System and method for classifying objects to prevent malicious activity propagation

Abstract

Systems and methods for classifying objects to prevent propagation of malicious activities are disclosed. In one aspect, an exemplary method includes searching in a network an object having generic information with other objects and collecting information about the object; generating an association graph containing classified objects and unclassified objects in a vertex form, so that association between the objects indicates that general information exists between the objects, and the classified objects comprise malicious objects; based on at least one of group correlation analysis between the objects and sequence correlation analysis between the objects, extracting at least one sub-graph comprising similar objects and at least one unclassified object from the generated correlation graph; classifying each unclassified object in each sub-graph based on analysis using a classification rule; and restricting access to the objects classified as malicious.

Description

Technical Field

[0001] The present invention relates to the field of information security, and more particularly, to a method for identifying malicious network nodes or intermediate network nodes through which malware is distributed to prevent the spread of malicious activities. Background Art

[0002] Malware is constantly evolving, pushing information security service providers to keep up with the changing threat landscape. In particular, cybercriminals develop methods to distribute malware and exploit new vulnerabilities to infiltrate computer systems (hereafter referred to as computers).

[0003] Currently, various types of attacks on computer network resources are being used. For example, attacks on computer network resources include attackers registering domain names for subsequent distribution of malware or using the domain names for phishing.

[0004] Such attacks can be used to redirect users to malicious or phishing websites, or to fake email services of the attacker's choice. For example, the pages of these websites may contain Trojans or viruses, and the fake email services may ask users for their mailbox login and password, and transmit these credentials to the attacker. On the other hand, visitors to phishing websites will not be aware of this deception and are likely to download malware to their computers.

[0005] Some known techniques are quite effective in solving the problem of malicious domain classification. However, despite many advantages, they only consider similarities based on WHOIS and DNS information, without considering other factors, such as the association of malicious domains through URIs, and analyzing the association of domain names based on homogeneous objects associated with domain names, whereby objects are homogeneous if there is common information about the objects. Therefore, the technical task of creating a method for classifying objects to prevent the spread of malicious activities is still meaningful.

[0006] Therefore, there is a need for methods and systems to more effectively identify malicious network nodes or intermediate network nodes through which malware is distributed to prevent the spread of malicious activity. Summary of the invention

[0007] Aspects of the present invention relate to systems and methods for classifying objects to prevent the spread of malicious activity.

[0008] In one exemplary aspect, a method for classifying objects to prevent the spread of malicious activities is disclosed, the method comprising: searching a network for objects having common information with other objects and collecting information about the objects; generating an association graph comprising classified objects and unclassified objects in vertex form, whereby associations between objects indicate the presence of common information between the objects, wherein the classified objects include malicious objects; extracting at least one subgraph comprising objects of the same type and containing at least one unclassified object from the generated association graph based on at least one of a group association analysis between objects and a sequential association analysis between objects; classifying each unclassified object in each subgraph based on an analysis of the objects using classification rules; and restricting access to objects classified as malicious to prevent the spread of malicious activities.

[0009] In one aspect, the other objects include objects classified as malicious or objects having common information with objects classified as malicious.

[0010] In one aspect, the classification rules include at least one of: similarity analysis and object analysis using a machine learning model.

[0011] In one aspect, the similarity analysis is performed using the Levenshtein metric.

[0012] In one aspect, the association graph contains only associations between objects of different types.

[0013] In one aspect, the object and the information of the object are at least two of the following types of information: an Internet Protocol (IP) address; a fully qualified domain name (FQDN); universal resource identifier (URI) information; domain name data, including information about a domain name registrar; information about the owner of the domain name, including the name of the owner of the domain name, the address of the owner of the domain name, the IP address range to which the domain name belongs on the network, and contact information of the owner of the domain name; information about the owner of the IP address, including the name and address of the owner of the IP address; the name of the computer network range; the location corresponding to the IP address range, including the country and city; administrator contact information; information about the IP address to which the object belongs; information about a public key certificate issued for the domain name; file hashes and file paths; and a URL containing the domain name.

[0014] In one aspect, the URI information includes at least a page address and page loading parameters.

[0015] In one aspect, generating the association graph including classified objects and unclassified objects in the form of vertices further comprises classifying the unclassified object being a domain name as authentic if the number of requests received from the domain name system exceeds a predetermined threshold.

[0016] In one aspect, at least one subgraph extracts an associated component containing information about associated objects, wherein at least one of the objects is unclassified.

[0017] In one aspect, each analysis is performed by at least one machine learning model.

[0018] In one aspect, the machine learning model is trained by using a boosted decision tree.

[0019] In one aspect, the sequential association analysis uses at least one adjacent malicious object.

[0020] In one aspect, the sequential association analysis between objects uses information about at least three objects having an association.

[0021] In one aspect, wherein the group association analysis between objects uses information about at least four objects, three of which have an association with a fourth object.

[0022] In one aspect, access to objects classified as malicious is restricted to prevent the spread of malicious activity by one of: blocking access to a website associated with the object; opening the website associated with the object in a browser running in protected mode; and pausing transitions to the website and notifying a user that the website is associated with a malicious object.

[0023] According to one aspect of the present invention, a system for classifying objects to prevent the spread of malicious activities is provided, the system comprising: at least one memory; and at least one hardware processor, the at least one hardware processor being connected to the at least one memory and being configured individually or in combination to: search for objects having common information with other objects in a network and collect information about the objects; generate an association graph containing classified objects and unclassified objects in vertex form, whereby the associations between objects indicate the existence of common information between the objects, wherein the classified objects include malicious objects; extract at least one subgraph including objects of the same type and containing at least one unclassified object from the generated association graph based on at least one of group association analysis between objects and sequential association analysis between objects; classify each unclassified object in each subgraph based on analysis of the objects using classification rules; and restrict access to objects classified as malicious to prevent the spread of malicious activities.

