MALWARE DETECTION SYSTEM ATTACK PREVENTION

• US 20200137098A1
• Filed: 12/26/2019
• Published: 04/30/2020
• Est. Priority Date: 06/27/2017
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Chen, Li
• Granted Patent: US 11,032,305 B2
• Time in Patent Office: Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/01 Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Systems and methods may be used to prevent attacks on a malware detection system. A method may include modeling a time series of directed graphs using incoming binary files during training of a machine learning system and detecting, during a time-window of the time series, an anomaly based on a directed graph of the time series of directed graphs. The method may include providing an alert that the anomaly has corrupted the machine learning system. The method may include preventing or remedying corruption of the machine learning system.

Claims

1. A malware detection system, the malware detection system comprising:

a processor; and

memory, the memory including instructions, which when executed by the processor, cause the processor to;

construct a time series of directed graphs using incoming files, during training of a machine learning system used to detect malware attacks, wherein a structure of the time series of directed graphs is based on relationships between entities recorded in the incoming files;

detect, during a time window of the time series, an anomaly based on the time series of directed graphs; and

provide an indication that the anomaly was detected.

2. The malware detection system of claim 1, wherein the incoming files describe activity of malware.

3. The malware detection system of claim 1, wherein to detect malware attacks, the instructions cause the processor to recognize statistical relationships of activities of malware.

4. The malware detection system of claim 1, wherein vertices in the structure of the directed graph represent an executable component.

5. A method for implementing a malware detection system, the method comprising:

constructing a time series of directed graphs using incoming files, during training of a machine learning system used to detect malware attacks, wherein a structure of the time series of directed graphs is based on relationships between entities recorded in the incoming files;

detecting, during a time window of the time series, an anomaly based on the time series of directed graphs; and

providing an indication that the anomaly was detected.

6. The method of claim 5, wherein the incoming files describe activity of malware.

7. The method of claim 5, wherein detecting malware attacks comprises recognizing statistical relationships of activities of malware.

8. The method of claim 5, wherein vertices in the structure of the directed graph represent an executable component.

9. At least one non-transitory machine-readable medium including instructions for preventing attacks on a malware detection system, which when executed by a machine, cause the machine to:

construct a time series of directed graphs using incoming files, during training of a machine learning system used to detect malware attacks, wherein a structure of the time series of directed graphs is based on relationships between entities recorded in the incoming files;

detect, during a time window of the time series, an anomaly based on the time series of directed graphs; and

provide an indication that the anomaly was detected.

10. The at least one non-transitory machine-readable medium of claim 9, wherein the incoming files describe activity of malware.

11. The at least one non-transitory machine-readable medium of claim 9, wherein the instructions to detect malware attacks comprise instructions to recognize statistical relationships of activities of malware.

12. The at least one non-transitory machine-readable medium of claim 9, wherein vertices in the structure of the directed graph represent an executable component.