Automatic threat detection of executable files based on static data analysis
Aspects of the present disclosure relate to threat detection of executable files. A plurality of static data points may be extracted from an executable file without decrypting or unpacking the executable file. The executable file may then be analyzed without decrypting or unpacking the executable file. Analysis of the executable file may comprise applying a classifier to the plurality of extracted static data points. The classifier may be trained from data comprising known malicious executable files, known benign executable files and known unwanted executable files. Based upon analysis of the executable file, a determination can be made as to whether the executable file is harmful.
1. A computer-implemented method comprising:
identifying, by a knowledge module, static data points that may be indicative of either a harmful or benign executable file;
associating, by the knowledge module, the identified static data points with one of a plurality of categories of files, the plurality of categories of files including harmful files and benign files;
identifying an executable file to be evaluated;
extracting, by the knowledge module, a plurality of static data points from the identified executable file;
generating a feature vector from the plurality of static data points using a classifier trained to classify the static data points based on training data, the training data comprising files known to fit into one of the plurality of categories of files, wherein one or more features of the feature vector are selectively turned on or off based at least in part on evaluation of whether a value of one of the plurality of static data points is within a predetermined range; and
providing the generated feature vector to one or more support vector machines to build a probabilistic model that indicates whether the executable file fits into one of the categories of files.
2. The computer-implemented method according to claim 1 , wherein the plurality of static data points are extracted without decrypting or unpacking the executable file.
3. The computer-implemented method according to claim 1 , wherein the one or more support vector machines builds the probabilistic model by performing data analysis and pattern recognition on the one or more feature vectors.
4. The computer-implemented method according to claim 1 , wherein the probabilistic model indicates whether the executable file is harmful.
5. The computer-implemented method according to claim 1 , wherein the executable file is identified in response to a detected condition.
6. The computer-implemented method according to claim 5 , wherein the detected condition is user request for a file download.
7. The computer-implemented method according to claim 5 , wherein the detected condition is the detection of a new file attempting to execute.
8. The computer-implemented method according to claim 1 , wherein the plurality of static data points represent predefined character strings in the executable file.
9. The computer-implemented method according to claim 1 , wherein a determination of whether the executable file is harmful is used to retrain the classifier.
10. A system comprising:
at least one memory; and
at least one processor operatively connected with the memory and configured to perform operation of:
identifying static data points that may be indicative of either a harmful or benign executable file;
associating the identified static data points with one of a plurality of categories of files, the plurality of categories of files including harmful files and benign files;
identifying an executable file to be evaluated;
extracting a plurality of static data points from the identified executable file; and
generating a feature vector from the plurality of static data points using a classifier trained to classify the static data points based on training data, the training data comprising files known to fit into one of the plurality of categories of files, wherein one or more features of the feature vector are selectively turned on or off based at least in part on evaluation of whether a value of one of the plurality of static data points is within a predetermined range; and
providing the generated feature vector to one or more support vector machines to build a probabilistic model that indicates whether the executable file fits into one of the categories of files.
11. The system according to claim 10 , wherein the plurality of static data points are extracted without decrypting or unpacking the executable file.
12. The system according to claim 10 , wherein the one or more support vector machines builds the probabilistic model by performing data analysis and pattern recognition on the one or more feature vectors.
13. The system according to claim 10 , wherein the probabilistic model indicates whether the executable file is harmful.
14. The system according to claim 10 , wherein the plurality of static data points represent predefined character strings in the executable file.
15. A computer-readable storage device containing instructions, that when executed on at least one processor, causing the processor to execute a process comprising:
identifying static data points that may be indicative of either a harmful or benign executable file;
associating the identified static data points with one of a plurality of categories of files, the plurality of categories of files including harmful files and benign files;
identifying an executable file to be evaluated;
extracting a plurality of static data points from the identified executable file;
generating a feature vector from the plurality of static data points using a classifier trained to classify the static data points based on training data, the training data comprising files known to fit into one of the plurality of categories of files, wherein one or more features of the feature vector are selectively turned on or off based at least in part on evaluation of whether a value of one of the plurality of static data points is within a predetermined range; and
providing the generated feature vector to one or more support vector machines to build a probabilistic model that indicates whether the executable file fits into one of the categories of files.
16. The computer-readable storage device according to claim 15 , wherein the plurality of static data points are extracted without decrypting or unpacking the executable file.
17. The computer-readable storage device according to claim 15 , wherein the plurality of static data points represent predefined character strings in the executable file.
18. A computer-implemented method comprising:
identifying static data points that may be indicative of either a harmful or benign executable file;
associating the identified static data points with one of a plurality of categories of files, the plurality of categories of files including harmful files and benign files;
identifying an executable file to be evaluated;
extracting a plurality of static data points from the executable file;
generating a feature vector from the plurality of static data points using a classifier trained to classify the static data points based on training data, the training data comprising files known to fit into one of the plurality of categories of files, wherein one or more features of the feature vector are selectively turned on or off based at least in part on evaluation of whether a value of one of the plurality of static data points is within a predetermined range; and
evaluating the feature vector using a machine learning model to determine whether the executable file fits into one of the categories of files.
19. The computer-implemented method according to claim 18 , wherein the plurality of static data points are extracted without decrypting or unpacking the executable file.
20. The computer-implemented method according to claim 18 , wherein the machine learning model comprises an artificial neural network.