[0024] In one exemplary aspect, the present invention provides a non-transitory computer-readable medium storing computer executable instructions for classifying objects to prevent the spread of malicious activities, the computer executable instructions including instructions for the following operations: searching a network for objects having common information with other objects and collecting information about the objects; generating an association graph containing classified objects and unclassified objects in vertex form, whereby associations between objects indicate the existence of common information between the objects, wherein the classified objects include malicious objects; extracting at least one subgraph including objects of the same type and including at least one unclassified object from the generated association graph based on at least one of group association analysis between objects and sequential association analysis between objects; classifying each unclassified object in each subgraph based on analysis of the objects using classification rules; and restricting access to objects classified as malicious to prevent the spread of malicious activities.

[0025] The technical effect of this method is to prevent malicious activities from spreading on a computer network. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate one or more exemplary aspects of the invention and, together with the detailed description, serve to explain the principles and implementations of these exemplary aspects.

[0027] Figure 1 An example computer network including a system for classifying objects to prevent the spread of malicious activity according to aspects of the present invention is shown.

[0028] Figure 2 An example of the composition of an object classification system according to aspects of the present invention is shown.

[0029] Figure 3 An example of an association graph with subgraphs generated according to aspects of the present invention is shown, in which vertices are classified using sequential association analysis.

[0030] Figure 4 An example of an association graph with subgraphs generated according to aspects of the present invention is shown, in which vertices are classified using group association analysis.

[0031] Figure 5a A first example of a correlation graph and analysis of a correlation graph according to aspects of the present invention is shown.

[0032] Figure 5b A second example of analysis of a correlation graph according to aspects of the invention is shown.

[0033] Figure 6An example of a method for classifying objects to prevent the spread of malicious activity according to aspects of the present invention is shown.

[0034] Figure 7 An example of a general purpose computer system upon which aspects of the present invention for classifying objects to prevent the spread of malicious activity may be implemented is presented. DETAILED DESCRIPTION

[0035] Exemplary aspects are described herein in the context of systems, methods, and computer programs for classifying objects to prevent the spread of malicious activity according to various aspects of the present invention. It will be appreciated by those of ordinary skill in the art that the following description is illustrative only and is not intended to be limiting in any way. Other aspects will readily occur to those of ordinary skill in the art who understand the present invention. Reference will now be made in detail to the implementation of the exemplary aspects as shown in the accompanying drawings. Throughout the drawings and the following description, the same reference numerals will be used as much as possible for the same or similar items.

[0036] In some aspects of the invention, part or all of the system for classifying objects to prevent the spread of malicious activity may be implemented on a general purpose computer (e.g., Figure 7 The system is implemented on a processor of a general-purpose computer (shown in FIG. 1 ). In this case, the components of the system can be implemented within a single computing device, or distributed among several interconnected computing devices. The present invention describes a technical solution for classifying objects to prevent the spread of malicious activities.

[0037] Figure 1 An example computer network 110 is shown, which includes a system for classifying objects to prevent the spread of malicious activities according to aspects of the present invention. The computer network 110 includes at least six computers (PC1 to PC6) and a computer device (server) 120, which further includes an information collection module 130 and an object classification system 140.

[0038] In one aspect, computer network 110 (hereinafter also referred to as network 110) is one of the network nodes of the Internet. Another example of computer network 110 is the entire Internet.

[0039] The computer of the present invention includes any computing device, such as a personal computer, a laptop, a smart phone, a tablet computer, a router, a data storage system, a server. An example of a server 120 on which the object classification system 140 is implemented is Figure 7 The computer system described in .

[0040] The information collection module 130 is designed to collect information about objects and send the collected information about objects to the object classification system 140. During the collection of object information, objects having common information with objects previously classified as malicious, or objects having common information with the following objects, which further have common information with objects classified as malicious, are searched in the computer network 110. Objects found in the network 110 are unclassified objects.

[0041] The object classification system 140 is designed to classify objects to prevent the spread of malicious activities based on the classification. The object to be classified is at least one of the following: a fully qualified domain name (hereinafter referred to as a domain name); URI information; an IP address; domain name data, including information about a domain name registrar; information about the owner of the domain name, including the name of the owner who owns the domain name, the address of the owner of the domain name, the IP address range to which the domain name belongs on the network, and the contact information of the owner of the domain name; information about the owner of the IP address, including the name and address of the owner of the IP address; the name of the computer network range; the location corresponding to the IP address range, including the country and city; the contact information of the administrator; information about the IP address to which the scanned object belongs; information about the public key certificate issued for the domain name; file hashes and file paths; and the URL containing the domain name. According to different aspects, objects can be classified for a single object type (such as a domain name), or for two or more object types. The classification is performed based on classification rules, which take into account various characteristics and associations of objects in the subgraph. It is worth noting that in the future, when referring to one type of object, other types of objects may also be used.

[0042] In another aspect, classification into two categories, namely malicious and credible. In this aspect, there may not be enough information about the object to unambiguously classify the object. In this case, the object remains unclassified until there is enough information about the object to make a unique classification.

[0043] It is worth noting that in other aspects, objects can be classified into two or more categories, and other categories can be selected. For example, objects are classified as malicious, non-malicious, and trusted.

[0044] Figure 2 An example of the composition of the object classification system 140 according to aspects of the present invention is shown. The object classification system 140 includes a module 210 for generating a graph, a malicious object database 220, a trusted object database 230, and an analyzer 240.

[0045] The module for generating a graph 210 is designed to generate a correlation graph based on information from the malicious object database 220 and information about objects received from the information gathering module 130 .

