Systems and methods for data driven malware task identification

Patent metadata

Field	Value
Publication number	US-10176438-B2
Application number	US-201615186278-A
Country	US
Kind code	B2
Filing date	Jun 17, 2016
Priority date	Jun 19, 2015
Publication date	Jan 8, 2019
Grant date	Jan 8, 2019

Abstract

Embodiments of a system and method for identifying malware tasks using a controlled environment to run malicious software to generate analysis reports, a parser to extract features from the analysis reports and a cognitively inspired learning algorithm to predict tasks associated with the malware are disclosed.

First claim

What is claimed is:

1. A method for malware task prediction, the method comprising:
configuring a computing device, for:
accessing training data from a memory in operable communication with the computing device, the training data represented as sample malware attributes associated with a plurality of sample malware instances, the sample malware attributes defining binary features of the plurality of sample malware instances;
accessing data associated with a malware utilizing the computing device;
applying a parser to the data associated with the malware to extract a set of attributes using the computing device, the set of attributes defining binary features associated with the malware; and
applying a machine learning cognitive model to the extracted set of attributes and the sample malware attributes, utilizing the computing device, to predict one or more tasks associated with the malware, at least by computing a similarity value between the malware and a sample instance of the plurality of sample malware instances,
wherein the machine learning cognitive model is data driven and utilizes mechanisms of an Adaptive Control of Thought-Rational cognitive architecture, and
wherein prediction of the one or more tasks by the computing device applying the machine learning cognitive model assists to define task activity the malware is designed to perform which improves accuracy associated with identification of the malware.

2. The method of claim 1 , wherein the similarity value is derived by computing an activation strength of the malware with each of the plurality of sample malware instances.

3. The method of claim 2 , wherein computing the activation strength further comprises utilizing a base-level activation function that is set to a base level constant.

4. The method of claim 2 , wherein computing the activation strength further comprises applying a spreading activation function that is a measure of uniqueness of the set of attributes associated with the malware relative to the sample malware attributes.

5. The method of claim 2 , wherein the activation strength is computed as:
A i =B i +S i +P i

where A i is the activation strength, B i is a base-level activation, S i is a spreading activation, and P i is a partial matching score.

6. The method of claim 1 , further comprising utilizing a spreading activation by computing a fan for each attribute of the set of attributes relative to the sample malware attributes.

7. The method of claim 1 , further comprising utilizing an iterative learning method that reflects a cognitive process of accumulating experiences defined by the sample malware attributes.

8. The method of claim 1 , further comprising assigning a probability to the one or more tasks and returning tasks of the one or more tasks with a sum probability greater than a predefined threshold.

9. One or more non-transitory tangible computer-readable storage media storing computer-executable instructions for performing a computer process on a machine, the computer process comprising:
accessing training data represented as sample malware attributes associated with a plurality of sample malware instances stored in a memory, the sample malware attributes defining binary features of the plurality of sample malware instances;
accessing data associated with a malware;
applying a parser to the data associated with the malware to extract a set of attributes, the set of attributes defining binary features associated with the malware; and
applying a machine learning cognitive model to the extracted set of attributes and the sample malware attributes to predict one or more tasks associated with the malware, at least by computing a similarity value between the malware and a sample instance of the plurality of sample malware instances,
wherein the machine learning cognitive model is data driven and utilizes mechanisms of an Adaptive Control of Thought-Rational cognitive architecture, and
wherein prediction of the one or more tasks by applying the machine learning cognitive model assists to define task activity the malware is designed to perform which improves accuracy associated with identification of the malware.

Assignees

• Univ Arizona State
• Univ Carnegie Mellon

Inventors

• Shakarian Paulo
• Nunes Eric
• Buto Casey
• Lebiere Christian
• Thomson Robert
• Bennati Stefano

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06N99/005 Primary

  Physics · mapped topic

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/562

  Static detection · CPC title