Digital DNA sequence

• US 10,121,105 B2
• Filed: 06/27/2014
• Issued: 11/06/2018
• Est. Priority Date: 04/24/2009
• Status: Active Grant

• Current Assignee: GoSecure, Inc.
• Original Assignee: Countertack Incorporated
• Inventors: Hoglund, Michael Gregory
• Primary Examiner(s): Hoffman, Brandon S
• Assistant Examiner(s): Salehi, Helai
• Application Number:
  US14/317,958
• Publication Number:
  US 20150058271A1
• Time in Patent Office: 1,593 Days
• Field of Search: 713200, 726 22- 25
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06N 5/027 Frames

Abstract

In an embodiment of the invention, a method of classifying a data object includes: scanning the data object; evaluating contents of data objects base on at least one selected rule; and generating a digital DNA sequence that classifies at least some contents in the data object.

Claims

1. A computer-implemented method, comprising:

at an electronic device for generating a sequence that classifies a data object to determine whether the data object is a malicious object;

applying to the data object a plurality of rules, each rule of the plurality of rules associated with a respective weight value and with a respective trait, to select expressed traits, wherein an expressed trait corresponds to a rule that matches the data object;

generating a sequence comprising each of the weight values associated with the expressed traits, wherein each of the weight values corresponds to a likelihood of whether the data object belongs to a respective class of data objects;

calculating a sequence weight based on the weight values associated with each of the expressed traits, wherein calculating a sequence weight comprises reducing a weight value of an expressed trait for a subsequent expression of the same trait, including;

determining whether a first rule of the plurality of rules matches the data object for a first time;

in accordance with determining that the first rule of the plurality of rules matches the data object for the first time, utilizing a first weight value in calculating the sequence weight;

determining whether the first rule of the plurality of rules matches the data object for a second time that is subsequent to the first time; and

in accordance with determining that the first rule of the plurality of rules matches the data object for the second time that is subsequent to the first time, utilizing a second weight value that is less than the first weight value in calculating the sequence weight; and

storing the generated sequence in a selected target memory of the electronic device.

2. The method of claim 1, wherein calculating a sequence weight comprises:

associating a decay rate with one or more of the weight values, wherein the decay rate diminishes an effect of successive instances of a repeated weight value on the sequence weight.

3. The method of claim 1, wherein the weight values comprise positive and negative confidence values, the positive confidence values corresponding to a high likelihood that the data object belongs to a respective class of data objects, and the negative confidence values corresponding to a low likelihood that the data object belongs to a respective class of data objects.

4. The method of claim 1, wherein each rule of the plurality of rules comprise a rule value;

and wherein the data object comprises a data value.

5. The method of claim 1, wherein one or more of the rules comprises a rule restriction indicating whether the rule is case-sensitive, and/or a rule restriction indicating a location of text to be searched.

6. The method of claim 1, wherein:

the sequence weight is a sum of weight values multiplied by respective weight multipliers.

7. The method of claim 1, including:

in accordance with determining that the first rule of the plurality of rules matches the data object for the first time, calculating a first sequence weight including multiplying a weight value for the first rule with an initial weight multiplier for the first rule; and

,

in accordance with determining that the first rule of the plurality of rules matches the data object for a second time that is subsequent to the first time, calculating a second sequence weight including multiplying the weight value for the first rule with a reduced weight multiplier for the first rule.

8. The method of claim 1, further comprising:

repeating application of the plurality of rules to the data object at different times for identifying subsequently expressed traits.

9. The method of claim 1, wherein calculating the sequence weight includes:

utilizing a third weight value for a first time match of a second expressed trait in calculating the sequence weight; and

utilizing a fourth weight value, that is less than the third weight value, for a second time match of the second expressed trait in calculating the sequence weight.

10. The method of claim 4, wherein the data value comprises one or more of:

a string, a byte pattern, a code, and a name of a process.

11. The method of claim 4, wherein applying the plurality of rules to the data object comprises determining, for each rule of the plurality of rules, whether the rule value matches the data value.

12. The method of claim 4, further comprising:

associating a control code with a first trait to inter-associate the first trait with a second trait; and

wherein each of the inter-associated traits is selected as an expressed trait based on whether the rule value of the other inter-associated trait matches the data value.

13. The method of claim 4, wherein one or more of the rule values comprise wildcard characters.

14. The method of claim 7, wherein:

the reduced weight multiplier for the first rule is reduced from the initial weight multiplier by a decay rate for the first rule.