[0046] Malicious object database 220 contains information about known malicious objects and information about associated objects. An association between objects means that there is common information between these objects. For example, malicious object database 220 stores IP address 192.158.0.13, and information collection module 130 collects information about domain names pointing to this IP address from computer network 110. In this example, the specified IP address is an association between objects.

[0047] In one aspect, the information collection module 130 includes an object database 205. The object database 205 contains information about associations and categories of objects collected by the information collection module 130. In this aspect, the malicious object database 220 stores at least tags of objects. When applied to domain names in the malicious object database 220, masks of malicious domain names and phishing domain names are stored. The mask is a constrained regular expression that replaces a portion of the domain name with an asterisk. In this case, for example, for files, the malicious object database 220 contains md5 files, names of malware, etc. In other words, the malicious object database 220 stores malicious object keys (e.g., masks and hashes) corresponding to multiple objects in the object database 205. In this case, the module 210 for generating a graph builds a graph based on information from the malicious object database 220 and object information from the object database 205.

[0048] Examples of information contained in malicious object database 220 and / or information collection module 130 (depending on the implementation) include:

[0049] Malicious domain “malware.com”

[0050] IP address 192.158.0.13; and

[0051] The information that the specified domain name points to the specified IP address.

[0052] Information about known malicious objects includes at least one of the following:

[0053] Information about objects obtained using the WHOIS service;

[0054] Information about the object obtained using the WHOIS IP service;

[0055] Information about objects obtained using the Domain Name System;

[0056] Information about the public key certificate issued for the domain name; and

[0057] A URL containing information about the page, its download options, and the files on the page.

[0058] Malicious object database 220 may obtain information from various sources, such as external sources (e.g., WHOIS services) or internal sources (i.e., analyzer 240).

[0059] Furthermore, the information about the object obtained using the WHOIS service includes at least one of the following:

[0060] Information about the owner of the domain name, including the name of the owner of the domain name, the name of the company, the address of the owner of the domain name, or contact information of the owner of the domain name;

[0061] ·Contact information of the domain administrator;

[0062] Information about the domain name registrar;

[0063] The date the domain was created;

[0064] The domain name registration period; and

[0065] The current status of the domain name.

[0066] The object information obtained using the WHOIS IP service includes information about at least one of the following:

[0067] The IP address range of the scanned object;

[0068] The name of the computer network scope;

[0069] The owner of the IP address, including the name and address of the owner of the IP address;

[0070] The country to which the IP address range corresponds; and

[0071] The city corresponding to the IP address range.

[0072] The object information obtained from the domain name system refers to the IP address to which the scanned object belongs.

[0073] The information about the public key certificate issued for a domain name contains information about the certificate issued by the certificate authority for the domain name. An example of such a certificate is an SSL (Secure Sockets Layer) certificate.

[0074] The URL information contains information about the protocol, FQDN, port, and hash of a specific file on the web server, the path to a specific file on the web server, and a URL in the form <schema> :[ / / <host> [: <port> ]][ / <pageaddress>][?<page load parameters> ]’s URI (Uniform Resource Identifier) ​​information.

[0075] In one particular aspect, information about each malicious object is included in malicious object database 220 until object classification system 140 receives notification that the corresponding object has been blocked. Upon receiving information about a blocked object, object classification system 140 updates the information in malicious object database 220 using analyzer 240.

[0076] In another specific aspect, the malicious object database 220 also contains information about the storage time of the information about each malicious object, for example six months, after which the information about the malicious object is deleted from the malicious object database 220. The storage time of the information can be selected in a practical way in order to store the information most efficiently, and in order to minimize false positives during analysis. For example, attackers often use short-term domain names, often associate new domain names with previously used IP addresses, and websites that distribute malware are blocked by antivirus solutions afterwards. Therefore, in order to update the information about the malicious objects, it is necessary to regularly update the malicious object database 220.

[0077] In another specific embodiment, the malicious object database 220 storing object tags and the data in the object database 205 are updated regularly, for example, every six months, based on information received from an external source (eg, a WHOIS service).

[0078] Trusted object database 230 contains a list of trusted objects. For example, a trusted domain name is a domain name requested from a DNS server with a high frequency (i.e., a frequency exceeding a predefined threshold). A trusted object is also an object that has been pre-analyzed and identified as legitimate.

[0079] In a preferred aspect, the module 210 for generating a graph generates an association graph as follows:

[0080] In a first step, the module for generating a graph 210 generates vertices, which are objects from the malicious object database 220 and information about the objects received from the information gathering module 130 .

[0081] In one particular aspect, the vertex is generated using object information from object database 205. In this case, unclassified objects are stored in object database 205, and malicious objects are stored in malicious object database 220. If object information from object database 205 is present in malicious object database 220, the corresponding vertex is classified as malicious.

[0082] In the second step, in the case where the corresponding features of two vertices are associated, the module 210 for generating a graph connects the two vertices with edges. For example, two vertices have two domain names pointing to the same IP address. In this case, the graph will draw edges between the vertex that is the IP address and each of the two vertices that are the domain names. For another example, the forty vertices corresponding to the IP address belong to the same IP range. In this case, the graph will draw edges between the vertex that is the IP range and each of the forty vertices that are the IP addresses. Therefore, the module 210 for generating a graph builds all edges based on information about the associations between the features.

[0083] In a specific implementation, the association graph only includes associations between objects of different types, that is, no associations between domain names whose types are all domain names are established.

[0084] Initially, the association graph contains two categories of vertices: malicious vertices and unclassified vertices. Malicious vertices correspond to malicious objects from the malicious object database 220. Unclassified vertices correspond to objects that have been retrieved from the information collection module 130. It is worth noting that in the analysis described below, if there is enough information about the object, the unclassified vertex is changed to one of the two categories of vertices, namely malicious vertices or trusted vertices. If there is not enough information about the feature to clearly classify it, the vertex will remain unclassified. The category to which the vertex corresponds depends on the results of the analysis.

