Method and system for identifying malware

1. A computer-implementable method for training an ensemble of classifiers to determine malware families of malware, the method comprising:

receiving a given sample of training malware of a plurality of samples of training malware;

analyzing the given sample of training malware in an isolated environment;

generating a respective behavioral report including indications of actions executed by the given sample of training malware in the isolated environment;

identifying within the respective behavioral reports associated with each one of the plurality of samples of training malware, a report group of behavioral reports associated with the samples of training malware of a given malware family;

determining by analyzing actions in the report group associated with the given malware family, reference actions common to every sample of training malware in the given malware family;

generating for a given behavioral report of the report group, a respective training feature vector of a respective plurality of training feature vectors associated with the given malware family, generating a given value of the respective training feature vector comprises:

determining whether a receptive field of the given behavioral report corresponds to a respective reference action associated with the given malware family;

training a given classifier of the ensemble of classifiers, based on the respective plurality of training feature vectors to determine if a given in-use sample of malware is of the given malware family; and

using the ensemble of classifiers to identify the given in-use sample of malware by:

receiving the given in-use sample of malware;

analyzing the given in-use sample of malware in the isolated environment;

generating an in-use behavioral report including indications of actions executed by the given in-use sample of malware;

generating a given in-use feature vector associated with the given in-use sample of malware,

a given value of the in-use feature vector being generated based on data in a given field of the in-use behavioral report which corresponds to a respective reference action associated with a respective malware family;

feeding the given in-use feature vector to a respective classifier the ensemble of classifiers associated with the respective malware family to generate a prediction outcome indicative of whether the given in-use sample of malware is of the respective malware family or not; and

storing data of the prediction outcome in association with the given in-use sample of malware for further use in the identifying the malware.

2. The method of claim 1 , wherein the analyzing the given sample of training malware in the isolated environment comprises analyzing at least one of:

processes started by the given sample of training malware and each process starting parameters;

files created by each process;

mutexes created by each process;

registry keys created by each process;

virtual machine screen video during running of the given sample of training malware;

indications of network activity; and

harmfulness markers associated with the given sample of training malware.

3. The method of claim 1 , wherein the respective behavioral report is a report in a JSON format including at least one of following fields associated with actions executed by the given sample of training malware: IP addresses, registry keys, mutexes, user agents, harmfulness markers, processes and running programs, types of requests and respective domains, and files.

4. The method of claim 1 , wherein the prediction outcome of the ensemble of the classifiers takes values from −1 to 1, wherein −1 corresponds to the given in-use sample of malware not being of the given malware family, and 1 corresponds to the given in-use sample of malware being of the given malware family.

5. The method of claim 1 , wherein a given ensemble of the classifiers is trained to identify malware of a respective malware family.

6. The method of claim 1 , wherein the generating each feature vector comprises applying regular expressions to the respective behavioral report.

7. The method of claim 1 , wherein the identifying the report group of behavioral reports associated with the samples of training malware of the given malware family is based on data of a database of known malicious files including behavioral features of one or more known malware families that have been identified using at least one of following approaches: ssdeep hashes, YARA signatures, and IDS signatures.

8. A system for training an ensemble of classifiers to determine malware families for malware, the system comprising at least one processor and at least one non-transitory computer-readable medium storing instructions, which, when executed by the at least one processor, cause the system to:

receive a given sample of training malware of a plurality of samples of training malware;

analyze the given sample of training malware in an isolated environment;

generate a respective behavioral report including indications of actions executed by the given sample of training malware in the isolated environment;

identify, within the respective behavioral reports associated with each one of the plurality of samples of training malware, a report group of behavioral reports associated with the samples of training malware of a given malware family;

determine, by analyzing actions in the report group associated with the given malware family, reference actions common to every sample of training malware in the given malware family;

generate, for a given behavioral report of the report group, a respective training feature vector of a respective plurality of training feature vectors associated with the given malware family, generating a given value of the respective training feature vector comprises:

determining whether a receptive field of the given behavioral report corresponds to a respective reference action associated with the given malware family; and

train a given classifier of the ensemble of classifiers, based on the respective plurality of training feature vectors to determine if a given in-use sample of malware is of the given malware family; and

during an in-use phase following the training phase, the at least one processor further causing the system to:

receive the given in-use sample of malware;

analyze the given in-use sample of malware in the isolated environment;

generate an in-use behavioral report including indications of actions executed by the given in-use sample of malware;

generate an in-use feature vector associated with the given in-use sample of malware,

a given value of the in-use feature vector being generated based on data in a given field of the in-use behavioral report which corresponds to a respective reference action associated with a respective malware family;

feed the in-use feature vector to the ensemble of classifiers to generate a prediction outcome indicative of whether the given in-use sample of malware is of the respective malware family or not; and

store data of the prediction outcome in association with the given in-use sample of malware for further use in the identifying the malware.