System and methods for efficient combining of malware detection rules
System and methods are described which are useful for efficiently combining characteristic detection rules, such as may be done to efficiently and quickly assist in the dispositioning of user reported security threats.
1. A method for efficiently processing characteristic detection rules in a rule set, the method comprising;
(a) identifying, by a device, a combination rule to be applied against an electronic communication to detect characteristics of the electronic communication, the combination rule comprising a plurality of characteristic detection rules combined via one or more logical operators, each of the plurality of characteristic detection rules comprising a description of a specific characteristic based on one of a textual or binary pattern;
(b) generating, by the device, one or more identifiers for each characteristic detection rule of the plurality of characteristic detection rules to identify any characteristic detection rule of the plurality of characteristic detection rules matching the electronic communication, the identifier comprising a combination rule identifier and an index identifying a position of each characteristic detection rule within a rule set;
(c) compiling, by the device, the rule set into a compiled rule set, the rule set comprising a plurality of characteristic detection rules with the one or more identifiers for each characteristic detection rule of the plurality of characteristic detection rules;
(d) executing, by the device, the compiled rule set against the electronic communication to detect whether the electronic communication comprises a specific characteristic corresponding to the plurality of characteristic detection rules;
(e) receiving, by the device from the execution of the compiled rule set, the index from each of the identifiers for each characteristic detection rule of the plurality of characteristic detection rules that matched against the electronic communication;
(f) applying, by the device, the one or more logical operators of the combination rule based on a result of each characteristic detection rule and the index of each characteristic detection rule that matched against the electronic communication, to determine whether the combination rule matches the electronic communication;
wherein the combination rule is configured with the plurality of characteristic detection rules to detect characteristics in a predetermined portion of the electronic communication.
2. The method of claim 1 , wherein one or more of the plurality of characteristic detection rules comprises a Yet Another Recursive Algorithm (YARA) rule.
3. The method of claim 1 , wherein the identifier of the one or more identifiers comprises one of a predetermined pattern, a predetermined name, or the combination rule identifier with a predetermined tag identifier.
4. The method of claim 1 , wherein the identifier of the one or more identifiers comprises one or more of the index with the combination rule identifier, and metadata associated with the combination rule.
5. The method of claim 1 , wherein the index identifies a specific characteristic detection rule in the combination rule.
6. The method of claim 1 , wherein a first one or more of the plurality of characteristic detection rules of the combination rule is configured to detect characteristics in a first predetermined portion of the electronic communication and wherein a second one or more of the plurality of characteristic detection rules of the combination rule is configured to detect characteristics in a second predetermined portion of the electronic communication.
7. The method of claim 1 , wherein the electronic communication comprises electronic mail.
8. The method of claim 1 , wherein more than one characteristic detection rule is combined together to form a rule set.
9. The method of claim 8 , where the rule set comprises one or more characteristic detection rules that apply to one of a header of an electronic communication, a body of an electronic communication, an attachment of an electronic communication, or metadata of an electronic communication.
10. A system for more efficiently processing characteristic detection rules in a rule set, the system comprising;
a device comprising one or more processors, coupled to memory;
a combination rule accessible and identifiable by the device, the combination rule to be applied against an electronic communication to detect characteristics of the electronic communication, the combination rule comprising a plurality of characteristic detection rules combined via one or more logical operators, each of the characteristic detection comprising a description of a specific characteristic based on one of a textual or binary pattern;
wherein the device is configured to:
generate an identifier for each characteristic detection rule of the plurality of characteristic detection rules to identify any characteristic detection rule of the plurality of characteristic detection rules matching the electronic communication, the identifier comprising a combination rule identifier and a unique identifier for indexing each characteristic detection rule within each combination rule;
compile a rule set comprising the plurality of characteristic detection rules with the identifier for each characteristic detection rule of the plurality of characteristic detection rules;
execute the compiled rule set against the electronic communication to detect whether the electronic communication comprises a specific characteristic corresponding to the plurality of characteristic detection rules;
receive, from the execution of the compiled rule set, the unique identifier from each of the identifiers for each characteristic detection rule of the plurality of characteristic detection rules that matched against the electronic communication; and
apply the one or more logical operators of the combination rule based on a result of each characteristic detection rule and the unique identifier of each characteristic detection rule that matched against the electronic communication, to determine whether the combination rule matches the electronic communication;
wherein the combination rule is configured with the plurality of characteristic detection rules to detect characteristics in a predetermined portion of the electronic communication.
11. The system of claim 10 , wherein one or more of the plurality of characteristic detection rules comprises a Yet Another Recursive Algorithm (YARA) rule.
12. The system of claim 10 , wherein the identifier comprises one of a predetermined pattern, a predetermined name, or the combination rule identifier with a predetermined tag identifier.
13. The system of claim 10 , wherein the identifier comprises one or more of the combination rule identifier with a predetermined tag identifier, and metadata associated with the combination rule.
14. The system of claim 10 , wherein the identifier comprises an index with the combination rule identifier, wherein the index identifies a location of the characteristic detection rule among the plurality of characteristic detection rules in the combination rule.
15. The system of claim 10 , wherein a first one or more of the plurality of characteristic detection rules of the combination rule is configured to detect specific characteristics in a first predetermined portion of the electronic communication and wherein a second one or more of the plurality of characteristic detection rules of the combination rule is configured to detect specific characteristics in a second predetermined portion of the electronic communication.
16. The system of claim 10 , wherein the electronic communication comprises electronic mail.
17. The system of claim 10 , where more than one characteristic detection rule is combined together to form a rule set.
18. The system of claim 17 , wherein the rule set comprises one or more characteristic detection rules that apply to one of a header of the electronic communication, a body of the electronic communication, an attachment of the electronic communication, or metadata of the electronic communication.