[0085] In one particular aspect, the module for generating a graph 210 further connects vertices based on URI information (eg, page address, page load parameters, and other components of URI information), WHOIS IP information, and WHOIS information.

[0086] The analyzer 240 is used to extract at least one subgraph from the association graph and analyze unclassified subgraph objects. It should be noted that all objects in the same subgraph are of the same type.

[0087] The analyzer 240 extracts at least one subgraph including objects of the same type and at least one unclassified object from the association graph based on at least one of the following methods:

[0088] Group association analysis between objects; and

[0089] ·Sequential association analysis between objects.

[0090] It is worth noting that the analyzer 240 uses a corresponding machine learning model for each method, which is trained to implement the corresponding method. Each machine learning model is based on one of the above methods.

[0091] In one particular implementation, the machine learning model is based on the principle of a "boosted decision tree". A decision tree is a hierarchical tree structure consisting of rules of the form "if..., then...". When being trained, the machine learning model receives information samples about objects from triplets of objects, such as "a malicious object of one type, an intermediate object of another type, a malicious object of the same type as the first type" and "a malicious object of one type, an intermediate object of another type, a trusted object of the same type as the first type". It is worth noting that the intermediate object is an object associated with the first and last object of the three objects.

[0092] In other specific implementations, the machine learning model is based on principles such as k-nearest neighbor (kNN) method, neural network, support vector machine, etc.

[0093] In one particular aspect, before extracting the subgraph from the association graph, the analyzer 240 determines, for each unclassified vertex in the association graph, the number of those vertices that request a domain name from a DNS server. If the number of requests to the DNS server exceeds a specified threshold, such as 10,000 requests, the analyzer 240 classifies the vertex as trusted and adds the corresponding domain name to the trusted object database 230. In this case, the specified domain name will be excluded from further analysis.

[0094] In another specific aspect, before extracting the subgraph from the association graph, the analyzer 240 determines, for each unclassified vertex in the association graph, the number of those vertices that request a domain name from a DNS server. If the number of requests to the DNS server exceeds a specified threshold, such as 10,000 requests, the analyzer 240 excludes the corresponding vertex from the association graph.

[0095] According to different aspects, these analysis methods can be applied in various combinations and sequences. In one aspect, the analyzer 240 uses these two methods in sequence in the analysis, for example, in the following order: sequential association analysis, group association analysis. On the other hand, the analyzer 240 uses these methods in parallel. On the other hand, when these methods are used in sequence, the analyzer 240 determines whether a subsequent method is needed after each method. Determine whether a subsequent method is needed based on the result obtained from the previous method. On the other hand, the analyzer 240 uses these methods in parallel and generates a single result when the result is received.

[0096] In the case where the analyzer 240 uses the sequential association analysis method, the analyzer 240 uses the machine learning model trained for the task to analyze the vertex triples on the association graph based on the feature information. It is worth noting that when the sequential association analysis method is used for analysis, the analyzer 240 analyzes the vertex triples in the form of "a malicious vertex of one type, an intermediate vertex of another type, and an unclassified vertex of the same type as the first type".

[0097] In one particular aspect, the sequential analysis uses at least one adjacent malicious object, and information about at least three associated objects.The operation of this method is considered based on the association graph generated by the module 210 for generating a graph.

[0098] Figure 3 An example 300 of an association graph with subgraphs generated according to aspects of the present invention is shown, in which vertices are classified using sequential association analysis. Figure 3 As shown, the unclassified vertices of the type domain are represented as "u", the malicious vertices of the type domain are represented as "m", the vertices corresponding to the information URI are represented as "uri", and the vertices corresponding to the IP are represented as "ip". For example, the analyzer 240 feeds the machine learning model with information about the malicious domain name corresponding to the vertex m2 and information about the unclassified domain name corresponding to the vertex u2. Vertices u2 and m2 are connected by the vertex uri, which corresponds to the common part of the URI information. If the machine learning model determines that the information about these domain names is similar, the analyzer 240 will add these three vertices to the subgraph for further analysis.

[0099] Let's look at another example. The analyzer 240 sends information about malicious domain names corresponding to vertices m3 and m1, and information about unclassified domain names corresponding to vertex u3 to the machine learning model. If the machine learning model determines that vertices m1 and u3 are similar, the analyzer 240 will add the three vertices m1, ip, and u3 to the subgraph for further analysis. If the machine learning model determines that vertices m3 and u3 are similar, the analyzer 240 will push the three vertices m3, uri, and u3 into the subgraph for further analysis. Since vertex u3 is already in the subgraph, the subgraph will be supplemented with a new vertex. Therefore, the subgraph will consist of the following vertices: m1, ip, u3, uri, m3.

[0100] The analyzer 240 analyzes the remaining associations in the association graph of the form of "malicious vertex, intermediate vertex of different types, unclassified vertex of the same type as the first type" in the same manner as the previously described example.

[0101] In the case where the analyzer 240 uses a group association analysis method, the analyzer 240 uses a machine learning model trained for the task to analyze the associations in the association graph based on the object information. When trained, the machine learning model receives as input objects that are not domain names and aggregate information about all objects associated with the object being analyzed. Let's see how this method works based on the association graph generated by the module for generating the graph 210.

