Granted Patent B2

US 12,229,259 · App. 17/586,010 · Granted Feb 18, 2025

Inventor: Nikolay Sergeevich Prudkovskij (Moscow, RU)

Assignee: F.A.C.C.T. NETWORK SECURITY LLC

G06F21/562G06F2221/033

Abstract

Claims (86)

1. A computer-implementable method for detecting malicious files in non-isolated environment, the method comprising:

during a training phase:

acquiring plurality of executable files including at least one malicious executable file and at least one non-malicious executable file;

analyzing a binary form of the given executable file to obtain a first data associated with the given executable file,

the first data comprising a Byte/Entropy Histogram associated with the given executable file;

the analyzing comprising analyzing at least one selected from the group consisting of: byte n-grams, data of fields of the given executable file, a file section entropy, metadata of the binary form of the given executable file, and line length distribution histograms;

analyzing a disassembled form of the given executable file to obtain: (i) a second data associated with the given executable file; (ii) a control-flow graph associated with the given executable file, and (iii) a data-flow graph associated with the given executable file,

the second data being different from the first data;

determining based on data including the first and second data, parameters of the given executable file;

determining the parameters of the given executable file as being indicative of one of a malicious executable file and a non-malicious executable file;

generating, based on the parameters, at least a first feature vector and a second feature vector;

generating, based on the control-flow graph, a third feature vector;

generating, based on the data-flow graph, a fourth feature vector,

each one of the first feature vector, the second feature vector, the third feature vector, and the fourth feature vector being different from an other one thereof; and

training an ensemble of classifiers to determine if a given in-use executable file is one of malicious and non-malicious, the training comprising:

training a first classifier of the ensemble of classifiers based on the first feature vector;

training a second classifiers of the ensemble of classifiers based on the second feature vector;

training a third classifiers of the ensemble of classifiers based on the third feature vector; and

training a fourth classifiers of the ensemble of classifiers based on the fourth feature vector;

assigning to each one of the ensemble of classifiers, a respective decisive priority value,

the respective decisive priority value being indicative of a respective weight assigned to a prediction outcome of a given classifier of the ensemble of classifiers, the respective weight having been determined based on prediction accuracy of the given classifier.

2. The method of claim 1 , further comprising, during an in-use phase following the training phase:

obtaining the given in-use executable file;

generating a first in-use feature vector, a second in-use feature vector, a third in-use feature vector, and a fourth in-use feature vector associated with the given in-use executable file;

feeding the first in-use feature vector, the second in-use feature vector, the third in-use feature vector, and the fourth in-use feature vector to the ensemble of classifiers to determine a prediction outcome indicative of whether the given in-use executable file is one of malicious and non-malicious; and

generating a report including the prediction outcome for presentation thereof to a user.

3. The method of claim 1 , wherein the first feature vector comprises numerical ones of the parameters of the given executable file, and the second vector comprises string ones of the parameters of the given executable file.

4. The method of claim 1 , wherein obtaining the second data associated with the given executable file comprises obtaining at least one of: metadata, an Import Table, and an Export Table associated with the given executable file.

5. The method of claim 1 , wherein the data of the fields of the given executable file comprises at least one of: a number of sections in the given executable file, a size of headers, a code size, an availability of digital signature, an availability of imported DLL and functions where these libraries have been used, names of exported functions, data from a resource catalog, and an assembler version of the given executable file.

6. The method of claim 1 , wherein the file section entropy has been determined using a sliding window applied to the binary form of the given executable file.

7. The method of claim 4 , wherein the metadata of the binary form of the given executable file comprises a number of sections in the file, sizes thereof, a presence of a checksum, a file size, a creation time, an operating system version, and an assembler version associated with the given executable file.

8. The method of claim 1 , wherein analyzing the disassembled form of the given executable file comprises analyzing at least one of: characters, registers, operation codes, a system interface (Windows APIs) access rate, sections, and metadata, associated with the given executable file.

9. The method of claim 8 , wherein the analyzing further comprises determining, in a code of the disassembled form of the given executable file, a frequency of occurrence of characters, including at least one of: “−”, “+”, “*”, “]”, “[”, “?”, “@”.

10. The method of claim 7 , wherein the analyzing further comprises determining a ratio between a number of known registers and a number of unknown registers obtained from the disassembled form of the given executable file.

11. The method of claim 8 , wherein the sections obtained from the disassembled form of the given executable file include at least one of: .text, .data, .bss, .rdata, .edata, .idata, .rsrc, .tls, and .reloc.

12. The method of claim 7 , wherein the metadata extracted from the disassembled form of the given executable file comprises the file size and a number of code lines.

13. The method of claim 2 , wherein the prediction outcome includes one of a binary prediction outcome and a probabilistic prediction outcome.

14. The method of claim 1 , wherein the respective decisive priority of a given classifier in the ensemble of classifiers is determined based on one of: an accuracy associated with the given classifier, a completeness associated with the given classifier, and an F-measure associated with the given classifier.

