Systems and methods for identifying associations between malware samples

Patent metadata

Field	Value
Publication number	US-9721099-B2
Application number	US-201514681269-A
Country	US
Kind code	B2
Filing date	Apr 8, 2015
Priority date	Aug 18, 2011
Publication date	Aug 1, 2017
Grant date	Aug 1, 2017

Abstract

Systems and methods are disclosed for identifying associations between binary samples, such as e-mail files and their attachments or a document and an executable program associated with the document. In one implementation, the method includes receiving a plurality of binary samples, and extracting metadata from the plurality of binary samples. The metadata for a binary sample from the plurality of binary samples includes a set of attributes of the binary sample. The method further includes identifying a set of associations between the plurality of binary samples based on the extracted metadata. Each association is characterized by at least one attribute the associated binary samples have in common, and each association has a confidence level indicative of a strength of the association. The method also includes identifying associations with a confidence level that exceeds a predefined threshold.

First claim

What is claimed is:

1. A method, performed by a processor, for identifying associations between binary samples, comprising:
accessing, via the processor, a set of associations between a plurality of binary samples, wherein a first association included in the set of associations is characterized by at least one attribute that is unique for a file type associated with the plurality of binary samples; and
providing a user interface, on a display device, that enables navigation of at least one of the set of associations and type-specific metadata associated with the plurality of binary samples.

2. The method of claim 1 , wherein the user interface further enables filtering of the type-specific metadata while preserving the set of associations.

3. The method of claim 1 , wherein the user interface displays a navigable, graphic visualization of the plurality of binary samples, the associations between the plurality of binary samples, and a set of groups that the associations produce.

4. The method of claim 1 , wherein the user interface enables filtering the set of associations to generate a subset of associations.

5. The method of claim 1 , wherein the user interface enables filtering the plurality of binary samples.

6. The method of claim 5 , wherein the filtering is based on at least one of distance selection, recentering, metadata queries, drill down, and group selection.

7. The method of claim 1 , wherein the user interface further enables modification of the type-specific metadata associated with a first binary sample included in the plurality of binary samples.

8. A system, comprising:
a memory, storing a set of instructions; and
a processor, to execute the stored set of instructions, the set of instructions comprising:
accessing a set of associations between a plurality of binary samples, wherein a first association included in the set of associations is characterized by at least one attribute that the associated binary samples have in common, wherein the at least one attribute of the plurality of binary samples is unique for a file type associated with the plurality of binary samples; and
providing a user interface, on a display device, that enables navigation of at least one of the set of associations and type-specific metadata associated with the plurality of binary samples.

9. The system of claim 8 , wherein the user interface further enables filtering of the type-specific metadata while preserving the set of associations.

10. The system of claim 8 , wherein the user interface enables filtering the set of associations to generate a subset of associations.

11. The system of claim 8 , wherein the user interface enables filtering the plurality of binary samples.

12. The system of claim 10 , wherein the filtering is based on at least one of distance selection, recentering, metadata queries, drill down, and group selection.

13. The system of claim 8 , wherein the user interface enables modification of the type-specific metadata associated with a first binary sample included in the plurality of binary samples.

14. A non-transitory computer-readable medium having stored thereon instructions that, when executed by a processor, performs a method for identifying associations between binary samples, the method comprising:
accessing, via the processor, a set of associations between a plurality of binary samples based on type-specific metadata extracted from the plurality of binary samples, wherein each association included in the set of associations is characterized by at least one attribute included in a set of attributes that the associated binary samples have in common, wherein the set of attributes of the plurality of binary samples are unique for a file type associated with the plurality of binary samples; and
providing a user interface, on a display device, that enables navigation of the set of associations and the type-specific metadata.

15. The non-transitory computer-readable medium of claim 14 , wherein the user interface further enables filtering of the type-specific metadata while preserving the set of associations.

16. The non-transitory computer-readable medium of claim 14 , wherein the user interface displays a navigable, graphic visualization of the plurality of binary samples, the associations between the plurality of binary samples, and a set of groups that the associations produce.

17. The non-transitory computer-readable medium of claim 14 , wherein the user interface enables filtering the set of associations to generate a subset of associations.

18. The non-transitory computer-readable medium of claim 14 , wherein the user interface enables filtering the plurality of binary samples.

19. The non-transitory computer-readable medium of claim 17 , wherein the filtering is based on at least one of distance selection, recentering, metadata queries, drill down, and group selection.

20. The non-transitory computer-readable medium of claim 14 , wherein the user interface enables modification of the type-specific metadata associated with a first binary sample included in the plurality of binary samples.

Assignees

• Verisign Inc

Inventors

• Sinclair Gregory
• Olson Ryan
• Falcone Robert

Classifications

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06F21/564

  by virus signature recognition · CPC title

• G06F16/338

  Presentation of query results · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F16/907

  Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually · CPC title