[0102] Figure 4 An example 400 of an association graph with subgraphs generated according to aspects of the present invention is shown, in which vertices are classified using group association analysis. Figure 4 , unclassified vertices are labeled "u", malicious vertices are labeled "m", vertices corresponding to common IP addresses are labeled "ip1", and vertices corresponding to common parts of URIs are labeled "uri1". Vertices m1, u1, and u2 are connected to vertex ip1 because their respective domain names have common IP addresses, while vertices u2, u3, u4, m2, m3, m4 are connected to node uri1 because their corresponding domain names have common URI parts. In the method, the analyzer 240 analyzes vertices uri1 and ip1. For example, the analyzer 240 passes the object uri1 and information about all vertices associated through the edges between the vertex uri1 to the machine learning model. If the machine learning model outputs to the analyzer 240 that the object corresponding to the vertex uri1 is similar to a malicious information URI, the analyzer 240 will add the vertex uri1 and all associated vertices to the subgraph for further analysis. The vertex ip1 will be analyzed in the same manner.

[0103] In one particular aspect, a group association analysis method analyzes information about at least four objects, three of which must be associated with a fourth object.

[0104] In one particular aspect, the features assigned by analyzer 240 are not added to the general subgraph, but are analyzed based only on neighboring vertices.

[0105] After extracting the subgraph from the association graph, the analyzer 240 classifies the unclassified objects of the selected subgraph based on the analysis of the objects using the classification rules.

[0106] In one particular aspect, at least one subgraph uses the above-described analysis method to identify associated components containing information about associated objects, wherein at least one of the objects is unclassified.

[0107] The classification rules include at least one of the following methods:

[0108] Object similarity analysis; and

[0109] Analyze objects using classification rules.

[0110] Using the “object similarity analysis” method, the analyzer 240 analyzes the vertices of the subgraph based on the feature information in one of the following ways:

[0111] A) Similarity based on the Levenshtein metric; and

[0112] B) Similarity based on machine learning models.

[0113] Similarity based on the Levenshtein metric is described in the known art, for example, VILevenshtein, Binary Codes Capable of Correcting Deletions, Insertions, and Reversals, Doklady Academy of Sciences of the USSR, 1965, vol. 163, no. 4, 845–848.

[0114] Analyzer 240 includes at least one machine learning model. First, the machine learning model is trained on a data sample consisting of object pairs (i.e., similar object pairs and dissimilar object pairs, and the objects must be of the same type). The result of the training is a model that determines the similarity of the received input objects. By using a similarity analysis method that utilizes a machine learning model, analyzer 240 analyzes more complex correlations of object pairs. For example, two random domain names jsidfjk.com and reuhuh.com of approximately the same length will be identified as similar by the machine learning model. Another domain name pair jsidfjk.com and myaddress.com will be identified as dissimilar by the machine learning model because the first domain name consists of a set of random characters, while the second domain name is not.

[0115] In one aspect, when providing a decision regarding the similarity of information related to objects, the machine learning model calculates a value indicating the degree of similarity or difference between the objects.

[0116] In one particular aspect, the value indicating the degree of similarity of the features is expressed as a percentage.

[0117] In another particular aspect, the value indicating the degree of similarity of the features is represented by a number, for example, a number between 0 and 1.

[0118] On the other hand, a value indicating the degree of similarity of objects is expressed as similarity, such as "dissimilar", "slightly similar", and "similar".

[0119] If analyzer 240 has classified an unclassified vertex from a subgraph as malicious based on using at least one of the above methods, analyzer 240 adds the corresponding object or object tag (mask, hash) to malicious object database 220 .

[0120] Using the "object analysis using classification rules" method, analyzer 240 analyzes the vertices of the subgraph using the specified classification rules. Typically, the classification rules are formed with the help of a user with the necessary qualifications and knowledge in the field of information security. For example, if the machine learning model outputs to analyzer 240 that the object corresponding to vertex uri1 is similar to a malicious information URI object, but the number of unclassified vertices of the subgraph is greater than a certain number, or the number of unclassified vertices is less than a certain percentage of the total number of vertices associated with vertex uri1, then analyzer 240 will not classify the previously unclassified vertex as malicious. Such rules are necessary to minimize false positive classifications.

[0121] In one particular aspect, the analyzer 240 analyzes the vertices of the subgraph using a machine learning model (i.e., a graph neural network). As described above, at least two basic analysis methods (i.e., sequential association analysis and group association analysis) are described for the analyzer 240 to perform subgraph extraction based on association graph analysis. It should be noted that the results of extracting subgraphs from the association graph and performing subsequent classification using these methods may be different. Therefore, the analyzer 240 can use one of the following analysis methods to analyze the vertices, but with two types of analysis, the number of malicious vertices detected is increased, which improves the efficiency of the analysis.

[0122] Based on the object classification performed by the analyzer 240, a method for protecting a user's computer device from malicious objects is used ( Figure 1 (not shown) to prevent the spread of malicious activities. For example, at least one of the following methods may be used, among other methods:

[0123] Restrict access to objects classified as malicious;

[0124] Completely block access to websites that are considered malicious;

[0125] Opening a website associated with the malicious object in a browser running in protected mode; and

[0126] Pauses conversion to the website and notifies the user that the website is associated with a malicious object.

[0127] For a better understanding, an example is provided below to illustrate how the method of the present invention operates.

[0128] After collecting information about the object, the information collection module 130 sends the information about the object to the module for generating a graph 210. Based on the information about the object received from the information collection module 130 and the information stored in the malicious object database 220, the module for generating a graph 210 builds an association graph. The analyzer 240 analyzes the number of requests for each unclassified vertex of the domain name type. If the number of requests exceeds a certain number, the analyzer 240 classifies the vertex to which the corresponding unclassified domain name belongs as trusted, and adds the corresponding domain name and IP address to the trusted object database 230.

[0129] Next, the analyzer 240 uses sequential association analysis and / or group association analysis to identify at least one subgraph, e.g. Figure 5a and Figure 5b The subgraph shown in , where Figure 5a A first example of an association graph and analysis of an association graph according to aspects of the present invention is shown, Figure 5b A second example of analysis of a correlation graph according to aspects of the invention is shown.

