Identifying suspected malware files and sites based on presence in known malicious environment
First Claim
1. A method for identifying potential malware comprising:
- identifying an anchor event in a first telemetry data stream, the anchor event occurring within an anchor timeframe comprising a predetermined time window before or after the time at which the anchor event occurred, the first telemetry data stream having a first plurality of events each identifying an activity performed by a first device, wherein the anchor event is an event identified as a potentially suspicious event;
comparing to the first telemetry data stream a second telemetry data stream having a second plurality of events each identifying an activity performed by a second device distinct from the first device; and
based on said comparing;
identifying among the second plurality of events in the second telemetry data stream at least one satellite event occurring within the anchor timeframe that corresponds to one of the plurality of events in the first telemetry data stream, wherein the identifying at least one satellite event comprises determining that the at least one satellite event;
is different from the anchor event; and
has a relationship to the anchor event; and
identifying in both the first and second telemetry data streams a second satellite event occurring within a second anchor timeframe, wherein the preceding steps are executed by at least one processor.
2 Assignments
0 Petitions
Accused Products
Abstract
Disclosed herein is a system and method for identifying potential sources of malicious activity as well as identifying potentially malicious files that originated from suspected malicious sources. Using an anchor event and telemetry data from devices known to have been infected by malicious activity similar events in the telemetry data between two devices can be identified. These satellite events are then used to identify other files that may have been deposited by the satellite event such that those files can be highlighted to a malware researcher. Additionally, the malware protection may be updated based on this analysis to label an associated site with the satellite event as a malicious site such that the site may be blocked or quarantined.
9 Citations
20 Claims
-
1. A method for identifying potential malware comprising:
-
identifying an anchor event in a first telemetry data stream, the anchor event occurring within an anchor timeframe comprising a predetermined time window before or after the time at which the anchor event occurred, the first telemetry data stream having a first plurality of events each identifying an activity performed by a first device, wherein the anchor event is an event identified as a potentially suspicious event; comparing to the first telemetry data stream a second telemetry data stream having a second plurality of events each identifying an activity performed by a second device distinct from the first device; and based on said comparing; identifying among the second plurality of events in the second telemetry data stream at least one satellite event occurring within the anchor timeframe that corresponds to one of the plurality of events in the first telemetry data stream, wherein the identifying at least one satellite event comprises determining that the at least one satellite event; is different from the anchor event; and has a relationship to the anchor event; and identifying in both the first and second telemetry data streams a second satellite event occurring within a second anchor timeframe, wherein the preceding steps are executed by at least one processor. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A system for identifying malicious activity comprising:
-
a telemetry gathering component configured to receive a plurality of telemetry data streams, wherein each of the plurality of telemetry data streams comprises a data stream received from a different device, each of the plurality of telemetry data streams having a plurality of events that each identify an activity performed by the device from which the telemetry data stream is received; an anchor identification component configured to identify an anchor event in a first telemetry data stream among the plurality of telemetry data streams, the anchor event occurring within an anchor timeframe comprising a predetermined time window before or after the time at which the anchor event occurred; and a satellite identification component configured to analyze the plurality of telemetry data streams to; identify a first satellite event in at least a second telemetry data stream among the plurality of telemetry data streams, the identifying comprising; comparing the first telemetry data stream to the second telemetry data stream, and based on said comparing, determining that; an event in the second telemetry data stream corresponds to the anchor event in the first telemetry data stream occurring within the anchor timeframe; and the event in the second telemetry data stream also occurs within the anchor timeframe; and identify in both the first and the second telemetry data streams a second satellite event occurring within a second anchor timeframe. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 19)
-
-
20. One or more computer readable storage devices having stored thereon computer executable instructions that when executed by at least one processor cause at least one computing device to:
-
receive a plurality of telemetry data streams from a plurality of devices, each of the plurality of telemetry data streams having information related to events that occurred on a different associated device; identify in a first telemetry data stream an anchor event having an associated anchor timeframe, the anchor event indicative of a potential malicious event in the first telemetry data stream and the anchor timeframe comprising a predetermined time window before or after the time at which the anchor event occurred; compare the first telemetry data stream with a second telemetry data stream to identify a first satellite event and a second satellite event occurring in both the first and the second telemetry data streams, wherein the identifying further comprises determining that; the first satellite event is different from and related to the anchor event in the first data stream; the first satellite event occurring in the first telemetry data stream occurs within the anchor timeframe; the first satellite event occurring in the second telemetry data stream occurs within the anchor timeframe; and the second satellite event occurs within a second anchor timeframe from the first satellite event; and update a malware protection component to block access to an Internet site associated with the first or second satellite event based on the satellite event appearing in at least two different telemetry data streams within the first or second anchor timeframe.
-
Specification