Detection center to detect targeted malware
A computerized method is described that is adapted to compare extracted features of a received object under analysis with one or more features associated with each known malicious object of a plurality of known malicious objects accessible to the one or more servers. Responsive to determining that the extracted features satisfy a prescribed level of correlation with the one or more features of a first known malicious object of the plurality of known malicious objects, identifying the received object as a malicious object. Also, responsive to determining that the extracted features fail to satisfy the prescribed level of correlation, conducting a second analysis that includes a comparison of the extracted features to the one or more features associated with each of the plurality of known malicious objects being of a type of malware other than malware targeting a specific entity.
1. A computerized method for discovering and identifying an occurrence of a cyberattack, comprising:
extracting features of an object during processing of the object;
comparing the extracted features with one or more features associated with a first plurality of known malicious objects, wherein each of the first plurality of known malicious objects includes a first type of malware directed at a particular target;
in response to determining that the extracted features fail to satisfy a prescribed level of correlation with the one or more features of any of the first plurality of known malicious objects, conducting a second analysis that includes a comparison of the extracted features to one or more features associated with a second plurality of known malicious objects associated with a second malware type, wherein the second malware type is different than the first type of malware; and
in response to determining that the extracted features satisfy a prescribed level of correlation with at least one of the one or more features associated with either the first plurality of known malicious object or the second plurality of known malicious objects, identifying the object as a malicious object.
2. The computerized method of claim 1 , wherein the first plurality of known malicious objects correspond to known malicious objects being of a type of malware directed to either a targeted individual, or industry, or government institution.
3. The computerized method of claim 1 , wherein an attacker profile is maintained with a database with one or more objects that tend to be generated or disseminated by an attacker with the attacker profile.
4. The computerized method of claim 1 , wherein the object associated with the extracted features is a file suspected to contain malware code.
5. The computerized method of claim 4 , wherein the extracted features are extracted at least after the malware code has been activated.
6. The computerized method of claim 1 , wherein the object associated with the extracted features corresponds to a dropped object that is generated during processing of another object within one or more virtual machines.
7. The computerized method of claim 1 , wherein the malicious object is part of a campaign when the malicious object is part of a campaign when (i) the malicious object is one of a number of malicious objects above a threshold detected within a specified time period, and (ii) each object included in the number of objects corresponds to a particular attacker profile.
8. The computerized method of claim 1 , further comprising:
transmitting a warning to a user of the client device that the object associated with the extracted features is a malicious object targeting the user in response to determining that the extracted features of the object associated with the extracted features are similar to the one or more features of any of the first plurality of known malicious objects or the second plurality of known malicious objects.
9. The computerized method of claim 8 , wherein the object associated with the extracted features is received from the client device and the warning is presented to the user on the client device.
10. The computerized method of claim 1 , wherein the extracted features include data describing the behavior and characteristics of the object associated with the extracted features.
11. The computerized method of claim 1 , wherein the comparing of the extracted features with one or more features of the plurality of known malicious objects comprises comparing the extracted features with the one or more features of the first plurality of known malicious objects being part of a plurality of known malicious objects and the comparing of the extracted features with the one or more features of the second plurality of known malicious objects are conducted based on statistical and machine learning techniques in determining whether the extracted features are similar to one or more features associated with any of the first plurality of known malicious objects and the second plurality of known malicious objects.
12. The computerized method of claim 1 , further comprising:
analyzing a database to determine a severity of the object associated with the extracted features.
13. The computerized method of claim 12 , wherein the analyzing of the database comprises:
comparing extracted features of a first object to extracted features of the object; and
associating the first object and the object with an attacker profile upon determining that multiple objects, including the first object and the object, share a predefined number of the extracted features.
14. The computerized method of claim 13 , further comprising:
comparing extracted features from a second object with one or more of the first object and the object associated with the attacker profile; and
attributing the second object to an attacker associated with the attacker profile upon determining that the second object shares the predefined number of extracted features with multiple objects including the first object and the object.
15. The computerized method of claim 12 , wherein the analyzing of the database comprises:
ranking the severity of the object, wherein the severity of the object is based on one or more of a size of a target and damage that could be caused by the object.
16. The computerized method of claim 15 , wherein the specific entity being either an organization or an individual within the organization.