[0130] exist Figure 5a , unclassified vertices are represented as squares, malicious vertices are represented as circles, and URIs are represented as triangles. Three vertices m2, URI2, and u1 are added to the subgraph using sequential association analysis. Vertex URI1 and its associated vertices are added to the subgraph using group association analysis. Vertex URI1 is malicious and vertex URI2 is unclassified. After at least one subgraph has been identified, analyzer 240 uses object similarity analysis using a machine learning model to analyze feature information of each vertex pair of the "malicious and unclassified" type. If the machine learning model outputs to analyzer 240 that the unclassified object is similar to a malicious object, analyzer 240 classifies the previously unclassified vertex as malicious.

[0131] exist Figure 5a , analyzer 240 classifies vertex URI2 as malicious and adds its corresponding object to malicious object database 220.

[0132] In the next step, the analyzer 240 applies object analysis using classification rules. In this example, the rule "if the number of malicious vertices is greater than 75% of the total number of vertices in the subgraph, classify all vertices as malicious" is triggered.

[0133] Let's look at another example of how the method of the present invention operates. Figure 5b The subgraph selected by the analyzer 240 is shown. The vertex "IP address" and its associated vertices are added to the subgraph using group association analysis. The vertex "IP address" is malicious.

[0134] In the first step, the analyzer 240 uses object similarity analysis using a machine learning model to analyze feature information of each vertex pair of the "malicious and unclassified" type. If the machine learning model outputs to the analyzer 240 that the unclassified object is similar to a malicious object, the analyzer 240 classifies the previously unclassified vertex as malicious and adds the corresponding object to the malicious object database 220.

[0135] In this example, when analyzing the vertex pair u1 and m3, the analyzer 240 classifies the vertex u1 as malicious and adds its corresponding object to the malicious object database 220. In the next step, the analyzer 240 applies object analysis using classification rules. In this example, no rules are triggered.

[0136] Figure 6 An example of a method 600 for classifying objects to prevent the spread of malicious activities according to various aspects of the present invention is shown. In addition, in the description of the steps of method 600, the attribute "domain name" is used as the attribute "object", and according to various aspects, any other object specified within the scope of the present invention, or a combination thereof, can be used.

[0137] In step 610, method 600 searches for objects that have common information with other objects in the network through information collection module 130, and collects information about these objects, such as domain names on network 110. For example, during object information collection, objects that have common information with the following objects are searched on network 110:

[0138] Objects previously classified as malicious, and

[0139] · Objects that further have common information with the objects classified as malicious.

[0140] Objects discovered in the network 110 are unclassified objects.

[0141] In step 620 , the method 600 generates an association graph by the module 210 for generating a graph, the association graph comprising classified objects and unclassified objects in the form of vertices, whereby associations between objects indicate that common information exists between the objects, wherein the classified objects include malicious objects.

[0142] In one particular aspect, an association graph is generated, wherein the association graph contains only associations between objects of different types.

[0143] The object and object information are at least two of the following types of information: an IP address; FQDN URI information; domain name data, including information about a domain name registrar; information about the owner of the domain name, including the name of the owner of the domain name, the address of the owner of the domain name, the IP address range to which the domain name belongs on the network, and contact information for the owner of the domain name; information about the owner of the IP address, including the name and address of the owner of the IP address; the name of the computer network range; the location corresponding to the IP address range, including the country and city; contact information for an administrator; information about the IP address to which the scanned object belongs; information about a public key certificate issued for the domain name; file hashes and file paths; a URL containing a domain name and one of the following URI information: a page address, page load parameters, and other components of the URI information.

[0144] In another particular aspect, at step 620, method 600 further classifies the unclassified domain name object as authentic if the number of requests received from the domain name system exceeds a predetermined threshold.

[0145] In step 630 , the method 600 extracts at least one subgraph including objects of the same type and containing at least one unclassified object from the generated association graph by the analyzer 240 based on at least one of: group association analysis between objects; and sequential association analysis between objects.

[0146] In one particular aspect, each of these analysis methods is performed using at least one machine learning model trained by "decision tree boosting."

[0147] In one particular aspect, the sequential analysis uses at least one adjacent malicious object and information about at least three associated objects; and the group-based analysis uses information about at least four objects, three of which are associated with a fourth object.

[0148] In step 640, method 600 classifies each unclassified object in each subgraph based on analyzing the object using the classification rule by analyzer 240. In a special case, the implementation of the classification rule includes at least one of the following methods: object analysis using a machine learning model and object similarity analysis implemented using the Levenshtein metric.

[0149] In step 650, method 600 limits access to objects classified as malicious to prevent the spread of malicious activity. In one aspect, limiting access is performed by one of: blocking access to a website associated with the object; opening the website associated with the object in a browser running in protected mode; pausing conversion to the website and notifying the user that the website is associated with a malicious object.

[0150] Therefore, the above-described system and method solve the following technical problem: Create a method for classifying objects into malicious objects and trusted objects to prevent the spread of malicious activities.

[0151] Figure 7 is a block diagram illustrating a computer system 20 on which aspects of the system and method for classifying objects to prevent the spread of malicious activity may be implemented. The computer system 20 may be in the form of multiple computing devices or in the form of a single computing device, such as a desktop computer, a laptop, a handheld computer, a mobile computing device, a smartphone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.

