System and method for determining data entropy to identify malware

• US 8,069,484 B2
• Filed: 01/25/2007
• Issued: 11/29/2011
• Est. Priority Date: 01/25/2007
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: Mandiant Corporation (Alphabet Inc.)
• Inventors: Garman, Jason, McMillan, Chad
• Primary Examiner(s): Truong; Thanhnga
• Assistant Examiner(s): HOLMES, ANGELA R
• Application Number:
  US11/657,541
• Publication Number:
  US 20080184367A1
• Time in Patent Office: 1,769 Days
• Field of Search: 726 22- 26, 713/194
• US Class Current: 726/23
• CPC Class Codes: G06F 21/563 by source code analysis

Abstract

Systems and methods for performing malware detection for determining suspicious data based on data entropy are provided. The method includes acquiring a block of data, calculating an entropy value for the block of data, comparing the entropy value to a threshold value, and recording the block of data as suspicious when the entropy value exceeds the threshold value. An administrator may then investigate suspicious data.

Claims

1. A malware detection method, the method comprising the steps of:

calculating a global entropy value for a block of data, said block of data comprising a plurality of data samples;

iteratively calculating an individual sample entropy value for each of the plurality of data samples to create a plurality of individual sample entropy values, wherein each of the plurality of data samples contains at least a portion of data overlapping at least one of an immediately preceding data sample and an immediately subsequent data sample;

performing a statistical method on the plurality of individual sample entropy values;

comparing at least one of the global entropy value and an individual sample entropy value to a threshold value; and

recording the block of data as suspicious when at least one of the global entropy value and an individual sample entropy value exceeds the threshold value.

2. The method of claim 1, further comprising reporting suspicious data to an administrator.

3. The method of claim 1, wherein calculating an entropy value includes calculating Shannon Entropy for the block of data.

4. The method of claim 1, wherein performing a statistical method includes:

calculating the mean and standard deviation of the plurality of individual sample entropy values; and

adding one standard deviation to the mean.

5. The method of claim, 1 wherein comparing the entropy value to a threshold value includes comparing both the global entropy value and the sample entropy value to the threshold.

6. The method of claim 1, wherein the portion of data overlapping at least one of the immediately preceding data sample and the immediately subsequent data sample is tunable.

7. The method of claim 1, further comprising examining metadata for the block of data for suspicious features, wherein said metadata comprises at least one of file type, type of different sections contained in a file, and permissions associated with individual sections within a file.

8. The method of claim 1, wherein the threshold is 0.9.

9. A computer-readable device having computer-executable instructions for performing a method of malware, the method comprising the steps of:

calculating a global entropy value for a block of data, said block of data comprising a plurality of data samples;

iteratively calculating an individual sample entropy value for each of the plurality of data samples to create a plurality of individual sample entropy values, wherein each of the plurality of data samples contains at least a portion of data overlapping at least one of an immediately preceding data sample and an immediately subsequent data sample;

performing a statistical method on the plurality of individual sample entropy values;

comparing at least one of the global entropy value and an individual sample entropy value to a threshold value; and

recording the block of data as suspicious when at least one of the global entropy value and an individual sample entropy value exceeds the threshold value.

10. The computer-readable device of claim 9, the method further comprising reporting suspicious packets to an administrator.

11. The computer-readable device of claim 9, wherein calculating an entropy value includes calculating Shannon Entropy for the block of data.

12. The computer-readable device of claim 9, wherein performing a statistical method includes:

calculating the mean and standard deviation of the plurality of individual sample entropy values; and

adding one standard deviation to the mean.

13. The computer-readable device of claim 9, wherein comparing the entropy value to a threshold value includes comparing both the global entropy value and the sample entropy value to the threshold.

14. The computer-readable device of claim 9, wherein the portion of data overlapping at least one of the immediately preceding data sample and the immediately subsequent data sample is tunable.

15. The computer-readable device of claim 9, the method further comprising examining metadata for the block of data for suspicious features, wherein said metadata comprises at least one of file type, type of different sections contained in a file, and permissions associated with individual sections within a file.

16. The computer-readable device of claim 9, wherein the threshold is 0.9.