METHOD AND SYSTEM FOR CORRELATING COMPUTER FILES, PARTICULARLY FOR DETECTING MALICIOUS COMPUTER FILES

Abstract

METHOD AND SYSTEM FOR CORRELATING COMPUTER FILES, IN PARTICULAR FOR DETECTING MALICIOUS COMPUTER FILES. The invention relates to a method for correlating an analyzed file (102) with a database (104) of files, characterized in that it comprises a step (112) of training a machine learning model (106) configured to obtain a set of characteristic functions associated with a file, a step (114) of determining the basic functions of the analyzed file (102), a step (116) of vectorizing the analyzed file (102) to obtain a set of vectors, each associated with at least one basic function of the analyzed file (102), and a step (118) of processing the vectors of the set of vectors by the machine learning model to associate a characteristic function with each vector.a step (120) of comparing the set of characteristic functions associated with each vector with a database (108) of characteristic functions, a step (122) of correlation between the analyzed file and the files in the database. Figure for the abbreviation: Figure 1,

Description

Title of the invention: METHOD AND SYSTEM FOR CORRELATING COMPUTER FILES, IN PARTICULAR FOR DETECTING MALICIOUS COMPUTER FILE Technical field of the invention

[0001] The invention relates to a method and a system for correlating a computer file with a database of computer files. In particular, the invention relates to a method and a system for rapidly processing a computer file to establish its degree of correlation with other computer files, preferably to establish a probability that the computer file is a malicious computer file or contains a portion of a malicious computer file. Technological background

[0002] The invention relates to the field of computer file processing for determining the functional characteristics of these files, in particular for correlating a file with a plurality of files stored in a database, said database preferably containing malicious computer files. The invention therefore also relates to the field of antivirus analysis methods and antivirus systems, in particular static analysis antivirus systems designed to establish the probability of a threat based on the file itself, its characteristics and functions, without requiring its execution.

[0003] A computer file is defined as a computer file comprising computer code, such computer code being, for example, raw code, interpreted code (such as a script), or compiled code, so as to form an executable computer file, for example, an executable computer file of type PE (Portable Executable) or ELF (Executable and Linkable Format). A computer file may also include additional computer data such as media data (image, sound, video) encoded within the computer file.

[0004] Current computer security solutions are limited in their ability to detect new variants of malicious computer files that have been modified to evade antivirus and other detection mechanisms. Attackers using such malicious computer files intentionally modify compilation options and code strings to avoid being detected. Traditional static analysis methods, which examine metadata and strings, are not sensitive enough to changes made to code during compilation. The challenge lies in effectively detecting threats that are unknown or have been cleverly modified to evade detection. Most current solutions, such as antivirus software, often rely on signatures of known malicious files to detect threats. This means they may not be effective against new variants of malicious files that have been meticulously modified to evade these signatures, which is a significant limitation.

[0005] Furthermore, reverse engineering software is generally used to disassemble code for in-depth analysis, but these tools also struggle to handle code modifications made by compilers. Developing reverse engineering solutions with greater tolerance for code modifications is necessary to improve application security. This improvement helps reduce risks and threats by quickly identifying vulnerabilities and flaws in computer files.

[0006] Cybercriminals are quick to adapt their methods and malicious code in response to new detection techniques. Therefore, even if a new detection method is developed, it can quickly become obsolete when attackers change their approaches.

[0007] The inventors therefore sought to provide a solution to overcome these drawbacks, and in particular to provide a method and system for correlating computer files that is particularly effective for detecting malicious computer files. Objectives of the invention

[0008] The invention aims to provide a system and method for correlating computer files, preferably enabling the detection of files including a malicious computer file.

[0009] The invention aims in particular to provide, in at least one embodiment, a system and a method of correlation enabling adaptation to frequent changes in the source code and / or compilation options of malicious computer files.

[0010] The invention aims in particular to provide, in at least one embodiment, a system and a method of correlation enabling the provision of a reliable and rapid result.

[0011] The invention aims in particular to provide, in at least one embodiment, a system and a correlation method enabling the determination of a family of computer files from which the analyzed computer file is derived.

[0012] The invention aims in particular to provide, in at least one embodiment, a system and a method of correlation enabling the reduction of the number of false positives and false negatives in the estimation of the correlation, in particular in the classification of the analyzed file as a malicious computer file.