[0152] As shown, computer system 20 includes a central processing unit (CPU) 21, a system memory 22, and a system bus 23 connecting various system components, including a memory associated with central processing unit 21. System bus 23 may include a bus memory or a bus memory controller, a peripheral bus, and a local bus capable of interacting with any other bus architecture. Examples of buses may include PCI, ISA, PCI-Express, HyperTransport, and the like. TM (HyperTransport TM ), unlimited bandwidth TM (InfiniBand TM ), Serial ATA, I 2 C, and other suitable interconnections. The central processing unit 21 (also referred to as a processor) may include a single group or multiple groups of processors having a single core or multiple cores. The processor 21 may execute one or more computer executable codes that implement the technology of the present invention. The system memory 22 may be any memory for storing data used herein and / or computer programs executable by the processor 21. The system memory 22 may include volatile memory (such as random access memory (Random Access Memory, RAM) 25) and non-volatile memory (such as read-only memory (Read-Only Memory, ROM) 24, flash memory, etc.) or any combination thereof. The basic input / output system (Basic Input / Output System, BIOS) 26 may store basic programs for transmitting information between elements of the computer system 20, such as those basic programs when the operating system is loaded using ROM 24.

[0153] The computer system 20 may include one or more storage devices, such as one or more removable storage devices 27, one or more non-removable storage devices 28, or a combination thereof. The one or more removable storage devices 27 and the one or more non-removable storage devices 28 are connected to the system bus 23 via a storage device interface 32. In one aspect, the storage devices and corresponding computer-readable storage media are power-independent modules for storing computer instructions, data structures, program modules, and other data of the computer system 20. The system memory 22, the removable storage devices 27, and the non-removable storage devices 28 may use a variety of computer-readable storage media. Examples of computer-readable storage media include: machine memory, such as cache, SRAM, DRAM, zero-capacitor RAM, two-transistor RAM, eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM, RRAM, SONOS, PRAM; flash memory or other storage technology, such as in a Solid State Drive (SSD) or a flash drive; magnetic cassettes, tapes, and disk storage, such as in a hard drive or floppy disk; optical storage, such as in a compact disk (CD-ROM) or a digital versatile disk (DVD); and any other medium that can be used to store the desired data and can be accessed by the computer system 20.

[0154] The system memory 22, removable storage device 27 and non-removable storage device 28 of computer system 20 can be used to store operating system 35, additional application programs 37, other program modules 38 and program data 39. Computer system 20 may include a peripheral interface 46 for transmitting data from input device 40, such as a keyboard, mouse, stylus, game controller, voice input device, touch input device, or other peripheral devices, such as a printer or scanner via one or more I / O ports, such as a serial port, parallel port, Universal Serial Bus (USB), or other peripheral interfaces. Display device 47 (such as one or more monitors, projectors or integrated displays) can also be connected to system bus 23 via output interface 48 (such as a video adapter). In addition to display device 47, computer system 20 can also be equipped with other peripheral output devices (not shown), such as speakers and other audio-visual devices.

[0155] The computer system 20 can work in a network environment using a network connection with one or more remote computers 49. The one or more remote computers 49 can be local computer workstations or servers, which include most or all of the elements described above in describing the properties of the computer system 20. Other devices can also be present in the computer network, such as but not limited to routers, network sites, peer devices or other network nodes. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating with the remote computer 49 through one or more networks, such as a computer local area network (LAN) 50, a computer wide area network (WAN), an intranet, and the Internet. Examples of the network interface 51 may include an Ethernet interface, a frame relay interface, a SONET (synchronous optical network) interface, and a wireless interface.

[0156] Various aspects of the present invention may be systems, methods and / or computer program products. The computer program products may include one or more computer-readable storage media having computer-readable program instructions for causing a processor to perform various aspects of the present invention.

[0157] Computer readable storage medium can be a tangible device, and this tangible device can keep and store the program code of the form of instruction or data structure, and this program code can be accessed by the processor of computing device (such as computer system 20).Computer readable storage medium can be electronic storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or its any suitable combination.As an example, this type of computer readable storage medium can include random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), portable optical disc read-only memory (CD-ROM), digital versatile disc (DVD), flash memory, hard disk, portable computer disk, memory stick, floppy disk or even mechanical coding device, such as punch card or convex structure in the groove of recording instruction thereon.As used in this article, computer readable storage medium should not be regarded as temporary signal itself, temporary signal such as radio wave or other free propagation electromagnetic wave, electromagnetic wave propagated by waveguide or transmission medium or electric signal transmitted by wire.

[0158] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network interface in each computing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the corresponding computing device.

[0159] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (Instruction-Set-Architecture, ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages ​​and traditional programmed programming languages).Computer-readable program instructions (as independent software packages) can be performed completely on the user's computer, partly on the user's computer, partly on the user's computer and partly on a remote computer or completely on a remote computer or server.In the latter case, the remote computer can be connected to the user's computer through any type of network (including LAN or WAN), or can be connected to an external computer (for example, through the Internet).In some respects, electronic circuits (including for example programmable logic circuits, field programmable gate arrays (FPGAs) or programmable logic arrays (Programmable Logic Arrays, PLAs)) can be performed by utilizing the state information of computer-readable program instructions to personalize the electronic circuit, thereby performing various aspects of the present invention.

[0160] In various aspects, the systems and methods described in the present invention can be processed in modules. The term "module" as used herein refers to, for example, a real-world device, component, or arrangement of components implemented using hardware (e.g., by an application-specific integrated circuit (ASIC) or FPGA), or to a combination of hardware and software, such as a microprocessor system and an instruction set that implements the module's functionality (the instruction set converts the microprocessor system into a dedicated device when executed). A module can also be implemented as a combination of two modules, in which certain functions are facilitated by hardware alone, and other functions are facilitated by a combination of hardware and software. In some implementations, at least a portion of a module (and in some cases, all of a module) can be implemented in a computer system (e.g., the above Figure 7 Therefore, each module can be implemented in various suitable configurations and should not be limited to any specific implementation illustrated in this article.

