System and method for malware detection learning
First Claim
1. A method, comprising:
- monitoring, by a network interface, a protected computer network that is to be protected from malicious software, and an infected computer network that is known to be infected with malicious software;
extracting, by a processor, from both the protected computer network and the infected computer network, first communication transactions that are known to be malicious;
extracting, by the processor, only from the protected computer network, second communication transactions that are not known to be malicious;
identifying, by the processor, one or more malicious communication transactions exchanged with the protected computer network, by processing the first and second communication transactions;
wherein identifying the malicious communication transactions comprises creating, by the processor, based on the extracted first and second communication transactions, one or more models that distinguish the malicious communication transactions from innocent communication transactions, and detecting the malicious communication transactions using the models;
wherein identifying the malicious communication transactions comprises generating alerts, by the processor, based on the models, receiving an analysis of the alerts from an operator, and detecting, by the processor, the malicious communication transactions based on the analysis of the alerts by the operator; and
wherein extracting the first communication transactions comprises selecting, by the processor, the first communication transactions depending on reputation levels of respective hosts participating in the communication transactions, and comprising updating, by the processor, at least one of the reputation levels based on the analysis of the alerts by the operator.
3 Assignments
0 Petitions
Accused Products
Abstract
Malware detection techniques that detect malware by identifying the C&C communication between the malware and the remote host, and distinguish between communication transactions that carry C&C communication and transactions of innocent traffic. The system distinguishes between malware transactions and innocent transactions using malware identification models, which it adapts using machine learning algorithms. However, the number and variety of malicious transactions that can be obtained from the protected network are often too limited for effectively training the machine learning algorithms. Therefore, the system obtains additional malicious transactions from another computer network that is known to be relatively rich in malicious activity. The system is thus able to adapt the malware identification models based on a large number of positive examples—The malicious transactions obtained from both the protected network and the infected network. As a result, the malware identification models are adapted with high speed and accuracy.
22 Citations
10 Claims
-
1. A method, comprising:
-
monitoring, by a network interface, a protected computer network that is to be protected from malicious software, and an infected computer network that is known to be infected with malicious software; extracting, by a processor, from both the protected computer network and the infected computer network, first communication transactions that are known to be malicious; extracting, by the processor, only from the protected computer network, second communication transactions that are not known to be malicious; identifying, by the processor, one or more malicious communication transactions exchanged with the protected computer network, by processing the first and second communication transactions; wherein identifying the malicious communication transactions comprises creating, by the processor, based on the extracted first and second communication transactions, one or more models that distinguish the malicious communication transactions from innocent communication transactions, and detecting the malicious communication transactions using the models; wherein identifying the malicious communication transactions comprises generating alerts, by the processor, based on the models, receiving an analysis of the alerts from an operator, and detecting, by the processor, the malicious communication transactions based on the analysis of the alerts by the operator; and wherein extracting the first communication transactions comprises selecting, by the processor, the first communication transactions depending on reputation levels of respective hosts participating in the communication transactions, and comprising updating, by the processor, at least one of the reputation levels based on the analysis of the alerts by the operator. - View Dependent Claims (2, 3, 4, 5)
-
-
6. A system, comprising:
-
a network interface, which is configured to monitor a protected computer network that is to be protected from malicious software, and an infected computer network that is known to be infected with malicious software; a processor, which is configured to extract, from both the protected computer network and the infected computer network, first communication transactions that are known to be malicious, to extract, only from the protected computer network, second communication transactions that are not known to be malicious, and to identify one or more malicious communication transactions exchanged with the protected computer network, by processing the first and second communication transactions; wherein the processor is configured to create, based on the extracted first and second communication transactions, one or more models that distinguish the malicious communication transactions from innocent communication transactions, and to detect the malicious communication transactions using the models; wherein the processor is configured to generate alerts based on the models, to receive an analysis of the alerts from an operator, and to identify the malicious communication transactions based on the analysis of the alerts by the operator; and wherein the processor is configured to select the first communication transactions depending on reputation levels of respective hosts participating in the communication transactions, and to update at least one of the reputation levels based on the analysis of the alerts by the operator. - View Dependent Claims (7, 8, 9, 10)
-
Specification