Multi-dimensional malware analysis
There is disclosed in one example a computing apparatus, including: a hardware platform, including a processor, a memory, and a network interface; a bucketized reputation modifier table; and instructions encoded within the memory to instruct the processor to: perform a feature-based malware analysis of an object; assign the object a malware reputation according to the feature-based malware analysis; query and receive via the network interface a complementary score for a complementary property of the object; query the bucketized reputation modifier table according to the complementary score to receive a reputation modifier for the object; adjust the object's reputation according to the reputation modifier; and take a security action according to the adjusted reputation.
1. A computing apparatus, comprising:
a hardware platform, comprising a processor, a memory, and a network interface;
a bucketized reputation modifier table; and
instructions encoded within the memory to instruct the processor to:
perform a feature-based malware analysis of an object;
assign the object a malware reputation according to the feature-based malware analysis;
query and receive via the network interface a complementary score for a complementary property of the object;
query the bucketized reputation modifier table according to the complementary score to receive a reputation modifier for the object;
adjust the object's reputation according to the reputation modifier; and
take a security action according to the adjusted reputation.
2. The computing apparatus of claim 1 , wherein the feature-based malware analysis comprises static analysis.
3. The computing apparatus of claim 1 , wherein the feature-based malware analysis comprises dynamic analysis.
4. The computing apparatus of claim 1 , wherein the complementary property is a reputation prediction of the object.
5. The computing apparatus of claim 1 , wherein the complementary property is an internet protocol (IP) address of the object.
6. The computing apparatus of claim 1 , wherein the complementary property is a certificate of the object.
7. The computing apparatus of claim 1 , wherein the complementary property is a uniform resource locator (URL) of the object.
8. The computing apparatus of claim 1 , wherein taking the security action comprises comparing the object's adjusted reputation to a malware threshold.
9. The computing apparatus of claim 8 , wherein adjusting the object's reputation comprises computing a difference between the threshold and the complementary score, and adjusting the object's reputation with the difference.
10. The computing apparatus of claim 1 , wherein the bucketized reputation modifier table comprises buckets for complementary score ranges.
11. One or more tangible, non-transitory computer-readable media having stored thereon executable instructions to instruct a processor to:
receive a malware reputation score for a binary object;
receive a secondary score for the binary object;
query a bucketized table for a reputation adjustment factor for a range corresponding to the secondary score;
adjust the reputation score with the reputation adjustment factor;
compare the adjusted reputation score to a malware threshold; and
take a security action according to the comparison.
12. The one or more tangible, non-transitory computer-readable media of claim 11 , wherein the instructions are further to compute the malware reputation score.
13. The one or more tangible, non-transitory computer-readable media of claim 12 , wherein the instructions are further to instruct the processor to perform feature-based malware analysis, including static analysis.
14. The one or more tangible, non-transitory computer-readable media of claim 12 , wherein the instructions are further to instruct the processor to perform feature-based malware analysis, including dynamic analysis.
15. The one or more tangible, non-transitory computer-readable media of claim 11 , wherein the bucketized table comprises buckets for complementary score ranges.
16. The one or more tangible, non-transitory computer-readable media of claim 15 , wherein the buckets include reputation modifiers derived from models for the buckets.
17. The one or more tangible, non-transitory computer-readable media of claim 16 , wherein the buckets include options for a plurality of sensitivity thresholds.
18. The one or more tangible, non-transitory computer-readable media of claim 16 , wherein the models comprise a machine learning model.
19. A computer-implemented method of performing a malware classification, comprising:
performing a first-phase feature-based analysis of an object, and assigning the object a first score;
receiving from a reputation database a second score for a complementary property of the object;
looking up a score adjustment factor according to the second score;
modifying the first score according to the score adjustment factor to yield a final score; and
comparing the final score to a malware threshold to determine if the object is malicious.
20. The computer-implemented method of claim 19 , wherein the first-phase feature-based malware analysis comprises static analysis.