Fuzzy hash of behavioral results

• US 10,218,740 B1
• Filed: 03/05/2018
• Issued: 02/26/2019
• Est. Priority Date: 09/30/2013
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Mesdaq, Ali, Westin, III, Paul L.
• Primary Examiner(s): Jhaveri, Jayesh M
• Application Number:
  US15/912,456
• Time in Patent Office: 358 Days
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A computerized method for classifying objects in a malware system is described. The method includes detecting behaviors of an object for classification after processing of the object has begun. Data associated with the detected behaviors is collected, and a fuzzy hash for the received object is generated. The generation of the fuzzy hash may include (i) removing a portion of the data associated with the detected behaviors, and (ii) performing a hash operation on a remaining portion of the data associated with the detected behaviors. Thereafter, the fuzzy hash for the received object is compared to a fuzzy hash of an object in a preexisting cluster to generate a similarity measure. The received object is associated with the preexisting cluster in response to determining that the similarity measure is above a predefined threshold value. Thereafter, the results are reported.

Claims

1. A computerized method for classifying objects in a malware system, comprising:

detecting behaviors of an object for classification after processing of the object from among one or more received objects has started;

collecting data associated with the detected behaviors;

generating a fuzzy hash for the object based on the data associated with the detected behaviors, the generating of the fuzzy hash includes;

(i) removing a portion of the data associated with the detected behaviors to produce a remaining portion of the data associated with the detected behaviors, and

(ii) performing a hash operation on the remaining portion of the data associated with the detected behaviors;

comparing the fuzzy hash for the object with a fuzzy hash of an object in a preexisting cluster to generate a similarity measure;

associating the object with the preexisting cluster in response to determining that the similarity measure is above a predefined threshold value; and

reporting, via a communications interface, whether the object is associated with the preexisting cluster.

2. The computerized method of claim 1, further comprising:

creating a new cluster for the object in response to determining that the similarity measure is below the predefined threshold value.

3. The computerized method of claim 1, wherein the object is at least one of a file, a uniform resource locator, a web object, a capture of network traffic for a user over time, and an email message.

4. The computerized method of claim 1, wherein the removing of the portion of the data associated with the detected behaviors includes removing data not directed to identifying the object.

5. The computerized method of claim 1, further comprising:

generating a preliminary malware score for the object based on a comparison of the detected behaviors with known malware behaviors, wherein the preliminary malware score indicates the probability the object is malware; and

generating a final malware score for the object based on the cluster the object is associated, wherein the final malware score is greater than the preliminary malware score when the object is associated with a cluster of objects classified as malware and the final malware score is less than the preliminary malware score when the object is associated with a cluster of objects classified as non-malware.

6. The computerized method of claim 1, wherein the removing of the portion of the data associated the detected behaviors comprises removing data that does not identify the object.

7. The computerized method of claim 6, wherein the removing of the portion of the data associated the detected behaviors includes at least one of:

(i) a process identifier of a process called by the object, (ii) a value written to a registry by the object, or (iii) names of objects generated, modified, or deleted by the object.

8. The computerized method of claim 2, further comprising:

transmitting, by a malicious content detection (MCD) system, the new cluster or the preexisting cluster with the newly associated object to another MCD system.

9. The computerized method of claim 1, further comprising:

classifying the object as malware, non-malware, or with an unknown status to match a classification of the preexisting cluster, when the object is assigned to the preexisting cluster.

10. The computerized method of claim 1, further comprising:

assigning a malware family name to the object to match a malware family name of the preexisting cluster, when the object is assigned to the preexisting cluster.

11. The computerized method of claim 1, wherein the removing of the portion of the data associated with the detected behaviors includes removing values written to a registry or modified registry values.

12. A system for classifying malicious objects, the system comprising:

one or more hardware processors;

a memory including one or more software modules that, when executed by the one or more hardware processors, is configured to;

detect behaviors of a received object for classification after processing of the received object has started,

collect data associated with the detected behaviors,

generate a fuzzy hash for the received object based on the data associated with the detected behaviors by at least (i) removing a portion of the data associated with the detected behaviors to produce a remaining portion of the data associated with the detected behaviors, and (ii) performing a hash operation on the remaining portion of the data associated with the detected behaviors,

compare the fuzzy hash for the received object with a fuzzy hash of an object in a preexisting cluster to generate a similarity measure,

associate the received object with the preexisting cluster in response to determining that the similarity measure is above a predefined threshold value, and

report whether the received object is associated with the preexisting cluster.

13. The system of claim 12, wherein at least one software module of the software modules, when executed, being further configured to:

create a new cluster for the received object in response to determining that the similarity measure is below the predefined threshold value.

14. The system of claim 12, wherein the removing the portion of the data associated with the detected behaviors includes removing data associated with the detected behaviors that does not identify the received object.

15. The system of claim 12, wherein the software modules, when executed, being further configured to:

classify the received object as malware, non-malware, or with an unknown status to match a classification of the preexisting cluster, when the received object is assigned to the preexisting cluster.

16. The system of claim 12, wherein when executed the software modules further:

assign a malware family name to the object to match a malware family name of the preexisting cluster, when the object is assigned to the preexisting cluster.

17. The system of claim 14, wherein the removing of the portion of the data associated with the detected behaviors includes removing of a subset of process identifiers of processes called by the received object during detonation.

18. The system of claim 14, wherein the removing of the portion of the data associated with the detected behaviors includes removing values written to or deleted from a registry by the received object during detonation.

19. The system of claim 18, wherein after the removing of the values written to or deleted from the registry.

20. The system of claim 14, wherein the removing of the portion of the data associated with the detected behaviors includes removing names of files generated, modified, or deleted by the received object during detonation.

21. The system of claim 20, wherein after removing of the portion of the data associated with the detected behaviors, only a path in an associated file system is retained.

22. The system of claim 12, wherein the preexisting cluster is a grouping of objects with similar fuzzy hashes.

23. The system of claim 22, wherein the one or more software modules, when executed by the one or more hardware processors, being further configured to create a new cluster different than the preexisting cluster for the received object in response to determining that the similarity measure is below the predefined threshold value.

24. The system of claim 18, wherein the fuzzy hash is generated using the remaining portion of the data associated with the detected behaviors.

25. The system of claim 22, wherein the one or more software modules, when executed by the one or more hardware processors, being further configured to classify the received object as malware, non-malware, or with an unknown status to match a classification of the preexisting cluster, when the received object is assigned to the preexisting cluster.

26. The system of claim 12, wherein the one or more software modules, when executed by the one or more hardware processors, further assign a malware family name to the received object to match a malware family name of the preexisting cluster, when the received object is assigned to the preexisting cluster.

27. The system of claim 22, wherein at least one software module of the software modules, when executed, being further configured to use machine learning to determine whether the received object is similar to an object in the preexisting cluster.