Classifying software modules utilizing similarity-based queries

1. A method comprising:

preparing a representation of data associated with a plurality of software modules, the representation comprising similarity-based hashing of signatures constructed from a first subset of features of the plurality of software modules, the first subset of features of the plurality of software modules comprising at least one of (i) one or more indicator of compromise features having a binary value range and (ii) one or more static features having an integer value range;

receiving a seed software module;

performing a similarity-based query utilizing the similarity-based hashing of signatures constructed from the first subset of features to identify one or more of the plurality of software modules as candidate software modules matching the seed software module;

computing distances between the candidate software modules and the seed software module utilizing a second subset of features of the plurality of software modules, at least one of the second subset of features comprising a textual feature;

classifying one or more of the candidate software modules as a designated software module type based on the computed distances;

generating a notification comprising a list of the candidate software modules classified as the designated software module type; and

modifying access by a given one of one or more client devices associated with an enterprise to a given one of the one or more of the candidate software modules in the list classified as the designated software module type;

wherein preparing the representation of data associated with the plurality of software modules comprises:

building a characteristic matrix having two or more rows each corresponding to one of the first subset of features;

converting each column of the characteristic matrix into a hash signature through a designated number of permutations; and

generating the similarity-based hashing of signatures by performing locality-sensitive hashing to build two or more bands of consecutive components of the hash signatures, each band comprising a concatenation of string values of two or more consecutive components of the hash signatures;

wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

2. The method of claim 1 further comprising:

receiving data associated with the plurality of software modules from a plurality of client devices associated with the enterprise; and

filtering the received data to remove one or more of the plurality of software modules that do not trigger one or more specified conditions and that are not of one or more specified types.

3. The method of claim 2 wherein the one or more specified conditions comprises triggering a threshold number of indicators of compromise and the one or more specified types comprises executable modules and dynamic link library modules.

4. The method of claim 1 wherein the hash signatures comprise Minhash signatures.

5. The method of claim 1 wherein performing the similarity-based query comprises performing a locality-sensitive hashing query matching one or more bands of the seed software module with corresponding bands of the plurality of software modules, and wherein the candidate software modules comprise respective ones of the plurality of software modules matching a designated threshold number of bands with the seed software module.

6. The method of claim 1 further comprising, prior to performing the similarity-based query, filtering out one or more of the plurality of software modules having one or more defined metadata types that do not match corresponding metadata types of the seed software module.

7. The method of claim 6 wherein the one or more defined metadata types comprise at least one of a module type, a module platform, and a certificate owner.

8. The method of claim 1 wherein computing the distances between the candidate software modules and the seed software module comprises computing distances between the candidate software modules and the seed software module for respective features in the second subset of features and summing the distances to determine distance metrics for respective ones of the candidate software modules.

9. The method of claim 8 wherein classifying a given one of the candidate modules as being the designated software module type comprises determining that the distance metric for the given candidate module exceeds a designated threshold.

10. The method of claim 1 wherein the designated software module type comprises malware.

11. The method of claim 1 wherein the designated software module type comprises potentially unwanted programs.

12. The method of claim 1 wherein generating the notification comprises ordering the list of candidate software modules classified as the designated software module type based on the computed distances between the candidate software modules and the seed software module.

13. The method of claim 1 wherein modifying access by the given client device to the given candidate software module classified as the designated software module type comprises at least one of:

removing the given candidate software module from a memory or storage of the given client device;

preventing the given client device from obtaining the given candidate software module; and

causing the given candidate software module to be opened in a sandboxed application environment on the given client device.

14. The method of claim 1 further comprising providing the notification over at least one network to one or more designated users of the enterprise.

15. A method comprising:

preparing a representation of data associated with a plurality of software modules, the representation comprising similarity-based hashing of signatures constructed from a first subset of features of the plurality of software modules, the first subset of features of the plurality of software modules comprising at least one of (i) one or more indicator of compromise features having a binary value range and (ii) one or more static features having an integer value range;

receiving a seed software module;

performing a similarity-based query utilizing the similarity-based hashing of signatures constructed from the first subset of features to identify one or more of the plurality of software modules as candidate software modules matching the seed software module;

computing distances between the candidate software modules and the seed software module utilizing a second subset of features of the plurality of software modules, at least one of the second subset of features comprising a textual feature;

classifying one or more of the candidate software modules as a designated software module type based on the computed distances;

generating a notification comprising a list of the candidate software modules classified as the designated software module type; and

