SYSTEM AND METHOD FOR CATEGORIZING MALWARE
A system for categorizing malware threat names comprising a malware correlator and a frequency graph constructor engine based on a malware virus predicate. The malware correlator can categorize malware threat names based on a malware virus predicate or malware virus network behavior. The frequency graph constructor engine can construct a graphical representation of the malware threat family.
1 . A system for categorizing threat names, comprising:
a malware correlator that analyzes and generates families of malware threats by correlating raw malware data corresponding to a malware virus predicate; and
a frequency graph constructor engine that generates frequency display data corresponding to families of malware threat names.
2 . The system of claim 1 , further comprising a malware database collecting at least malware names or family of malware names.
3 . The system of claim 2 , wherein a malware database collects raw malware data from an antivirus product.
4 . The system of claim 2 , wherein the malware database queries a third party for malware raw data.
5 . The system of claim 1 , further comprising a malware virus predicate associated with a malware virus network behavior.
6 . The system of claim 1 , wherein the malware virus predicate corresponds to at least a unique hash value, a secure hash algorithm 1, or a malware name.
7 . The system of claim 5 , wherein the malware virus network behavior corresponds to at least a IP address destination over a period of time, a domain address destination over a period of time, or a peer to peer network behavior over a period of time.
8 . The system of claim 1 , wherein a malware database collects a list of unique malware hash values.
9 . The system of claim 1 , wherein the frequency display data corresponds to a graphical representation of a word cloud.
10 . The system of claim 1 , further comprising determining whether unique malware hash values have been queried.
11 . A computer implemented method for categorizing threats, comprising:
gathering raw data for malware;
querying malware database with a malware virus predicate;
collecting malware data resulting from query;
generating family of malware threats by correlating collected malware data;
constructing a frequency display data of correlated malware; and
generating a user interface.
12 . The method of claim 11 , further comprising a malware database collecting at least malware names or family of malware names.
13 . The method of claim 12 , wherein a malware database collects raw malware data from an antivirus product.
14 . The method of claim 12 , wherein the malware database queries a third party for malware raw data.
15 . The method of claim 11 , wherein the malware virus predicate corresponds to at least a unique hash value, a secure hash algorithm 1, or a malware name.
16 . The method of claim 11 , further comprising a malware virus predicate associated with a malware virus network behavior.
17 . The method of claim 16 , wherein the malware virus network behavior corresponds to at least a IP address destination over a period of time, a domain address destination over a period of time, or a peer to peer network behavior over a period of time.
18 . The method of claim 12 , wherein a malware database collects a list of unique malware hash values.
19 . The method of claim 11 , wherein the frequency display data corresponds to a graphical representation of a word cloud.
20 . The method of claim 11 , further comprising determining whether unique malware hash values have been queried.