IP Library › Granted Patent US 10,846,406

Granted Patent B2

US 10,846,406 · App. 16/114,877 · Granted Nov 24, 2020

Malware clustering based on analysis of execution-behavior reports

Inventors: Srivathsan Srinivasagopalan (Austin, TX); Alex Lisle (Austin, TX); Russell Spitler (Austin, TX); Roger Thornton (Austin, TX)

Assignee: AlienVault, Inc.

G06F21/566 G06F21/552 G06K9/6215 G06K9/6218

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 10,846,406
App. No.: 16/114,877
Filed: Aug 28, 2018
Granted: Nov 24, 2020
Kind: B2
Examiner: WALIULLAH, MOHAMMED
Art Unit: 2498
USPC: 726/22

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Techniques are disclosed relating to malware clustering based on execution-behavior reports. In some embodiments, a computer system may access malware information that includes a plurality of reports corresponding to a plurality of malware samples. In some embodiments, each of the malware reports specifies a set of features relating to execution behavior of a corresponding malware sample. The computer system may, in various embodiments, process the plurality of reports to generate a plurality of vectors that includes, for each of the malware samples, a corresponding vector indicative of the execution behavior of the corresponding malware sample. Based on the plurality of vectors, the computer system may generate similarity values indicative of a similarity between ones of the plurality of vectors. Further, based on the similarity values, the computer system may assign each of the plurality of malware samples to one of a plurality of clusters of related malware samples.

Claims (60)

1. A method comprising:

executing, in a test environment of a computer system, a plurality of malware samples;

logging, by the computer system, features corresponding to respective execution behaviors of each of the plurality of malware samples to generate a plurality of reports corresponding to the plurality of malware samples, wherein the features corresponding to the respective execution behaviors of each of the plurality of malware samples comprise internal behavioral features associated with execution behaviors of each of the plurality of malware samples that are local to the computer system on which each of the plurality of malware samples is executed and external behavioral features associated with execution behaviors of each of the plurality of malware samples that attempt to communicate with a device that is external to the computer system;

accessing, by the computer system, malware information that includes the plurality of reports corresponding to the plurality of malware samples;

processing, by the computer system, the plurality of reports to generate a plurality of vectors that includes, for each of the plurality of malware samples, a corresponding vector indicative of a respective execution behavior of a corresponding malware sample of the plurality of malware samples;

based on the plurality of vectors, generating, by the computer system, similarity values indicative of a similarity between ones of the plurality of vectors; and

based on the similarity values, assigning, by the computer system, each of the plurality of malware samples to one of a plurality of clusters of related malware samples.

2. The method of claim 1 , wherein processing the plurality of reports comprises:

accessing a list specifying features usable to differentiate between different categories of malware samples; and

based on the list, selecting, for each of the plurality of reports, a plurality of features from the features corresponding to the respective execution behaviors of each of the plurality of malware samples to generate a reduced feature set.

3. The method of claim 2 , wherein processing the plurality of reports further comprises generating a plurality of strings including a respective string for each of the plurality of reports, wherein each string is indicative of the reduced feature set for a corresponding report of the plurality of reports.

4. The method of claim 3 , wherein processing the plurality of reports further comprises generating the plurality of vectors based on the plurality of strings, wherein each of the plurality of vectors includes numerical values indicative of the reduced feature set for the corresponding report of the plurality of reports.

5. The method of claim 4 , wherein generating the similarity values comprises based on the plurality of vectors, generating a similarity matrix that specifies a similarity between each pair of the plurality of vectors wherein assigning each of the plurality of malware samples to one of the plurality of clusters of related malware samples is performed based on the similarity matrix.

6. The method of claim 1 , wherein processing the plurality of reports comprises:

based on the malware information, generating a plurality of data shingles that includes, for each of the plurality of reports, a respective set of data shingles;

generating a plurality of hash values based on the plurality of data shingles, wherein the plurality of hash values include, for each of the plurality of reports, a corresponding hash value that is based on a respective set of data shingles; and

encoding the plurality of hash values to generate the plurality of vectors.

7. The method of claim 6 , further comprising creating, by the computer system, a matrix based on the plurality of vectors, wherein each column of the matrix corresponds to a different one of the plurality of vectors.

8. The method of claim 7 , wherein generating the similarity values comprises performing a plurality of MinHash operations based on the plurality of vectors included in the matrix to generate, for each of the plurality of malware samples, a set of MinHash values, wherein assigning each of the plurality of malware samples to one of the plurality of clusters of related malware samples is performed, for a given malware sample of the plurality of malware samples, based on a respective set of MinHash values of the given malware sample of the plurality of malware samples.

9. The method of claim 1 , wherein assigning each of the plurality of malware samples to one of the plurality of clusters of related malware samples includes grouping each of the plurality of vectors into one of the plurality of clusters of related malware samples.

