IP Library › Granted Patent US 11,989,293

Granted Patent B2

US 11,989,293 · App. 17/195,130 · Granted May 21, 2024

Systems, methods, and media for identifying and responding to malicious files having similar features

Inventors: Joel R. Spurlock (Portland, OR); Leonardo Frittelli (Cordoba, AR)

Assignee: McAfee, LLC

G06F21/565 G06F21/567 H04L63/14 H04L63/145 G06F2221/033

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 11,989,293
App. No.: 17/195,130
Granted: May 21, 2024
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Systems, methods, and media for identifying and responding to malicious files having similar features are provided. More particularly, in some embodiments, systems for identifying and responding to malicious files having similar features are provided, the systems comprising: a memory; and a hardware processor coupled to the memory and configured to: receive feature information extracted from a file, wherein the feature information includes at least two of static feature information, environmental feature information, and behavioral feature information; create clusters based on the feature information; determine if a file corresponding to one of the clusters is malicious; and report to a plurality of endpoints that other files corresponding to the one of the clusters is malicious.

Claims (58)

1. A system for identifying and responding to malicious files having similar features, comprising:

a memory; and

a hardware processor coupled to the memory and configured to:

receive feature information extracted from a file, wherein the feature information includes at least two of static feature information, environmental feature information, and behavioral feature information;

for each cluster of a plurality of clusters of files:

for a first portion of the feature information corresponding to one of the static feature information, the environmental feature information, and the behavioral feature information:

determine a first number of features in the first portion of the feature information that match the cluster; and

determine a first score based on a ratio of the first number of features and a total number of features in the first portion of the feature information;

for a second portion of the feature information corresponding to another of the static feature information, the environmental feature information, and the behavioral feature information:

determine a second number of features in the second portion of the feature information that match the cluster; and

determine a second score based on a ratio of the second number of features and a total number of features in the second portion of the feature information; and

determine a combined score for the cluster based on a combination of at least the first score and the second score, wherein the combined score is one of a plurality of combined scores;

identify one of the plurality of clusters with a best of the plurality of combined scores as matching the file;

determine that the file is malicious; and

report to a plurality of endpoints that other files corresponding to the one of the plurality of clusters is malicious.

2. The system of claim 1 , wherein the feature information includes the static feature information, and the static feature information includes information that describes contents of the file.

3. The system of claim 2 , wherein the static feature information includes at least one of a size of the file, a description of one or more overlays in the file, a geometry of the file, resources used by the file, application programming interfaces (APIs) used by the file, entropy of portions of the file, sections of code executed by the file, libraries imported or referenced by the file, and strings embedded in the file.

4. The system of claim 1 , wherein the feature information includes the environmental feature information, and the environmental feature information includes information that describes how the file is installed and executed on a device.

5. The system of claim 4 , wherein the environmental feature information includes at least one of information that identifies a path from which the file is executed, information that identifies a parent process of the file, information that indicates that the file is installed as a service, information that indicates that the file has an uninstaller registered for a same path, information that indicates that the file has a run key or other automated execution condition, information that indicates that the file is registered as a shell extension, information that indicates the file's age in the environment, information that indicates the file's prevalence in the environment, information that indicates whether or not any short cuts reference the file, and information that indicates what operating system the file is configured to run in.

6. The system of claim 1 , wherein the feature information includes the behavioral feature information, and the behavioral feature information includes information that describes observable outcomes of executing the file.

7. The system of claim 6 , wherein the behavioral feature information includes information that indicates that the file, when executed, does at least one of: connects to external URLs, creates certain files, disables a firewall or one or more features of a firewall, opens up ports for listening, interacts with other processes, registry, or files, executes with a certain frequency, requires a certain user security level or integrity level when executed, and installs a Windows Management Instrumentation (WMI) provider.

8. A method for identifying and responding to malicious files having similar features, comprising:

receiving, at a hardware processor, feature information extracted from a file, wherein the feature information includes at least two of static feature information, environmental feature information, and behavioral feature information;

for each cluster of a plurality of clusters of files:

for a first portion of the feature information corresponding to one of the static feature information, the environmental feature information, and the behavioral feature information:

determining a first number of features in the first portion of the feature information that match the cluster; and

determining a first score based on a ratio of the first number of features and a total number of features in the first portion of the feature information;

for a second portion of the feature information corresponding to another of the static feature information, the environmental feature information, and the behavioral feature information:

determining a second number of features in the second portion of the feature information that match the cluster; and

determining a second score based on a ratio of the second number of features and a total number of features in the second portion of the feature information; and

determining a combined score for the cluster based on a combination of at least the first score and the second score, wherein the combined score is one of a plurality of combined scores;

identifying one of the plurality of clusters with a best of the plurality of combined scores as matching the file;

determining, using the hardware processor, that the file is malicious; and

reporting to a plurality of endpoints that other files corresponding to the one of the plurality of clusters is malicious.

9. The method of claim 8 , wherein the feature information includes the static feature information, and the static feature information includes information that describes contents of the file.

10. The method of claim 9 , wherein the static feature information includes at least one of a size of the file, a description of one or more overlays in the file, a geometry of the file, resources used by the file, application programming interfaces (APIs) used by the file, entropy of portions of the file, sections of code executed by the file, libraries imported or referenced by the file, and strings embedded in the file.

11. The method of claim 8 , wherein the feature information includes the environmental feature information, and the environmental feature information includes information that describes how the file is installed and executed on a device.

12. The method of claim 11 , wherein the environmental feature information includes at least one of information that identifies a path from which the file is executed, information that identifies a parent process of the file, information that indicates that the file is installed as a service, information that indicates that the file has an uninstaller registered for a same path, information that indicates that the file has a run key or other automated execution condition, information that indicates that the file is registered as a shell extension, information that indicates the file's age in the environment, information that indicates the file's prevalence in the environment, information that indicates whether or not any short cuts reference the file, and information that indicates what operating system the file is configured to run in.

13. The method of claim 8 , wherein the feature information includes the behavioral feature information, and the behavioral feature information includes information that describes observable outcomes of executing the file.

14. The method of claim 13 , wherein the behavioral feature information includes information that indicates that the file, when executed, does at least one of: connects to external URLs, creates certain files, disables a firewall or one or more features of a firewall, opens up ports for listening, interacts with other processes, registry, or files, executes with a certain frequency, requires a certain user security level or integrity level when executed, and installs a Windows Management Instrumentation (WMI) provider.

15. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for identifying and responding to malicious files having similar features, the method comprising:

receiving feature information extracted from a file, wherein the feature information includes at least two of static feature information, environmental feature information, and behavioral feature information;