Classifying Samples Using Clustering

• US 20140201208A1
• Filed: 01/15/2013
• Published: 07/17/2014
• Est. Priority Date: 01/15/2013
• Status: Abandoned Application

• Current Assignee: Veritas Technologies, LLC (Whitehouse Group Ltd.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Satish, Sourabh, Salinas, Govind, Symantec Corporation, Cheong, Vincent
• Application Number:
  US13/742,218
• Publication Number:
  US 20140201208A1
• Time in Patent Office: Days
• US Class Current: 707/737
• CPC Class Codes: G06F 21/564 by virus signature recognition

Abstract

An unlabeled sample is classified using clustering. A set of samples containing labeled and unlabeled samples is established. Values of features are gathered from the samples contained in the datasets and a subset of features are selected. The labeled and unlabeled samples are clustered together based on similarity of the gathered values for the selected subset of features to produce a set of clusters, each cluster having a subset of samples from the set of samples. The selecting and clustering steps are recursively iterated on the subset of samples in each cluster in the set of clusters until at least one stopping condition is reached. The iterations produce a cluster having a labeled sample and an unlabeled sample. A label is propagated from the labeled sample in the cluster to the unlabeled sample in the cluster to classify the unlabeled sample.

Claims

1. A computer-implemented method of classifying a sample, comprising:

establishing a set of samples containing labeled and unlabeled samples;

gathering values of features from the labeled and unlabeled samples;

selecting a subset of the features;

clustering the labeled and unlabeled samples together based on similarity of the gathered values of the selected subset of features to produce a set of clusters, each cluster having a subset of samples from the set of samples;

recursively iterating the selecting and clustering steps on the subset of samples in each cluster in the set of clusters until at least one stopping condition is reached, the iterations producing a cluster having a labeled sample and an unlabeled sample; and

propagating a label from the labeled sample in the cluster to the unlabeled sample in the cluster to classify the unlabeled sample.

2. The method of claim 1, wherein gathering values of features comprises:

accessing a feature dictionary enumerating features that may distinguish the labeled and unlabeled samples; and

gathering values of the enumerated features from the labeled and unlabeled samples.

3. The method of claim 2, wherein the enumerated features comprise features of portable executable (PE) computer files, the labeled samples are associated with labeled computer files, and the unlabeled files are associated with unlabeled computer files.

4. The method of claim 1, wherein selecting a subset of features comprises:

selecting the subset of features from among available features, the available features consisting of features for which values of samples to be clustered in the iteration have variation.

5. The method of claim 1, wherein the features comprise structural features describing structures of the labeled and unlabeled samples and content features describing content within the labeled and unlabeled samples, and wherein selecting a subset of features comprises:

selecting the subset from among only the structural features for one or more initial iterations; and

selecting the subset from among the structural features and the content features for one or more subsequent iterations occurring after the initial iterations.

6. The method of claim 1, wherein clustering the labeled and unlabeled samples together based on similarity of the gathered values of the selected subset of features comprises:

clustering together labeled and unlabeled samples having at least a threshold measure of similarity among the gathered values of the selected subset of features, wherein different threshold measures of similarity are used for different iterations.

7. The method of claim 1, wherein the at least one stopping condition comprises a stopping condition based on at least one of:

a number of samples in the cluster, a total number of clusters, a number of available features using which the samples in the cluster may be further clustered, and a variation of feature values of the samples within the cluster.

8. The method of claim 1, wherein the iterations produce a set of hierarchical clusters including the cluster and a child cluster beneath the cluster in a hierarchy, further comprising:

propagating the label from the labeled sample in the cluster to an unlabeled sample in the child cluster.