21. The computer-implemented method according to claim 18 , wherein the machine learning model comprises a support vector machine.
22. The computer-implemented method according to claim 18 , wherein the machine learning model comprises a machine learning decision tree.
23. The computer-implemented method according to claim 18 , wherein the machine learning model comprises a Bayesian network.
24. The computer-implemented method according to claim 18 , wherein evaluating the feature vector using the machine learning model comprises evaluating the feature vector using support vector processing.
25. The computer-implemented method according to claim 18 , wherein the machine learning model comprises a clustering model.
26. The computer-implemented method according to claim 18 , wherein the executable file is identified in response to a detected condition.
27. The computer-implemented method according to claim 26 , wherein the detected condition is user request for a file download.
28. The computer-implemented method according to claim 26 , wherein the detected condition is the detection of a new file attempting to execute.
29. The computer-implemented method according to claim 18 , wherein the plurality of static data points represent predefined character strings in the executable file.
30. The computer-implemented method according to claim 18 , wherein a determination of whether the executable file is harmful is used to retrain the classifier.
31. The computer-implemented method according to claim 18 , further comprising preventing execution of the executable file based on classifying the executable file as harmful.
32. A computer-readable storage device containing instructions, that when executed on a processor, cause the processor to execute a process comprising:
identifying static data points that may be indicative of either a harmful or benign executable file;
associating the identified static data points with one of a plurality of categories of files, the plurality of categories of files including harmful files and benign files;
identifying an executable file to be evaluated;
extracting a plurality of static data points from the executable file;
generating a feature vector from the plurality of static data points using a classifier trained to classify the static data points based on training data, the training data comprising files known to fit into one of the plurality of categories of files, wherein one or more features of the feature vector are selectively turned on or off based at least in part on evaluation of whether a value of one of the plurality of static data points is within a predetermined range; and
evaluating the feature vector using a machine learning model to determine whether the executable file fits into one of the categories of files.
33. The computer-readable storage device according to claim 32 , wherein the plurality of static data points are extracted without decrypting or unpacking the executable file.
34. The computer-readable storage device according to claim 32 , wherein the machine learning model comprises an artificial neural network.
35. The computer-readable storage device according to claim 32 , wherein the machine learning model comprises a support vector machine.
36. The computer-readable storage device according to claim 32 , wherein the machine learning model comprises a machine learning decision tree.
37. The computer-readable storage device according to claim 32 , wherein the machine learning model comprises a Bayesian network.
38. The computer-readable storage device according to claim 32 , wherein evaluating the feature vector using the machine learning model comprises evaluating the feature vector using support vector processing.
39. The computer-readable storage device according to claim 32 , wherein the machine learning model comprises a clustering model.
40. The computer-readable storage device according to claim 32 , wherein the executable file is identified in response to a detected condition.
41. The computer-readable storage device according to claim 40 , wherein the detected condition is user request for a file download.
42. The computer-readable storage device according to claim 40 , wherein the detected condition is the detection of a new file attempting to execute.
43. The computer-readable storage device according to claim 32 , wherein the plurality of static data points represent predefined character strings in the executable file.
44. The computer-readable storage device according to claim 32 , wherein a determination of whether the executable file is harmful is used to retrain the classifier.
45. The computer-readable storage device according to claim 32 , wherein the process further comprises preventing execution of the executable file based on classifying the executable file as harmful.
46. A system comprising:
at least one memory;
at least one processor configured to perform operation of:
identifying static data points that may be indicative of either a harmful or benign executable file; and
associating the identified static data points with one of a plurality of categories of files, the plurality of categories of files including harmful files and benign files; and
at least one processor configured to perform operation of:
identifying an executable file to be evaluated;
extracting a plurality of static data points from the executable file;
generating a feature vector from the plurality of static data points using a classifier trained to classify the static data points based on training data, the training data comprising files known to fit into one of the plurality of categories of files, wherein one or more features of the feature vector are selectively turned on or off based at least in part on evaluation of whether a value of one of the plurality of static data points is within a predetermined range; and
evaluating the feature vector using a machine learning model to determine whether the executable file fits into one of the categories of files.
47. The system according to claim 46 , wherein the plurality of static data points are extracted without decrypting or unpacking the executable file.
48. The system according to claim 46 , wherein the machine learning model comprises an artificial neural network.
49. The system according to claim 46 , wherein the machine learning model comprises a support vector machine.
50. The system according to claim 46 , wherein the machine learning model comprises a machine learning decision tree.
51. The system according to claim 46 , wherein the machine learning model comprises a Bayesian network.
52. The system according to claim 46 , wherein evaluating the feature vector using the machine learning model comprises evaluating the feature vector using support vector processing.
53. The system according to claim 46 , wherein the machine learning model comprises a clustering model.
54. The system according to claim 46 , wherein the executable file is identified in response to a detected condition.
55. The system according to claim 54 , wherein the detected condition is user request for a file download.
56. The system according to claim 54 , wherein the detected condition is the detection of a new file attempting to execute.
57. The system according to claim 46 , wherein the plurality of static data points represent predefined character strings in the executable file.
58. The system according to claim 46 , wherein a determination of whether the executable file is harmful is used to retrain the classifier.
59. The system according to claim 46 , further comprising at least one processor configured to perform operation of:
preventing execution of the executable file based on classifying the executable file as harmful.