17. The computerized method of claim 1 , wherein the detected number of objects are associated with a single attacker.
18. A non-transitory storage medium including instructions discovering and identifying a cyberattack, comprising:
a first logic to extract features of an object during processing of the object by one or more virtual machines; and
a second logic to compare the extracted features with one or more features associated with a first plurality of known malicious objects, each of the first plurality of known malicious objects includes a first type of malware that is directed at a particular target, wherein
in response to determining that the extracted features fail to satisfy a prescribed level of correlation with the one or more features of any of the first plurality of known malicious objects, the second logic to conduct a second analysis that includes a comparison of the extracted features to one or more features associated with a second plurality of known malicious objects associated with a second malware type, wherein the second malware type is different than the first type of malware, and
in response to determining that the extracted features satisfy a prescribed level of correlation with at least one of the one or more features associated with either the first plurality of known malicious objects or the second plurality of known malicious objects, identifying the object as a malicious object.
19. The non-transitory storage medium of claim 18 , wherein the first plurality of known malicious objects correspond to known malicious objects being of a type of malware directed to either a targeted individual, or industry, or government institution.
20. The non-transitory storage medium of claim 18 , wherein the second logic being configured with access to a database including a plurality of attacker profiles and the plurality of attacker profiles being used for attribution of the object, identified as the malicious object, to a particular attacker.
21. The non-transitory storage medium of claim 18 , wherein the malicious object is part of a campaign when the malicious object is one of a number of malicious objects above a threshold detected within a specified time period.
22. The non-transitory storage medium of claim 18 , further comprising:
logic to transmit a warning to a user of the client device that the object associated with the extracted features is a malicious object targeting the user in response to determining that the extracted features of the object are similar to the one or more features of any of the first plurality of known malicious objects.
23. The non-transitory storage medium of claim 18 , wherein the second logic further configured to determine whether the object is a malicious object by at least (i) comparing extracted features of a first object to extracted features of the object, and (ii) associating the first object and the object with an attacker profile upon determining that multiple objects, including the first object and the object, share a predefined number of the extracted features.
24. The non-transitory storage medium of claim 18 , further comprising:
analyzing a database to determine a severity of the object associated with the extracted features; and
ranking the severity of the object, wherein the severity of the object is based on one or more of a size of a target and damage that could be caused by the object.
25. A system for identifying and discovering cyberattacks, comprising:
a network interface;
one or more hardware processors communicatively coupled to the network interface;
a memory communicatively coupled to one or more hardware processors, the memory including one or more software modules that, when executed by the one or more hardware processors:
extracting features of an object, received via the network interface from a client device remotely located from the system, during processing of the received object by one or more virtual machines,
comparing the extracted features with one or more features associated with a first plurality of known malicious objects, wherein the first plurality of known malicious objects includes a first type of malware directed at a particular target,
responsive to determining that the extracted features fail to satisfy a prescribed level of correlation with any of the one or more features associated with each malicious object of the first plurality of known malicious objects, conducting a second analysis that includes a comparison of the extracted features to one or more features associated with a second plurality of known malicious objects of a second malware type, wherein the second malware type is different than the first type of malware, and
in response to determining that the extracted features satisfy a prescribed level of correlation with at least one of the one or more features associated with either the first plurality of known malicious objects or the second plurality of known malicious objects, identifying the object as a malicious object.
26. The system of claim 25 , wherein the first plurality of known malicious objects correspond to known malicious objects being of a type of malware directed to either a targeted individual, or industry, or government institution.
27. The system of claim 25 , wherein the one or more software modules, when executed by the one or more hardware processors, are configured for accessing a database including a plurality of attacker profiles and the plurality of attacker profiles being used for attribution of the object, identified as the malicious object, to a particular attacker.
28. The system of claim 25 , wherein the malicious object is part of a campaign when the malicious object is one of a number of malicious objects above a threshold detected within a specified time period.
29. The system of claim 25 , wherein the one or more software modules, when executed by the one or more hardware processors, are further configured to transmit a warning to a user of the client device that the object associated with the extracted features is a malicious object targeting the user in response to determining that the extracted features of the object are similar to the one or more features of any of the first plurality of known malicious objects.
30. The system of claim 25 , wherein the one or more software modules, when executed by the one or more hardware processors, are further configured to determine whether the object is a malicious object by at least (i) comparing extracted features of a first object to extracted features of the object, and (ii) associating the first object and the object with an attacker profile upon determining that multiple objects, including the first object and the object, share a predefined number of the extracted features.
31. The system of claim 25 , the one or more software modules, when executed by the one or more hardware processors, are further configured to analyze a database to determine a severity of the object associated with the extracted features and rank the severity of the object, wherein the severity of the object is based on one or more of a size of a target and damage that could be caused by the object.