9. A computer for classifying a sample, comprising:

a non-transitory computer-readable storage medium storing computer program modules executable to perform steps comprising;

establishing a set of samples containing labeled samples and unlabeled samples;

gathering values of features from the labeled and unlabeled samples;

selecting a subset of the features;

clustering the labeled and unlabeled samples together based on similarity of the gathered values of the selected subset of features to produce a set of clusters, each cluster having a subset of samples from the set of samples;

recursively iterating the selecting and clustering steps on the subset of samples in each cluster in the set of clusters until at least one stopping condition is reached, the iterations producing a cluster having a labeled sample and an unlabeled sample; and

propagating a label from the labeled sample in the cluster to the unlabeled sample in the cluster to classify the unlabeled sample; and

a computer processor for executing the computer program modules.

10. The computer of claim 9, wherein gathering values of features comprises:

accessing a feature dictionary enumerating features that may distinguish the labeled and unlabeled samples; and

gathering values of the enumerated features from the labeled and unlabeled samples.

11. The computer of claim 9, wherein selecting a subset of features comprises:

selecting the subset of features from among available features, the available features consisting of features for which values of samples to be clustered in the iteration have variation.

12. The computer of claim 9, wherein the features comprise structural features describing structures of the labeled and unlabeled samples and content features describing content within the labeled and unlabeled samples, and wherein selecting a subset of features comprises:

selecting the subset from among only the structural features for one or more initial iterations; and

selecting the subset from among the structural features and the content features for one or more subsequent iterations occurring after the initial iterations.

13. The computer of claim 9, wherein clustering the labeled and unlabeled samples together based on similarity of the gathered values of the selected subset of features comprises:

clustering together labeled and unlabeled samples having at least a threshold measure of similarity among the gathered values of the selected subset of features, wherein different threshold measures of similarity are used for different iterations.

14. The computer of claim 9, wherein the iterations produce a set of hierarchical clusters including the cluster and a child cluster beneath the cluster in a hierarchy, the executable computer program modules further executable to propagate the label from the labeled sample in the cluster to an unlabeled sample in the child cluster.

15. A non-transitory computer-readable storage medium storing computer program modules for classifying a sample, the computer program modules executable to perform steps comprising:

establishing a set of samples containing labeled and unlabeled samples;

gathering values of features from the labeled and unlabeled samples;

selecting a subset of the features;

clustering the labeled and unlabeled samples together based on similarity of the gathered values of the selected subset of features to produce a set of clusters, each cluster having a subset of samples from the set of samples;

recursively iterating the selecting and clustering steps on the subset of samples in each cluster in the set of clusters until at least one stopping condition is reached, the iterations producing a cluster having a labeled sample and an unlabeled sample; and

propagating a label from the labeled sample in the cluster to the unlabeled sample in the cluster to classify the unlabeled sample.

16. The computer-readable medium of claim 15, wherein gathering values of features comprises:

accessing a feature dictionary enumerating features that may distinguish the labeled and unlabeled samples; and

gathering values of the enumerated features from the labeled and unlabeled samples.

17. The computer-readable medium of claim 15, wherein selecting a subset of features comprises:

selecting the subset of features from among available features, the available features consisting of features for which values of samples to be clustered in the iteration have variation.

18. The computer-readable medium of claim 15, wherein the features comprise structural features describing structures of the labeled and unlabeled samples and content features describing content within the labeled and unlabeled samples, and wherein selecting a subset of features comprises:

selecting the subset from among only the structural features for one or more initial iterations; and

selecting the subset from among the structural features and the content features for one or more subsequent iterations occurring after the initial iterations.

19. The computer-readable medium of claim 15, wherein clustering the labeled and unlabeled samples together based on similarity of the gathered values of the selected subset of features comprises:

clustering together labeled and unlabeled samples having at least a threshold measure of similarity among the gathered values of the selected subset of features, wherein different threshold measures of similarity are used for different iterations.

20. The computer-readable medium of claim 15, wherein the iterations produce a set of hierarchical clusters including the cluster and a child cluster beneath the parent cluster in a hierarchy, further comprising a module for:

propagating the label from the labeled sample in the cluster to an unlabeled sample in the child cluster.