Combination rule mining for malware signature generation
Malware signature generation through combination rule mining is disclosed. A set of properties associated, collectively, with a plurality of data samples is received. A first data sample has a first set of properties and a second data sample has a second set of properties. A combination signature comprising at least a first property included in the first set of properties and a second property included in the second set of properties is generated.
1. A system, comprising:
a processor configured to:
receive a set of properties associated, collectively, with a plurality of data samples, wherein a first data sample has a first subset of properties and wherein a second data sample has a second subset of properties; and
automatically generate a combination signature comprising at least a first property included in the first subset of properties and a second property included in the second subset of properties, including by:
(1) sorting the received set of properties into a sorted list of properties, using a malware frequency-inverse benign frequency score determined for each property included in the set of properties, wherein the score indicates an ability to separate malware from benign samples; and
(2) using an iteration schedule in which, for each iteration, one property is selected from the sorted list and all new combinations are enumerated; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1 , wherein the plurality of data samples includes at least one benign sample and at least one malicious sample.
3. The system of claim 1 , wherein the combination signature is usable by a data appliance to determine whether a file is malicious.
4. The system of claim 1 , wherein at least some of the properties included in the received set of properties are obtained in response to a static analysis.
5. The system of claim 1 , wherein at least some of the properties included in the received set of properties are obtained in response to a dynamic analysis.
6. The system of claim 1 , wherein the processor is further configured to pre-process the received set of properties, at least in part by determining which properties in the received set are distinct and mapping the distinct properties to a distinct index.
7. The system of claim 1 , wherein the processor is further configured to generate an integerized representation of at least one data sample included in the plurality of data samples.
8. The system of claim 1 , wherein automatically generating the combination signature includes generating a set of candidate combination signatures.
9. The system of claim 1 , wherein the processor is further configured to maintain a list of pruned combinations and prevent additional processing of any supersets of those pruned combinations.
10. The system of claim 1 , wherein automatically generating the combination signature includes refining a set of candidate combination signatures using a best-remaining approach.
11. The system of claim 1 , wherein automatically generating the combination signature includes refining a set of candidate combination signatures using a threshold-based approach.
12. A method, comprising:
receiving a set of properties associated, collectively, with a plurality of data samples, wherein a first data sample has a first subset of properties and wherein a second data sample has a second subset of properties; and
automatically generating a combination signature comprising at least a first property included in the first subset of properties and a second property included in the second subset of properties, including by:
(1) sorting the received set of properties into a sorted list of properties, using a malware frequency-inverse benign frequency score determined for each property included in the set of properties, wherein the score indicates an ability to separate malware from benign samples; and
(2) using an iteration schedule in which, for each iteration, one property is selected from the sorted list and all new combinations are enumerated.
13. The method of claim 12 , wherein the plurality of data samples includes at least one benign sample and at least one malicious sample.
14. The method of claim 12 , wherein the combination signature is usable by a data appliance to determine whether a file is malicious.
15. The method of claim 12 , wherein at least some of the properties included in the received set of properties are obtained in response to a static analysis.
16. The method of claim 12 , wherein at least some of the properties included in the received set of properties are obtained in response to a dynamic analysis.
17. The method of claim 12 , further comprising pre-processing the received set of properties, at least in part by determining which properties in the received set are distinct and mapping the distinct properties to a distinct index.
18. The method of claim 12 , further comprising generating an integerized representation of at least one data sample included in the plurality of data samples.
19. The method of claim 12 , wherein automatically generating the combination signature includes generating a set of candidate combination signatures.
20. The method of claim 12 , further comprising maintaining a list of pruned combinations and preventing additional processing of any supersets of those pruned combinations.
21. The method of claim 12 , wherein automatically generating the combination signature includes refining a set of candidate combination signatures using a best-remaining approach.
22. The method of claim 12 , wherein automatically generating the combination signature includes refining a set of candidate combination signatures using a threshold-based approach.
23. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving a set of properties associated, collectively, with a plurality of data samples, wherein a first data sample has a first subset of properties and wherein a second data sample has a second subset of properties; and
automatically generating a combination signature comprising at least a first property included in the first subset of properties and a second property included in the second subset of properties, including by:
(1) sorting the received set of properties into a sorted list of properties, using a malware frequency-inverse benign frequency score determined for each property included in the set of properties, wherein the score indicates an ability to separate malware from benign samples; and
(2) using an iteration schedule in which, for each iteration, one property is selected from the sorted list and all new combinations are enumerated.