modifying access by a given one of one or more client devices associated with an enterprise to a given one of the one or more of the candidate software modules in the list classified as the designated software module type;

wherein preparing the representation of data associated with the plurality of software modules comprises:

building a characteristic matrix having two or more rows each corresponding to one of the first subset of features; and

converting each column of the characteristic matrix into a hash signature through a designated number of permutations;

wherein the first subset of the plurality of features comprises at least one feature having a binary value range and at least one feature having an associated integer value range, and wherein each feature in the first subset having a binary value range is associated with a single row in the characteristic matrix and each feature in the first subset having an integer value range is associated with two or more rows of the characteristic matrix corresponding to different integer values in its associated integer value range; and

wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

16. The method of claim 15 wherein preparing the representation further comprises generating the similarity-based hashing of signatures by performing locality-sensitive hashing to build two or more bands of consecutive components of the hash signatures, each band comprising a concatenation of string values of two or more consecutive components of the hash signatures.

17. A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device cause the at least one processing device:

to prepare a representation of data associated with a plurality of software modules, the representation comprising similarity-based hashing of signatures constructed from a first subset of features of the plurality of software modules, the first subset of features of the plurality of software modules comprising at least one of (i) one or more indicator of compromise features having a binary value range and (ii) one or more static features having an integer value range;

to receive a seed software module;

to perform a similarity-based query utilizing the similarity-based hashing of signatures constructed from the first subset of features to identify one or more of the plurality of software modules as candidate software modules matching the seed software module;

to compute distances between the candidate software modules and the seed software module utilizing a second subset of features of the plurality of software modules, at least one of the second subset of features comprising a textual feature;

to classify one or more of the candidate software modules as a designated software module type based on the computed distances;

to generate a notification comprising a list of the candidate software modules classified as the designated software module type; and

to modify access by a given one of one or more client devices associated with an enterprise to a given one of the one or more of the candidate software modules in the list classified as the designated software module type

wherein preparing the representation of data associated with the plurality of software modules comprises:

building a characteristic matrix having two or more rows each corresponding to one of the first subset of features;

converting each column of the characteristic matrix into a hash signature through a designated number of permutations; and

generating the similarity-based hashing of signatures by performing locality-sensitive hashing to build two or more bands of consecutive components of the hash signatures, each band comprising a concatenation of string values of two or more consecutive components of the hash signatures.

18. The computer program product of claim 17 wherein:

performing the similarity-based query comprises performing a locality-sensitive hashing query matching one or more bands of the seed software module with corresponding bands of the plurality of software modules; and

the candidate software modules comprise respective ones of the plurality of software modules matching a designated threshold number of bands with the seed software module.

19. An apparatus comprising:

at least one processing device comprising a processor coupled to a memory;

the at least one processing device being configured:

to prepare a representation of data associated with a plurality of software modules, the representation comprising similarity-based hashing of signatures constructed from a first subset of features of the plurality of software modules, the first subset of features of the plurality of software modules comprising at least one of (i) one or more indicator of compromise features having a binary value range and (ii) one or more static features having an integer value range;

to receive a seed software module;

to perform a similarity-based query utilizing the similarity-based hashing of signatures constructed from the first subset of features to identify one or more of the plurality of software modules as candidate software modules matching the seed software module;

to compute distances between the candidate software modules and the seed software module utilizing a second subset of features of the plurality of software modules, at least one of the second subset of features comprising a textual feature;

to classify one or more of the candidate software modules as a designated software module type based on the computed distances;

to generate a notification comprising a list of the candidate software modules classified as the designated software module type; and

to modify access by a given one of one or more client devices associated with an enterprise to a given one of the one or more of the candidate software modules in the list classified as the designated software module type;

wherein preparing the representation of data associated with the plurality of software modules comprises:

building a characteristic matrix having two or more rows each corresponding to one of the first subset of features;

converting each column of the characteristic matrix into a hash signature through a designated number of permutations; and

generating the similarity-based hashing of signatures by performing locality-sensitive hashing to build two or more bands of consecutive components of the hash signatures, each band comprising a concatenation of string values of two or more consecutive components of the hash signatures.

20. The apparatus of claim 19 wherein:

performing the similarity-based query comprises performing a locality-sensitive hashing query matching one or more bands of the seed software module with corresponding bands of the plurality of software modules; and

the candidate software modules comprise respective ones of the plurality of software modules matching a designated threshold number of bands with the seed software module.