Malware detection

Abstract

A computer-implemented method for identifying malware in computer systems comprises receiving a plurality of executable files labeled as being malicious or benign, training a machine learning model using properties extracted from overlays associated with each of the plurality of received labeled executable files, receiving an executable file that is not labeled, determining whether the received unlabeled executable file is malicious or benign using the trained machine learning model based on properties extracted from an overlay associated with the received unlabeled executable file, and transmitting information identifying the received unlabeled executable file as malicious when the received unlabeled executable file is determined to be malicious.

Description

technical field [0001] The present invention relates to techniques for detecting malicious executable files by performing static analysis on the executable's overlay. Background technique [0002] Malicious files (malware) pose a great risk to private users and organizations. In recent years, the task of detecting malware has become a major problem with the growth of the number of malware samples and the continuous improvement of malware camouflage techniques. [0003] Currently, malicious executable programs use a variety of techniques to evade detection by anti-virus systems (AVs). These techniques, such as code packaging, polymorphism, metamorphology, encryption, etc., are usually performed "in-place", ie, on the portion of the malicious file that is loaded into memory when the file starts executing. Existing mechanisms to detect such malicious code perform with high efficiency and probability, making such attacks more difficult to succeed. As a result, malware has evo...

AI Technical Summary

Problems solved by technology

Therefore, the prior art does not adequately address the problem of detecting malicious content present in the overlay of an executable file

Images