SYSTEMS, METHODS, AND MEDIA FOR IDENTIFYING AND RESPONDING TO MALICIOUS FILES HAVING SIMILAR FEATURES
Systems, methods, and media for identifying and responding to malicious files having similar features are provided. More particularly, in some embodiments, systems for identifying and responding to malicious files having similar features are provided, the systems comprising: a memory; and a hardware processor coupled to the memory and configured to: receive feature information extracted from a file, wherein the feature information includes at least two of static feature information, environmental feature information, and behavioral feature information; create clusters based on the feature information; determine if a file corresponding to one of the clusters is malicious; and report to a plurality of endpoints that other files corresponding to the one of the clusters is malicious.
1 . A system for identifying and responding to malicious files having similar features, comprising:
a memory; and
a hardware processor coupled to the memory and configured to:
receive feature information extracted from a file, wherein the feature information includes at least two of static feature information, environmental feature information, and behavioral feature information;
create clusters based on the feature information;
determine if a file corresponding to one of the clusters is malicious; and
report to a plurality of endpoints that other files corresponding to the one of the clusters is malicious.
2 . The system of claim 1 , wherein the feature information includes static feature information, and the static feature information includes information that describes contents of the file.
3 . The system of claim 2 , wherein the static feature information includes at least one of a size of the file, a description of one or more overlays in the file, a geometry of the file, resources used by file, application programming interfaces (APIs) used by the file, entropy of portions of the file, sections of code executed by the file, libraries imported or referenced by the file, and strings embedded in the file.
4 . The system of claim 1 , wherein the feature information includes environmental feature information, and the environmental feature information includes information that describes how the file is installed and executed on a device.
5 . The system of claim 4 , wherein the environmental feature information includes at least one of information that identifies a path from which the file is executed, information that identifies a parent process of the file, information that indicates that the file is installed as a service, information that indicates that the file has an uninstaller registered for the same path, information that indicates that the file has a run key or other automated execution condition, information that indicates that the file is registered as a shell extension, information that indicates the file's age in the environment, information that indicates the file's prevalence in the environment, information that indicates whether or not any short cuts reference the file, and information that indicates what operating system the file is configured to run in.
6 . The system of claim 1 , wherein the feature information includes behavioral feature information, and the behavioral feature information includes information that describes observable outcomes of executing the file.
7 . The system of claim 6 , wherein the behavioral feature information includes information that indicates that the file, when executed, does at least one of: connects to external URLs, creates certain files, disables a firewall or one or more features of a firewall, opens up ports for listening, interacts with other processes, registry, or files, executes with a certain frequency, requires a certain user security level or integrity level when executed, and installs WMI provider.
8 . A method for identifying and responding to malicious files having similar features, comprising:
receiving, at a hardware processor, feature information extracted from a file, wherein the feature information includes at least two of static feature information, environmental feature information, and behavioral feature information;
creating, using the hardware processor, clusters based on the feature information;
determining, using the hardware processor, if a file corresponding to one of the clusters is malicious; and
reporting to a plurality of endpoints that other files corresponding to the one of the clusters is malicious.
9 . The method of claim 8 , wherein the feature information includes static feature information, and the static feature information includes information that describes contents of the file.
10 . The method of claim 9 , wherein the static feature information includes at least one of a size of the file, a description of one or more overlays in the file, a geometry of the file, resources used by file, application programming interfaces (APIs) used by the file, entropy of portions of the file, sections of code executed by the file, libraries imported or referenced by the file, and strings embedded in the file.
11 . The method of claim 8 , wherein the feature information includes environmental feature information, and the environmental feature information includes information that describes how the file is installed and executed on a device.
12 . The method of claim 11 , wherein the environmental feature information includes at least one of information that identifies a path from which the file is executed, information that identifies a parent process of the file, information that indicates that the file is installed as a service, information that indicates that the file has an uninstaller registered for the same path, information that indicates that the file has a run key or other automated execution condition, information that indicates that the file is registered as a shell extension, information that indicates the file's age in the environment, information that indicates the file's prevalence in the environment, information that indicates whether or not any short cuts reference the file, and information that indicates what operating system the file is configured to run in.
13 . The method of claim 8 , wherein the feature information includes behavioral feature information, and the behavioral feature information includes information that describes observable outcomes of executing the file.
14 . The method of claim 13 , wherein the behavioral feature information includes information that indicates that the file, when executed, does at least one of: connects to external URLs, creates certain files, disables a firewall or one or more features of a firewall, opens up ports for listening, interacts with other processes, registry, or files, executes with a certain frequency, requires a certain user security level or integrity level when executed, and installs WMI provider.
15 . A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for identifying and responding to malicious files having similar features, the method comprising:
receiving feature information extracted from a file, wherein the feature information includes at least two of static feature information, environmental feature information, and behavioral feature information;
creating clusters based on the feature information;
determining if a file corresponding to one of the clusters is malicious; and
reporting to a plurality of endpoints that other files corresponding to the one of the clusters is malicious.
16 . The non-transitory computer-readable medium of claim 15 , wherein the feature information includes static feature information, and the static feature information includes information that describes contents of the file.
17 . The non-transitory computer-readable medium of claim 16 , wherein the static feature information includes at least one of a size of the file, a description of one or more overlays in the file, a geometry of the file, resources used by file, application programming interfaces (APIs) used by the file, entropy of portions of the file, sections of code executed by the file, libraries imported or referenced by the file, and strings embedded in the file.
18 . The non-transitory computer-readable medium of claim 15 , wherein the feature information includes environmental feature information, and the environmental feature information includes information that describes how the file is installed and executed on a device.
19 . The non-transitory computer-readable medium of claim 18 , wherein the environmental feature information includes at least one of information that identifies a path from which the file is executed, information that identifies a parent process of the file, information that indicates that the file is installed as a service, information that indicates that the file has an uninstaller registered for the same path, information that indicates that the file has a run key or other automated execution condition, information that indicates that the file is registered as a shell extension, information that indicates the file's age in the environment, information that indicates the file's prevalence in the environment, information that indicates whether or not any short cuts reference the file, and information that indicates what operating system the file is configured to run in.
20 . The non-transitory computer-readable medium of claim 15 , wherein the feature information includes behavioral feature information, and the behavioral feature information includes information that describes observable outcomes of executing the file.