first threshold; and
otherwise classifying the first software module as potentially malicious.