Optimized analysis for detecting harmful content

Patent metadata

Field	Value
Publication number	US-11601451-B1
Application number	US-202217744704-A
Country	US
Kind code	B1
Filing date	May 15, 2022
Priority date	May 15, 2022
Publication date	Mar 7, 2023
Grant date	Mar 7, 2023

Abstract

A method including analyzing affected data known to include harmful content to identify harmful traits that are included in the affected data with a frequency that satisfies a threshold frequency; analyzing clean data known to be free of harmful content to identify clean traits that are included in the clean data with a frequency that satisfies the threshold frequency; determining harmful patterns indicating characteristics of the harmful traits included in affected data based at least in part on comparing the affected data with the harmful traits and the clean traits; determining clean patterns indicating characteristics of the clean traits included in clean data based at least in part on comparing the clean data with the harmful traits and the clean traits; and determining whether given data includes the harmful content based at least in part on utilizing the harmful patterns and the clean patterns. Various other aspects are contemplated.

First claim

What is claimed is:

1. A method, comprising:
analyzing, by an infrastructure device, affected data known to include harmful content to identify harmful traits that are included in the affected data;
analyzing, by the infrastructure device, clean data known to be free of harmful content to identify clean traits that are included in the clean data;
mixing, by the infrastructure device, the identified harmful traits and the identified clean traits to determine a mixed set of the harmful traits and the clean traits;
determining, by the infrastructure device, harmful patterns indicating characteristics of the harmful traits included in the affected data based at least in part on comparing the affected data with the mixed set of the harmful traits and the clean traits, wherein a harmful pattern, from among the harmful patterns, includes a combination of harmful traits and clean traits;
determining, by the infrastructure device, clean patterns indicating characteristics of the clean traits included in the clean data based at least in part on comparing the clean data with the mixed set of the harmful traits and the clean traits;
determining, by the infrastructure device, whether given data includes the harmful content based at least in part on utilizing the harmful patterns and the clean patterns; and
preventing, based at least in part on determining whether the given data includes the harmful content, execution of the harmful content on a device.

2. The method of claim 1 , wherein determining whether the given data includes the harmful content comprises identifying traits included in the given data and utilizing a machine learning model to compare the identified traits with the harmful patterns and the clean patterns.

3. The method of claim 1 , wherein determining the harmful patterns includes determining a harmful pattern that indicates a particular combination of harmful traits included in the affected data.

4. The method of claim 1 , wherein determining the harmful patterns includes determining a harmful pattern that indicates a number of times a particular harmful trait is included in the affected data.

5. The method of claim 1 , wherein determining the harmful patterns includes determining a harmful pattern that indicates a particular arrangement of one or more harmful traits included in the affected data.

6. The method of claim 1 , wherein the harmful traits or the clean traits include functions when the affected data or the clean data includes software code.

7. The method of claim 1 , wherein the harmful traits or the clean traits include strings of alphanumeric characters when the affected data or the clean data includes text data.

8. An infrastructure device, comprising:
a memory; and
a processor communicatively coupled with the memory, the memory and the processor being configured to:
analyze affected data known to include harmful content to identify harmful traits that are included in the affected data;
analyze clean data known to be free of harmful content to identify clean traits that are included in the clean data;
mix the identified harmful traits and the identified clean traits to determine a mixed set of the harmful traits and the clean traits;
determine harmful patterns indicating characteristics of the harmful traits included in the affected data based at least in part on comparing the affected data with the mixed set of the harmful traits and the clean traits, wherein a harmful pattern, from among the harmful patterns, includes a combination of harmful traits and clean traits;
determine clean patterns indicating characteristics of the clean traits included in the clean data based at least in part on comparing the clean data with the mixed set of the harmful traits and the clean traits;
determine whether given data includes the harmful content based at least in part on utilizing the harmful patterns and the clean patterns; and
prevent, based at least in part on determining whether the given data includes the harmful content, execution of the harmful content on a device.

9. The infrastructure device of claim 8 , wherein, to determine whether the given data includes the harmful content, the memory and the processor are configured to identify traits included in the given data and to utilize a machine learning model to compare the identified traits with the harmful patterns and the clean patterns.

10. The infrastructure device of claim 8 , wherein, to determine the harmful patterns, the memory and the processor are configured to determine a harmful pattern that indicates a particular combination of harmful traits included in the affected data.

11. The infrastructure device of claim 8 , wherein, to determine the harmful patterns, the memory and the processor are configured to determine a harmful pattern that indicates a number of times a particular harmful trait is included in the affected data.

12. The infrastructure device of claim 8 , wherein, to determine the harmful patterns, the memory and the processor are configured to determine a harmful pattern that indicates a particular arrangement of one or more harmful traits included in the affected data.

13. The infrastructure device of claim 8 , wherein the harmful traits or the clean traits include functions when the affected data or the clean data includes software code.

14. The infrastructure device of claim 8 , wherein the harmful traits or the clean traits include strings of alphanumeric characters when the affected data or the clean data includes text data.

15. A non-transitory computer-readable medium configured to store instructions, which when executed by a processor associated with an infrastructure device, configure the processor to:
analyze affected data known to include harmful content to identify harmful traits that are included in the affected data;
analyze clean data known to be free of harmful content to identify clean traits that are included in the clean data;
mix the identified harmful traits and the identified clean traits to determine a mixed set of the harmful traits and the clean traits;
determine harmful patterns indicating characteristics of the harmful traits included in the affected data based at least in part on comparing the affected data with the mixed set of the harmful traits and the clean traits, wherein a harmful pattern, from among the harmful patterns, includes a combination of harmful traits and clean traits;
determine clean patterns indicating characteristics of the clean traits included in the clean data based at least in part on comparing the clean data with the mixed set of the harmful traits and the clean traits;
determine whether given data includes the harmful content based at least in part on utilizing the harmful patterns and the clean patterns; and
prevent, based at least in part on determining whether the given data includes the harmful content, execution of the harmful content on a device.

16. The non-transitory computer-readable medium of claim 15 , wherein, to determine whether the given data includes the harmful content, the processor is configured to identify traits included in the given data and to utilize a machine learning model to compare the identified traits with the harmful patterns and the clean patterns.

17. The non-transitory computer-readable medium of claim 15 , wherein, to determine the harmful patterns, the memory and the processor are configured to determine a harmful pattern that indicates a particular combination of harmful traits included in the affected data.

18. The non-transitory computer-readable medium of

Assignees

• Uab 360 It

Inventors

• {Hacek Over (S)}Ev{Hacek Over (C)}Enko Aleksandr
• Briliauskas Mantas

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title