Multi-level malware classification machine- learning method and system
A cyber security method and system for detecting malware via an anti-malware application employing a fast locality-sensitive hashing evaluation using a vantage-point tree (VPT) structure for the indication of malicious files and non-malicious files. The locality-sensitive hashing evaluation using the VPT structure can be performed prior to initiating the deeper, more computationally intensive evaluation and is used to identify with high confidence a scanned file or data object being (i) a malicious file, (ii) a non-malicious file, or a low confidence measure of the two.
1 . A method for detecting malware in a target file, the method comprising:
receiving the target file;
generating one or more fuzzy hashes from the target file using a locality-sensitive hashing operation;
determining a malware classification with respect to the target file by assessing the one or more fuzzy hashes using one or more vantage-point tree structures, wherein assessing the one or more fuzzy hashes comprises iteratively:
comparing a fuzzy hash of the one or more fuzzy hashes to a node of the one or more vantage-point tree structures to determine a distance that measures a similarity of the node and the fuzzy hash;
comparing the distance to a threshold; and
modifying, based on the comparison, a tree data structure by adding two nodes corresponding to children of the node of the one or more vantage-point tree structures;
wherein determining the malware classification comprises analyzing the tree data structure; and
performing a malware-based responsive action based on the malware classification.
2 . The method of claim 1 , wherein the malware classification is a prediction of whether the target file is malicious.
3 . The method of claim 1 , wherein assessing the one or more fuzzy hashes further comprises comparing the one or more fuzzy hashes to hashes generated using at least one of a library of malicious code or a library of non-malicious code.
4 . The method of claim 1 , wherein the node represents a known malware.
5 . The method of claim 1 , wherein the one or more vantage-point tree structures comprises:
a first vantage-point tree structure, wherein the nodes in the first vantage-point tree structure are generated by a first set of malicious code; and
a second vantage-point tree structure, wherein the nodes in the second vantage-point tree structure are generated by a set of non-malicious code or a second set of malicious code that is different from the first set of malicious code.
6 . The method of claim 1 , wherein assessing the one or more fuzzy hashes comprises searching for neighboring fuzzy hashes using the one or more vantage-point tree structures.
7 . The method of claim 6 , wherein searching for the neighboring fuzzy hashes is limited to a CPU cache level.
8 . The method of claim 7 , wherein the malware-based responsive action comprises at least one of rejecting, passing, or quarantining the target file.
9 . A system for determining whether a target file is malicious, the system comprising:
one or more processors; and
memory having instructions stored thereon that, when executed by the one or more processors, cause the system to:
receive the target file;
generate one or more fuzzy hashes from the target file using a locality-sensitive hashing operation;
determining a malware classification with respect to the target file by assessing the one or more fuzzy hashes using one or more vantage-point tree structures, wherein assessing the one or more fuzzy hashes comprises iteratively:
comparing a fuzzy hash of the one or more fuzzy hashes to a node of the one or more vantage-point tree structures to determine a distance that measures a similarity of the node and the fuzzy hash;
comparing the distance to a threshold; and
modifying, based on the comparison, a tree data structure by adding two nodes corresponding to children of the node of the one or more vantage-point tree structures;
wherein determining the malware classification comprises analyzing the tree data structure; and
perform a malware-based responsive action based on the malware classification.
10 . The system of claim 9 , wherein the malware classification is a prediction of whether the target file is malicious.
11 . The system of claim 9 , wherein assessing the one or more fuzzy hashes further comprises comparing the one or more fuzzy hashes to hashes generated using a library of malicious code.
12 . The system of claim 9 , wherein assessing the one or more fuzzy hashes further comprises comparing the one or more fuzzy hashes to hashes generated using a library of non-malicious code.
13 . The system of claim 9 , wherein the node represents a known malware.
14 . The system of claim 9 , wherein the one or more vantage-point tree structures comprises:
a first vantage-point tree structure, wherein the nodes in a first vantage-point tree structure are generated by a first set of malicious code; and
a second vantage-point tree structure, wherein the nodes in the second vantage-point tree structure are generated by a set of non-malicious code or a second set of malicious code that is different from the first set of malicious code.
15 . The system of claim 14 , wherein a fuzzy hash of the one or more fuzzy hashes are added to the set of non-malicious code or the first set of malicious code or the second set of malicious code to be subsequently used to update at least one of the first vantage-point tree structure or the second vantage-point tree structure.
16 . A non-transitory computer-readable medium having instructions stored thereon that, when executed by one or more processors, cause a device to:
receive a target file;
generate one or more fuzzy hashes from the target file using a locality-sensitive hashing operation;
determining a malware classification with respect to the target file by assessing the one or more fuzzy hashes using one or more vantage-point tree structures, wherein assessing the one or more fuzzy hashes comprises iteratively:
comparing a fuzzy hash of the one or more fuzzy hashes to a node of the one or more vantage point tree structures to determine a distance that measures a similarity of the node and the fuzzy hash;
comparing the distance to a threshold; and
modifying, based on the comparison, a tree data structure by adding two nodes corresponding to children of the node of the one or more vantage-point tree structures;
wherein determining the malware classification comprises analyzing the tree data structure; and
perform a malware-based responsive action based on the malware classification.
17 . The computer-readable medium of claim 16 , wherein the malware classification is a prediction of whether the target file is malicious.
18 . The computer-readable medium of claim 16 , wherein the one or more vantage-point tree structures comprises:
a first vantage-point tree structure, wherein the nodes in the first vantage-point tree structure are generated by a first set of malicious code; and
a second vantage-point tree structure, wherein the nodes in the second vantage-point tree structure are generated by a set of non-malicious code or a second set of malicious code that is different from the first set of malicious code.