15. The method of claim 14, including:

in accordance with determining that a second rule, distinct from the first rule, of the plurality of rules matches the data object for a first time, calculating a third sequence weight including multiplying a weight value for the second rule with an initial weight multiplier for the second rule; and

,

in accordance with determining that the second rule of the plurality of rules matches the data object for a second time that is subsequent to the first time, calculating a fourth sequence weight including multiplying the weight value for the second rule with a reduced weight multiplier for the second rule.

16. The method of claim 15, wherein:

the reduced weight multiplier for the second rule is reduced from the initial weight multiplier by a decay rate for the second rule; and

the decay rate for the second rule is distinct from the decay rate for the first rule.

17. An electronic device for generating a sequence that classifies a data object to determine whether the data object is a malicious object, the device comprising:

a memory; and

a sequencing engine, wherein the sequencing engine is configured to be executed by one or more processors, the sequencing engine including instructions for;

applying to the data object a plurality of rules, each rule of the plurality of rules associated with a respective weight value and with a respective trait, to select expressed traits, wherein an expressed trait corresponds to a rule that matches the data object;

generating a sequence comprising each of the weight values associated with the expressed traits, wherein each of the weight values corresponds to a likelihood of whether the data object belongs to a respective class of data objects;

calculating a sequence weight based on the weight values associated with each of the expressed traits, wherein calculating a sequence weight comprises reducing a weight value of an expressed trait for a subsequent expression of the same trait, including;

determining whether a first rule of the plurality of rules matches the data object for a first time;

in accordance with determining that the first rule of the plurality of rules matches the data object for the first time, utilizing a first weight value in calculating the sequence weight;

determining whether the first rule of the plurality of rules matches the data object for a second time that is subsequent to the first time; and

in accordance with determining that the first rule of the plurality of rules matches the data object for the second time that is subsequent to the first time, utilizing a second weight value that is less than the first weight value in calculating the sequence weight; and

storing the generated sequence in a selected target memory.

18. The device of claim 17, wherein the sequencing engine further include instructions for:

associating a decay rate with one or more of the weight values, wherein the decay rate diminishes an effect of successive instances of a repeated weight value on the sequence weight.

19. The device of claim 17, wherein the weight values comprise positive and negative confidence values, the positive confidence values corresponding to a high likelihood that the data object belongs to a respective class of data objects, and the negative confidence values corresponding to a low likelihood that the data object belongs to a respective class of data objects.

20. The device of claim 17, wherein each rule of the plurality of rules comprise a rule value;

and wherein the data object comprises a data value.

21. The device of claim 17, wherein one or more of the rules comprises a rule restriction indicating whether the rule is case-sensitive, and/or a rule restriction indicating a location of text to be searched.

22. The device of claim 17, wherein the data object is stored in the memory.

23. The device of claim 17, wherein the sequencing engine is executed when the data object is received by the device over a network.

24. The device of claim 20, wherein the data value comprises one or more of:

a string, a byte pattern, a code, and a name of a process.

25. The device of claim 20, wherein applying the plurality of rules to the data object comprises determining, for each rule of the plurality of rules, whether the rule value matches the data value.

26. The device of claim 20, wherein the sequencing engine further include instructions for:

associating a control code with a first trait to inter-associate the first trait with a second trait; and

wherein each of the inter-associated traits is selected as an expressed trait based on whether the rule value of the other inter-associated trait matches the data value.

27. The device of claim 20, wherein one or more of the rule values comprise wildcard characters.

28. A non-transitory computer-readable storage medium storing instructions for execution by an electronic device for generating a sequence that classifies a data object to determine whether the data object is a malicious object, the instructions comprising instructions for:

applying to the data object a plurality of rules, each rule of the plurality of rules associated with a respective weight value and with a respective trait, to select expressed traits, wherein an expressed trait corresponds to a rule that matches the data object;

generating a sequence comprising each of the weight values associated with the expressed traits, wherein each of the weight values corresponds to a likelihood of whether the data object belongs to a respective class of data objects;

calculating a sequence weight based on the weight values associated with each of the expressed traits, wherein calculating a sequence weight comprises reducing a weight value of an expressed trait for a subsequent expression of the same trait, including;

determining whether a first rule of the plurality of rules matches the data object for a first time;

in accordance with determining that the first rule of the plurality of rules matches the data object for the first time, utilizing a first weight value in calculating the sequence weight;

determining whether the first rule of the plurality of rules matches the data object for a second time that is subsequent to the first time; and

in accordance with determining that the first rule of the plurality of rules matches the data object for the second time that is subsequent to the first time, utilizing a second weight value that is less than the first weight value in calculating the sequence weight; and

storing the generated sequence in a selected target memory of the electronic device.