10. The method of claim 9 , wherein assigning each of the plurality of malware samples to one of the plurality of clusters of related malware samples is performed using locality-sensitive hashing.

11. A non-transitory, computer-readable medium having instructions stored thereon that, when executed by a processor of a computer system, cause the processor to perform operations comprising:

executing, in a test environment of the computer system, a plurality of malware samples;

logging features corresponding to respective execution behaviors of each of the plurality of malware samples to generate a plurality of reports corresponding to the plurality of malware samples, wherein the features corresponding to the respective execution behaviors of each of the plurality of malware samples comprise internal behavioral features associated with execution behaviors of each of the plurality of malware samples that are local to the computer system on which each of the plurality of malware samples is executed and external behavioral features associated with execution behaviors of each of the plurality of malware samples that attempt to communicate with a device that is external to the computer system;

accessing malware information that includes the plurality of reports corresponding to the plurality of malware samples;

processing the plurality of reports to generate a plurality of vectors that includes, for each of the plurality of malware samples, a corresponding vector indicative of a respective execution behavior of a corresponding malware sample of the plurality of malware samples;

based on the plurality of vectors, generating similarity values indicative of a similarity between ones of the plurality of vectors; and

based on the similarity values, assigning each of the plurality of malware samples to one of a plurality of clusters of related malware samples.

12. The non-transitory, computer-readable medium of claim 11 , wherein the processing the plurality of reports comprises:

accessing a list specifying features usable to differentiate between different categories of malware samples;

generating a plurality of strings, wherein the plurality of strings include a respective string for each of the plurality of reports, and wherein each string is indicative of the reduced feature set for a corresponding report of the plurality of reports.

13. The non-transitory, computer-readable medium of claim 12 , wherein processing the plurality of reports further comprises:

generating the plurality of vectors based on the plurality of strings, wherein each of the plurality of vectors includes numerical values indicative of the reduced feature set for the corresponding report; and

based on the plurality of vectors, generating a similarity matrix that specifies a similarity between each pair of the plurality of vectors.

14. The non-transitory, computer-readable medium of claim 11 , wherein processing the plurality of reports comprises:

based on the malware information, generating a plurality of data shingles that includes, for each of the plurality of reports, a respective set of data shingles;

encoding the plurality of hash values to generate the plurality of vectors.

15. The non-transitory, computer-readable medium of claim 14 , wherein the operations further comprise creating a matrix based on the plurality of vectors, wherein each column of the matrix corresponds to a different one of the plurality of vectors, wherein generating the similarity values includes performing a plurality of MinHash operations based on the plurality of vectors included in the matrix to generate, for each of the plurality of malware samples, a set of MinHash values, and wherein assigning each of the plurality of malware samples to one of the plurality of clusters of related malware samples is performed, for a given malware sample of the plurality of malware samples, based on a respective set of MinHash values of the given malware sample of the plurality of malware samples.

16. A system comprising:

at least one processor; and

a non-transitory memory having instructions stored thereon that are executable by the at least one processor to cause the system to perform operations comprising:

executing, in a test environment of the system, a plurality of malware samples,

logging features corresponding to respective execution behaviors of each of the plurality of malware samples to generate a plurality of reports corresponding to the plurality of malware samples, wherein the features corresponding to the respective execution behaviors of each of the plurality of malware samples comprise internal behavioral features associated with execution behaviors of each of the plurality of malware samples that are local to the system on which each of the plurality of malware samples is executed and external behavioral features associated with execution behaviors of each of the plurality of malware samples that attempt to communicate with a device that is external to the system,

accessing malware information that includes the plurality of reports corresponding to the plurality of malware samples,

based on the plurality of vectors, generating similarity values indicative of a similarity between ones of the plurality of vectors, and

based on the similarity values, assigning each of the plurality of malware samples to one of a plurality of clusters of related malware samples.

17. The system of claim 16 , wherein processing the plurality of reports comprises:

accessing a list specifying features usable to differentiate between different categories of malware samples;

18. The system of claim 17 , wherein processing the plurality of reports further comprises:

based on the plurality of vectors, generating a similarity matrix that specifies a similarity between each pair of the plurality of vectors.

19. The system of claim 16 , wherein processing the plurality of reports comprises:

based on the malware information, generating a plurality of data shingles that includes, for each of the plurality of reports, a respective set of data shingles;

encoding the plurality of hash values to generate the plurality of vectors.

Assignments (4)

RELEASE OF SECURITY INTEREST RECORDED AT REEL/FRAME 071914/0110 Recorded Apr 30, 2026

From: ANKURA TRUST COMPANY, LLC

To: ALIENVAULT, INC.

Reel/Frame 075366/0934 →

SECURITY INTEREST Recorded Aug 1, 2025

From: ALIENVAULT, INC.

To: ANKURA TRUST COMPANY, LLC

Reel/Frame 071914/0110 →

SECURITY INTEREST Recorded Apr 22, 2024

From: ALIENVAULT, INC.