[0161] For the sake of clarity, not all routine features of various aspects are disclosed herein. It should be appreciated that in the development of any practical implementation of the present invention, many specific implementation decisions must be made in order to achieve the developer's specific goals, and these specific goals will vary for different implementations and different developers. It should be understood that such development efforts can be complex and time-consuming, but are still a routine task of engineering for those of ordinary skill in the art who understand the advantages of the present invention.

[0162] In addition, it should be understood that the words or terms used herein are for the purpose of description rather than limitation, so the terms or terms of this specification should be interpreted by those skilled in the art according to the teachings and guidance provided herein in combination with the knowledge of (one or more) relevant technical personnel. In addition, it is not intended to attribute any term in this specification or claims to an uncommon or special meaning unless explicitly stated as such.

[0163] The various aspects disclosed herein include the present and future known equivalents of the known modules cited herein in an illustrative manner. In addition, although various aspects and applications have been shown and described, it will be apparent to those skilled in the art who understand the advantages of the present invention that more modifications than those mentioned above are feasible without departing from the inventive concept disclosed herein.< / pageaddress> < / port> < / host> < / schema>

Claims

1. A method for classifying objects to prevent the spread of malicious activities, the method comprising: Searching the network for objects that have common information with other objects and collecting information about the objects; generating an association graph comprising classified objects and unclassified objects in the form of vertices, whereby associations between objects indicate the presence of common information between the objects, wherein the classified objects include malicious objects; Extracting at least one subgraph including objects of the same type and containing at least one unclassified object from the generated association graph based on at least one of a group association analysis between objects and a sequential association analysis between objects; classifying each unclassified object in each subgraph based on analyzing the object using a classification rule; as well as Limit access to objects classified as malicious to prevent malicious activity from spreading.

2. The method according to claim 1, wherein: The other objects include objects classified as malicious or objects having common information with the objects classified as malicious.

3. The method according to claim 1, wherein: The classification rules include at least one of: similarity analysis and object analysis using a machine learning model.

4. The method according to claim 3, wherein: The similarity analysis was performed using the Levenshtein metric.

5. The method according to claim 1, wherein: The association graph only contains associations between objects of different types.

6. The method according to claim 1, wherein: The object and the information of the object are at least two of the following types of information: Internet Protocol (IP) address; Fully qualified domain name (FQDN); Universal Resource Identifier (URI) information; Domain name data, including information about domain name registrars; Information about the owner of the domain name, including the name of the owner of the domain name, the address of the owner of the domain name, the IP address range to which the domain name belongs on the network, and contact information of the owner of the domain name; Information about the owner of the IP address, including the name and address of the owner of the IP address; The name of the computer network range; The location corresponding to the IP address range, including country and city; The administrator’s contact information; Information about the IP address to which the object belongs; information about the public key certificate issued for the domain name; File hash and file path; as well as The URL containing the domain name.

7. The method according to claim 6, wherein: The URI information includes at least a page address and page loading parameters.

8. The method according to claim 1, wherein: Generating the association graph including the classified objects and the unclassified objects in the form of vertices further includes classifying the unclassified object, which is the domain name, as authentic if the number of requests received from the domain name system exceeds a predetermined threshold.

9. The method according to claim 1, wherein: At least one subgraph extracts an associated component containing information about associated objects, wherein at least one of the objects is unclassified.

10. The method according to claim 1, wherein: Each analysis is performed by at least one machine learning model.

11. The method according to claim 10, wherein: The machine learning model is trained by using a boosted decision tree.

12. The method according to claim 1, wherein: The sequential association analysis uses at least one adjacent malicious object.

13. The method according to claim 1, wherein: The sequential association analysis between the objects uses information on at least three objects having an association.

14. The method according to claim 1, wherein: The group association analysis between the objects uses information about at least four objects, three of which have an association with a fourth object.

15. The method according to claim 1, wherein: Access to objects classified as malicious is restricted to prevent the spread of malicious activity by one of the following means: blocking access to a website associated with the object; opening the website associated with the object in a browser running in protected mode; and pausing transitions to the website and notifying a user that the website is associated with a malicious object.

16. A system for classifying objects to prevent the spread of malicious activity, comprising: at least one memory; as well as at least one hardware processor coupled to the at least one memory and configured, alone or in combination, to: Searching the network for objects that have common information with other objects and collecting information about the objects; generating an association graph comprising classified objects and unclassified objects in the form of vertices, whereby associations between objects indicate the presence of common information between the objects, wherein the classified objects include malicious objects; Extracting at least one subgraph including objects of the same type and containing at least one unclassified object from the generated association graph based on at least one of a group association analysis between objects and a sequential association analysis between objects; classifying each unclassified object in each subgraph based on analyzing the object using a classification rule; as well as Limit access to objects classified as malicious to prevent malicious activity from spreading.

17. The system of claim 16, wherein: The other objects include objects classified as malicious or objects having common information with the objects classified as malicious.

18. The system of claim 16, wherein: The classification rules include at least one of: similarity analysis and object analysis using a machine learning model.

19. The system of claim 18, wherein: The similarity analysis was performed using the Levenshtein metric.

20. A non-transitory computer-readable medium having stored thereon computer-executable instructions for classifying an object to prevent the spread of malicious activity, the computer-executable instructions comprising instructions for: Searching the network for objects that have common information with other objects and collecting information about the objects; Generate an association graph including classified objects and unclassified objects in the form of vertices, whereby associations between objects indicate that common information exists between the objects, wherein The classified objects include malicious objects; Extracting at least one subgraph including objects of the same type and containing at least one unclassified object from the generated association graph based on at least one of a group association analysis between objects and a sequential association analysis between objects; classifying each unclassified object in each subgraph based on analyzing the object using a classification rule; as well as Limit access to objects classified as malicious to prevent malicious activity from spreading.

Images