15. A system for detecting malicious files in non-isolated environment, the system comprising at least one processor and at least one non-transitory computer-readable medium storing instructions, which, when executed by the at least one processor, cause the system to:

during a training phase:

acquire a plurality of executable files including at least one malicious executable file and at least one non-malicious executable file;

analyze a binary form of the given executable file to obtain a first data associated with the given executable file, the first data comprising a Byte/Entropy Histogram associated with the given executable file, by:

analyzing at least one selected from the group consisting of: byte n-grams, data of fields of the given executable file, a file section entropy, metadata of the binary form of the given executable file, and line length distribution histograms;

analyze a disassembled form of the given executable file, to obtain: (i) a second data associated with the given executable file; (ii) a control-flow graph associated with the given executable file, and (iii) a data-flow graph associated with the given executable file,

the second data being different from the first data;

determine, based on the data including the first and second data, parameters of the given executable file;

determine the parameters of the given executable file as being indicative of one of a malicious executable file and a non-malicious executable file;

generate, based on the parameters, at least a first feature vector and a second feature vector;

generate, based on the control-flow graph, a third feature vector;

generate, based on the data-flow graph, a fourth feature vector,

each one of the first feature vector, the second feature vector, the third feature vector, and the fourth feature vector being different from an other one thereof; and

train an ensemble of classifiers to determine if a given in-use executable file is one of malicious and non-malicious, by:

training a first classifier of the ensemble of classifiers based on the first feature vector;

training a second classifiers of the ensemble of classifiers based on the second feature vector;

training a third classifiers of the ensemble of classifiers based on the third feature vector; and

training a fourth classifiers of the ensemble of classifiers based on the fourth feature vector;

assign, to each one of the ensemble of classifiers, a respective decisive priority value,

the respective decisive priority value being indicative of a respective weight assigned to a prediction outcome of a given classifier of the ensemble of classifiers, the respective weight having been determined based on prediction accuracy of the given classifier.

16. The system of claim 15 , wherein, during an in-use phase following the training phase, the processor is further configured to:

obtain the given in-use executable file;

generate a first in-use feature vector, a second in-use feature vector, a third in-use feature vector, and a fourth in-use feature vector associated with the given in-use executable file;

feed the first in-use feature vector, the second in-use feature vector, the third in-use feature vector, and the fourth in-use feature vector to the ensemble of classifiers to determine a prediction outcome indicative of whether the given in-use executable file is one of malicious and non-malicious; and

generate a report including the prediction outcome for presentation thereof to a user.

17. A computer-implementable method for detecting malicious files in non-isolated environment, the method comprising:

during a training phase:

acquiring a training set of data including a plurality of executable files, the plurality of executable files including at least one malicious executable file and at least one non-malicious executable file; and

training, based on the training set of data, an ensemble of classifiers to determine if a given in-use executable file is one of malicious and non-malicious, the training comprising:

training a first classifier of the ensemble of classifiers based on a first plurality of feature vectors,

a given one of the first plurality of feature vectors having been determined based on parameters associated with a respective one of the plurality of executable files;

training a second classifiers of the ensemble of classifiers based on a second plurality of feature vectors,

a given one of the second plurality of feature vectors having been determined based on the parameters associated with the respective one of the plurality of executable files,

the parameters having been determined based on first and second data obtained, for a given executable file of the plurality of executable files, respectively, based on analyzing (i) a binary form and (ii) a disassembled form of the given executable file,

 the first data comprising a Byte/Entropy Histogram associated with the given executable file;

 analyzing the binary form comprising analyzing at least one selected from the group consisting of: byte n-grams, data of fields of the given executable file, a file section entropy, metadata of the binary form of the given executable file, and line length distribution histograms; and

 the second data being different from the first data;

training a third classifiers of the ensemble of classifiers based on a third plurality of feature vectors,

a given one of the third plurality of feature vectors having been determined based on a control-flow graph of the respective one of the plurality of executable files; and

training a fourth classifiers of the ensemble of classifiers based on a fourth plurality of feature vectors,

a given one of the fourth plurality of feature vectors having been determined based on a data-flow graph of the respective one of the plurality of executable files,

 each one of the given one of the first plurality of feature vectors, the given one of the second plurality of feature vectors, the given one of the third plurality of feature vectors, and the given one of the fourth plurality of feature vectors being different from an other one thereof; and

assigning, to each one of the ensemble of classifiers, a respective decisive priority value.

18. The method of claim 17 , further comprising, during an in-use phase following the training phase:

obtaining, by the processor, the given in-use executable file;

generating, by the processor, a first in-use feature vector, a second in-use feature vector, a third in-use feature vector, and a fourth in-use feature vector associated with the given in-use executable file;

feeding the first in-use feature vector, the second in-use feature vector, the third in-use feature vector, and the fourth in-use feature vector to the ensemble of classifiers to determine a prediction outcome indicative of whether the given in-use executable file is one of malicious and non-malicious; and

generating a report including the prediction outcome for presentation thereof to a user.

Assignments (3)

Priority Claims (1)

Continuity (2)

References Cited (345)