Computer assisted identification of intermediate level threats
An ensemble of detection techniques are used to identify code that presents intermediate levels of threat. For example, an ensemble of machine learning techniques may be used to evaluate suspiciousness based on binaries, file paths, behaviors, reputations, and so forth, and code may be sorted into safe, unsafe, intermediate, or any similar categories. By filtering and prioritizing intermediate threats with these tools, human threat intervention can advantageously be directed toward code samples and associated contexts most appropriate for non-automated responses.
1. A computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
providing a training set including threat samples that are known to be safe and known to be malicious;
tagging each one of the threat samples with one or more tags that identify corresponding, observed behavior;
training a first machine learning model to identify malicious code in the training set based on the one or more tags;
training a second machine learning model to identify malicious code in the training set based on a corresponding file path for each of the threat samples;
training a third machine learning model to identify malicious code in the training set based on one or more Uniform Resource Locators contained in each of the threat samples;
creating an integrative model that evaluates a probability that an unknown threat sample is malicious based on a combination of the first machine learning model, the second machine learning model and the third machine learning model; and
conditionally presenting a new threat sample for human intervention when the probability calculated by the integrative model identifies the new threat sample as an intermediate threat that fails to fall within a first predetermined threshold of likely safe or within a second predetermined threshold of likely malicious.
2. The computer program product of claim 1 further comprising code that performs the step of displaying a plurality of intermediate threats, each failing to fall within the first predetermined threshold and the second predetermined threshold, in a user interface, the plurality of intermediate threats ranked according to likelihood of threat.
3. The computer program product of claim 2 wherein the plurality of intermediate threats are ranked according to a combination of likelihood of threat and estimated business value.
4. The computer program product of claim 2 wherein the user interface includes one or more controls for receiving a manual threat evaluation for one of the plurality of intermediate threats from a user.
5. A method comprising:
creating an integrative model that evaluates a potential threat by a threat sample based on a combination of a first model configured to identify malicious code based on behavioral tags, a second model configured to identify malicious code based on an executable file path, and a third model configured to identify malicious code based on a Uniform Resource Locator within the threat sample;
configuring a threat management facility to identify a new threat sample as an intermediate threat when the new threat sample is not within a predetermined confidence level of safe code or malicious code according to the integrative model; and
providing a user interface for presenting the new threat sample with the intermediate threat for human evaluation.
6. The method of claim 5 wherein the user interface presents the new threat sample in a list of a number of intermediate threats detected on an endpoint ranked according to a likelihood of threat.
7. The method of claim 5 wherein the user interface presents the new threat sample in a list of a number of intermediate threats detected in an enterprise network ranked according to a likelihood of threat.
8. The method of claim 7 wherein the list is ranked according to a combination of a likelihood of threat and an estimated business value of one or more files associated with each one of the intermediate threats.
9. The method of claim 5 wherein the first model includes a machine learning model trained to identify code with malicious behavior using a training set including threat samples that are known to be safe and known to be malicious.
10. The method of claim 5 wherein the second model includes a machine learning model trained to identify potentially malicious code based on a file path using a training set including threat samples that are known to be safe and known to be malicious.
11. The method of claim 5 wherein the third model includes a machine learning model trained to identify potentially malicious code based on a Uniform Resource Locator associated with the threat sample using a training set including threat samples that are known to be safe and known to be malicious.
12. The method of claim 5 wherein the integrative model evaluates the potential threat based at least in part on a context for the threat sample.
13. The method of claim 12 wherein the context includes a reputation for the threat sample.
14. The method of claim 12 wherein the context includes a user executing a process associated with the threat sample.
15. The method of claim 12 wherein the context includes one or more files accessed by the threat sample.
16. The method of claim 5 wherein the user interface includes one or more tools for remediating a threat associated with the threat sample.
17. The method of claim 5 wherein the user interface includes one or more tools for receiving a user evaluation of the threat sample.
18. A system comprising:
a memory storing an integrative model configured to evaluate a potential threat by a threat sample based on a combination of a first model configured to identify malicious code based on behavioral tags, a second model configured to identify malicious code based on an executable file path, and a third model configured to identify malicious code based on a Uniform Resource Locator within the threat sample;
a threat management facility configured to apply the integrative model to a new threat sample and to identify a new threat sample as an intermediate threat; and
a web server configured to display the intermediate threat in a user interface on an endpoint for evaluation.
19. The system of claim 18 wherein the web server is configured to present additional contextual information for the intermediate threat to a user through the user interface.
20. The system of claim 18 wherein the web server is configured to receive an evaluation of the intermediate threat from a user through the user interface.