Method and system for detecting malicious files using behavior patterns

1. A method for detecting malicious files comprising:

emulating, using a processor, execution of a file under analysis, wherein the emulating further comprises opening the file under analysis by an interpreter;

forming, using the processor, a behavior log of the emulated execution of the file under analysis;

forming one or more behavior patterns from commands and parameters selected from the behavior log;

calculating a convolution of the one or more behavior patterns;

selecting two or more models for detecting malicious files from a database;

calculating a plurality of degrees of maliciousness of the file being executed using the convolution and the two or more models, wherein the plurality of the degrees of maliciousness represents change in the plurality of degrees of maliciousness as a function of number of behavior patterns used to calculate the plurality of degree of maliciousness;

forming a decision making template based on the plurality of degrees of maliciousness; and

determining that the file is malicious when a degree of similarity between the decision making template and a predetermined decision making template exceeds a predetermined threshold value.

2. The method of claim 1 , wherein the behavior log comprises intercepted commands and parameters to the commands originating from the file under analysis.

3. The method of claim 1 , wherein the plurality of the degrees of maliciousness is a measure of a central tendency of calculated degrees of maliciousness.

4. The method of claim 1 further comprising:

detecting that the degree of similarity between the decision making template and at least one of predetermined decision making templates exceeds a first predetermined threshold;

detecting that the degree of maliciousness calculated using the two or more models for detecting malicious files do not exceed a second predetermined threshold; and

retraining at least one of the two or more models for detecting malicious files.

5. The method of claim 1 , wherein an inverse convolution function of a result of a convolution function performed to calculate the convolution has a degree of similarity to the one or more behavior patterns greater than a predetermined threshold value.

6. A system for detecting malicious files comprising:

a hardware processor configured to:

emulate execution of a file under analysis, wherein the hardware processor configured to emulate is further configured to open the file under analysis by an interpreter;

form a behavior log of the emulated execution of the file under analysis;

form one or more behavior patterns from commands and parameters selected from the behavior log;

calculate a convolution of the one or more behavior patterns;

select two or more models for detecting malicious files from a database;

calculate a plurality of degrees of maliciousness of the file being executed based using the convolution and the two or more models, wherein the plurality of the degrees of maliciousness represents change in the plurality of degrees of maliciousness as a function of number of behavior patterns used to calculate the plurality of degree of maliciousness;

form a decision making template based on the plurality of degrees of maliciousness; and

determine that the file is malicious when a degree of similarity between the decision making template and a predetermined decision making template exceeds a predetermined threshold value.

7. The system of claim 6 , wherein the behavior log comprises intercepted commands and parameters to the commands originating from the file under analysis.

8. The system of claim 6 , wherein the plurality of the degrees of maliciousness is a measure of a central tendency of the calculated degrees of maliciousness.

9. The system of claim 6 , wherein the hardware processor is further configured to:

detect that the degree of similarity between the decision making template and at least one of predetermined decision making templates exceeds a first predetermined threshold; detect that the degree of maliciousness calculated using the two or more models for detecting malicious files do not exceed a second predetermined threshold; and retrain at least one of the two or more models for detecting malicious files.

10. The system of claim 6 , wherein an inverse convolution function of a result of a convolution function performed to calculate the convolution has a degree of similarity to the one or more behavior patterns greater than a predetermined threshold value.

11. A non-transitory computer-readable medium comprising instructions thereon for detecting malicious files, the instructions comprising:

emulating execution of a file under analysis, wherein the emulating further comprises opening the file under analysis by an interpreter;

forming a behavior log of the emulated execution of the file under analysis;

forming one or more behavior patterns from commands and parameters selected from the behavior log;

calculating a convolution of the one or more behavior patterns;

selecting two or more models for detecting malicious files from a database;

calculating a plurality of degrees of maliciousness of the file being executed based using the convolution and the two or more models, wherein the plurality of the degrees of maliciousness represents change in the plurality of degrees of maliciousness as a function of number of behavior patterns used to calculate the plurality of degree of maliciousness;

forming a decision making template based on the plurality of degrees of maliciousness; and

determining that the file is malicious when a degree of similarity between the decision making template and a predetermined decision making template exceeds a predetermined threshold value.

12. The medium of claim 11 , wherein the behavior log comprises intercepted commands and parameters to the commands originating from the file under analysis.