Detecting malware attacks using extracted behavioral features

Patent metadata

Field	Value
Publication number	US-10530787-B2
Application number	US-201715690668-A
Country	US
Kind code	B2
Filing date	Aug 30, 2017
Priority date	Aug 30, 2017
Publication date	Jan 7, 2020
Grant date	Jan 7, 2020

Abstract

Detecting malware attacks is described herein. A computer-implemented method may include receiving, via a processor, events from a plurality of activity monitors. The method also include extracting, via the processor, a plurality of behavioral features from the received events. The method may further include detecting, via the processor, a malware attack based on the extracted behavioral features using a malware identification model trained on private data and public data. The method may also include executing, via the processor, an ad hoc protection improvement based on the detected malware attack.

First claim

What is claimed is:

1. A computer system, comprising:
one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage medium, and program instructions stored on at least one of the one or more tangible storage medium for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising:
receiving events from a plurality of activity monitors;
extracting a plurality of behavioral features from the received events, wherein the behavioral features include network behavioral features, database behavioral features, and file behavioral features;
detecting a malware attack based on the extracted behavioral features using a malware identification model trained on private data and public data, wherein the malware includes previously unknown form of malware detected based on a combination of the behavioral features; and
executing an ad hoc protection improvement based on the detected malware attack, wherein the improvement includes dynamically installing a file access monitor agent on a machine correlated with the detected malware attack, blocking access to tables with sensitive information for suspicious users, installation of security patches on machines, and blocking suspicious command and control domains.

2. The computer system of claim 1 , wherein the ad hoc protection improvement comprises a dynamic installation of a file access monitor agent on a machine correlated with the detected malware attack.

3. The computer system of claim 1 , wherein the processor is to block network traffic associated with the detected malware attack.

4. The computer system of claim 1 , wherein the network behavioral feature comprises a user identification, a proxy agent used by the malware attack, a data characteristic, a protocol error, an access domain metadata, or any combination thereof.

5. The computer system of claim 1 , wherein the database behavioral feature comprises a user account used by the malware attack to access data.

6. The computer system of claim 1 , wherein the file behavioral feature comprises a file metadata, a file permission, a user identification, a content classification, a file action, or any combination thereof.

7. The computer system of claim 1 , wherein the plurality of activity monitors comprise a file activity monitor, a network activity monitors, a database activity monitor, or any combination thereof.

8. A computer-implemented method, comprising:
receiving, via a processor, events from a plurality of activity monitors;
extracting, via the processor, a plurality of behavioral features from the received events, wherein the behavioral features include network behavioral features, database behavioral features, and file behavioral features;
detecting, via the processor, a malware attack based on the extracted behavioral features using a malware identification model trained on private data and public data, wherein the malware includes previously unknown form of malware detected based on a combination of the behavioral features; and
executing, via the processor, an ad hoc protection improvement based on the detected malware attack, wherein the improvement includes dynamically installing a file access monitor agent on a machine correlated with the detected malware attack, blocking access to tables with sensitive information for suspicious users, installation of security patches on machines, and blocking suspicious command and control domains.

9. The method of claim 8 , wherein the ad hoc protection improvement comprises dynamically installing a file access monitor agent on a machine correlated with the detected malware attack.

10. The method of claim 8 , comprising blocking, via the processor, network traffic associated with the detected malware attack.

11. The method of claim 8 , comprising generating a report and sending the report to a security information and event management (SIEM) service.

12. The method of claim 8 , comprising updating the malware identification model based on collected findings about the malware attack.

13. The method of claim 8 , comprising updating a knowledge database based on the detected malware attack.

14. The method of claim 8 , further comprising retraining the malware identification model based on collected findings associated with the malware attack.

15. A computer program product for detecting malware attacks, the computer program product comprising:
one or more computer-readable tangible storage medium and program instructions stored on at least one of the one or more tangible storage medium, the program instructions executable by a processor capable of performing a method, the method comprising:
receiving events from a plurality of activity monitors;
extracting a plurality of behavioral features from the received events, wherein the behavioral features include network behavioral features, database behavioral features, and file behavioral features;
detecting a malware attack based on the extracted behavioral features using a malware identification model trained on private data and public data, wherein the malware includes previously unknown form of malware detected based on a combination of the behavioral features; and
executing an ad hoc protection improvement based on the detected malware attack, wherein the improvement includes dynamically installing a file access monitor agent on a machine correlated with the detected malware attack, blocking access to tables with sensitive information for suspicious users, installation of security patches on machines, and blocking suspicious command and control domains.

16. The computer program product of claim 15 , further comprising program code executable by the processor to dynamically install a file access monitor agent on a machine correlated with the detected malware attack.

17. The computer program product of claim 15 , further comprising program code executable by the processor to block network traffic associated with the detected malware attack.

18. The computer program product of claim 15 , further comprising program code executable by the processor to generate a report and sending the report to a security information and event management (SIEM) service.

19. The computer program product of claim 15 , further comprising program code executable by the processor to update a knowledge database based on the detected malware attack.

20. The computer program product of claim 15 , further comprising program code executable by the processor to retrain the malware identification model based on collected findings associated with the malware attack.

Assignees

• IBM

Inventors

• Avrahami Shlomit
• Finelt Tali
• Gordon Itai
• Keisar Yakir
• Prager Ilan
• Pyasik Alexander
• Sofer Oded
• Bar-Yaacov Or
• Yulevich Yifat

Classifications

• G06F21/554

  involving event detection and direct action · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title