Systems and methods for identifying malicious computer files
A computer-implemented method for identifying malicious computer files may include (i) receiving, by a computing device, a set of files from a set of client devices, (ii) performing, by the computing device, a machine learning classification of file attributes on the set of files, (iii) determining, based on the machine learning classification, a node pattern of a suspicious file in the set of files, (iv) calculating, by hashing the node pattern, a file prevalence score of the suspicious file, and (v) performing, by the computing device, a security action based on the file prevalence score of the suspicious file. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for identifying malicious computer files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
receiving, by the computing device, a set of files from a set of client devices;
performing, by the computing device, a machine learning classification of file attributes on the set of files;
determining, based on the machine learning classification, a node pattern of a suspicious file in the set of files, wherein each node of the node pattern comprises a condition for classification;
calculating a file prevalence score of the suspicious file by:
hashing the node pattern by aggregating a set of nodes into a single hash value;
identifying a family of files for the suspicious file based on the hash value, wherein the family of files comprises files with the same hash value; and
calculating a prevalence of the hash value in the set of files, wherein the prevalence of the hash value indicates the prevalence of the family of files; and
performing, by the computing device, a security action based on the file prevalence score of the suspicious file.
2. The method of claim 1 , wherein the file attributes comprise static attributes derived from at least one of:
a header of a file;
metadata of the file; and
a scan of file contents.
3. The method of claim 1 , wherein performing the machine learning classification comprises:
extracting a set of features from the file attributes; and
constructing a set of decision trees to classify the set of features.
4. The method of claim 3 , wherein determining the node pattern of the suspicious file comprises:
classifying the suspicious file using at least one decision tree in the set of decision trees; and
identifying a set of nodes based on the decision tree classification.
5. The method of claim 1 , wherein performing the security action comprises at least one of:
flagging the suspicious file as potentially malicious;
flagging the family of files as potentially malicious;
quarantining the suspicious file on a client device;
quarantining another file in the family of files on the client device;
alerting an administrator about the suspicious file; and
alerting an administrator about the family of files.
6. A system for identifying malicious computer files, the system comprising:
a reception module, stored in memory, that receives, by a computing device, a set of files from a set of client devices;
a performance module, stored in memory, that performs, by the computing device, a machine learning classification of file attributes on the set of files;
a determination module, stored in memory, that determines, based on the machine learning classification, a node pattern of a suspicious file in the set of files, wherein each node of the node pattern comprises a condition for classification;
a calculation module, stored in memory, that calculates a file prevalence score of the suspicious file by:
hashing the node pattern by aggregating a set of nodes into a single hash value;
identifying a family of files for the suspicious file based on the hash value, wherein the family of files comprises files with the same hash value; and
calculating a prevalence of the hash value in the set of files, wherein the prevalence of the hash value indicates the prevalence of the family of files;
a security module, stored in memory, that performs, by the computing device, a security action based on the file prevalence score of the suspicious file; and
at least one processor that executes the reception module, the performance module, the determination module, the calculation module, and the security module.
7. The system of claim 6 , wherein the file attributes comprise static attributes derived from at least one of:
a header of a file;
metadata of the file; and
a scan of file contents.
8. The system of claim 6 , wherein the performance module performs the machine learning classification by:
extracting a set of features from the file attributes; and
constructing a set of decision trees to classify the set of features.
9. The system of claim 8 , wherein the determination module determines the node pattern of the suspicious file by:
classifying the suspicious file using at least one decision tree in the set of decision trees; and
identifying a set of nodes based on the decision tree classification.
10. The system of claim 6 , wherein the security module performs the security action by at least one of:
flagging the suspicious file as potentially malicious;
flagging the family of files as potentially malicious;
quarantining the suspicious file on a client device;
quarantining another file in the family of files on the client device;
alerting an administrator about the suspicious file; and
alerting an administrator about the family of files.
11. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
receive, by the computing device, a set of files from a set of client devices;
perform, by the computing device, a machine learning classification of file attributes on the set of files;
determine, based on the machine learning classification, a node pattern of a suspicious file in the set of files, wherein each node of the node pattern comprises a condition for classification;
calculate a file prevalence score of the suspicious file by:
hashing the node pattern by aggregating a set of nodes into a single hash value;
identifying a family of files for the suspicious file based on the hash value, wherein the family of files comprises files with the same hash value; and
calculating a prevalence of the hash value in the set of files, wherein the prevalence of the hash value indicates the prevalence of the family of files; and
perform, by the computing device, a security action based on the file prevalence score of the suspicious file.
12. The non-transitory computer-readable medium of claim 11 , wherein the file attributes comprise static attributes derived from at least one of:
a header of a file;
metadata of the file; and
a scan of file contents.
13. The non-transitory computer-readable medium of claim 11 , wherein the computer-executable instructions cause the computing device to perform the machine learning classification by:
extracting a set of features from the file attributes; and
constructing a set of decision trees to classify the set of features.
14. The non-transitory computer-readable medium of claim 13 , wherein the computer-executable instructions cause the computing device to determine the node pattern of the suspicious file by:
classifying the suspicious file using at least one decision tree in the set of decision trees; and
identifying a set of nodes based on the decision tree classification.