System and method for detecting unknown malware

Abstract

Disclosed are systems, methods and computer program products for detecting unknown malware. A method comprises generating genes for known malicious and clean objects; analyzing object genes using different malware analysis methods; computing a level of successful detection of malicious objects by one or a combination of malware analysis methods based on analysis of genes of the known malicious objects; computing a level of false positive detections of malicious objects by one or a combination of malware analysis methods based on analysis of genes of known clean objects; measuring effectiveness of each one or the combination of malware analysis methods as a function of the level of successful detections and the level of false positive detections; and selecting one or a combination of the most effective malware analysis methods for analyzing unknown object for malware.

Description

technical field [0001] The present invention relates generally to the field of computer security, and in particular, to systems, methods and computer program products for detecting unknown malware. Background technique [0002] Over the past decade, the significant growth in the number of Internet users driven by the development of Internet services such as gaming, news, entertainment, shopping, banking, social networking, etc. has led to a significant increase in the emergence of new types of malware. In the past three years alone, the number of new malicious program detections has increased more than tenfold. And that growth rate continues to increase. As such, antivirus software developers have struggled to keep pace with the proliferation of new classes of malware by developing new systems and methods for detecting malware. [0003] As a result of this development, signature matching and heuristic analysis techniques for malware have become widely popular and are extre...

AI Technical Summary

Problems solved by technology

[0005] The protection's heuristic analysis method also has shortcomings in detecting unknown malware: firstly, the longer operation time compared to the signature method; and secondly, it provides a detection rate of 60-70%, which is already close to the limit of its capabilities

Images