[0013] The invention aims in particular to provide, in at least one embodiment, a computer program correlation product implementing at least part of the steps of the correlation process according to the invention and / or executed in a correlation system according to the invention. Description of the invention

[0014] To this end, the invention relates to a method of correlation between a computer file, referred to as the analyzed file, and at least one computer file in a database of files,

[0015] characterized in that it comprises: - a preliminary step of training a machine learning model from a dataset comprising a plurality of computer files, the learning model being configured to obtain, from a pre-processed computer file, a set of characteristic functions associated with said file, - a step to determine the basic functions of the analyzed file, - a vectorization step of the analyzed file, configured to obtain a set of vectors, each vector being associated with one or more basic functions of the analyzed file and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s), - a step of processing the vectors of the set of vectors by the trained machine learning model, so as to associate a characteristic function with each vector, - a step of comparing all the characteristic functions associated with each vector with a database of characteristic functions, said database of characteristic functions being generated beforehand by processing the files of the file database by the machine learning model, - a correlation step between the analyzed file and one or more files in the file database, and the provision of data representative of the correlation between the analyzed file and one or more files in the file database

[0016] A correlation method according to the invention thus makes it possible to establish the correlation between an analyzed file and a plurality of computer files by determining the characteristic functions of the analyzed file on the one hand and the characteristic functions of the computer files on the other. The use of these characteristic functions allows for rapid processing by comparison of all the characteristic functions associated with each vector.

[0017] Vectors are associated with basic functions that are determined from the analyzed or disassembled file, or even, in some cases, determined during disassembly by the disassembly software. A basic function is a set of expressions and / or instructions that provide continuity in the code or execution flow, for example, that allows a feature to be implemented. Basic functions generally include one or more basic blocks if the analyzed file is an executable file. Vectors result from exhaustive statistical processing to extract the features and signatures of these basic functions, the results of which are then compiled into vectors.Each vector is associated with one or more basis functions, for example a main basis function and associated basis functions, such as basis functions called by the main basis function and allowing context to be added to this main basis function.

[0018] Correlation represents a proximity, or similarity, between the analyzed file and one or more files in the database. Two computer files are assumed to be correlated when they contain similarities. The correlation is stronger the greater the number of common or similar characteristic functions, which may indicate that code, a portion of code, or the use of a library or set of libraries is shared between the analyzed file and the database file(s). This correlation with respect to characteristic functions makes it possible to bypass minor code changes that escape a textual comparison in the prior art.The analyzed files are therefore not reduced to their source codes but to the characteristic functions that can be implemented, that is to say, code linked to a concept, or concept-code, implemented in the computer file regardless of its implementation, its implementation algorithm, its programming language, etc. These similarities may be due to shared common code, the fact that the computer files were developed by the same team, etc.

[0019] The processing time of the analyzed file is significantly reduced compared to prior art systems. The generation of the characteristic function database is performed upstream and therefore does not affect the processing time of the analyzed file. The generation of characteristic functions for the analyzed file is Fast because it is limited to this single file. Finally, comparing the characteristic functions of the analyzed file with the characteristic function database is an optimized processing operation that can be performed quickly even with a large characteristic function database (several billion characteristic functions). These file analysis operations can therefore be implemented by a standard computer, or even an embedded system, without requiring a supercomputer.

[0020] The characteristic functions as determined by the learning model are key functions that allow for a very precise classification regarding their proximity to other files, in particular allowing for the determination of their malicious nature. Characteristic functions are elements of computer files that can be found from one computer file to another without any constraints on the implementation and the programming language used to create the computer file.Thus, an analyzed computer file containing a variant of another computer file will have common characteristic functions with that computer file from which it derives if the latter has a similar behavior when interpreted or executed from compiled code, even if the implementation algorithm has been modified to escape classic antivirus software, if the programming language is different, if obfuscation techniques have been implemented, etc.

[0021] The machine learning model, more commonly known as the machine learning model in English, and in particular a deep learning model.

[0022] Advantageously and according to the invention, the correlation process includes a step of disassembling the analyzed file by a disassembler if the analyzed file is an executable computer file, to obtain a file disassembled into machine instructions, and in that the correlation process applies the steps of determining the basic functions and vectorization to the disassembled file

[0023] Advantageously and according to the invention, at least one file in the dataset and at least one file in the file database are malicious computer files, and in that the correlation step provides data indicating a probability that the analyzed file is a malicious computer file.

[0024] According to this aspect of the invention, the correlation method makes it possible to detect a malicious computer file by correlating the analyzed computer file with a database of malicious files. In particular, the correlation makes it possible to associate the analyzed file with one or more malicious computer files forming a family of malicious computer files because they share a common design and / or functionalities.

[0025] The use of characteristic functions thus makes it possible to thwart the usual methods of modifying malicious computer files to avoid their detection by conventional antivirus software.

[0026] Advantageously and according to the invention, at least one file in the dataset and at least one file in the file database are malicious computer files implementing at least one feature that is likely to be undesirable, and in that the correlation step provides data indicating a probability that the analyzed file is a malicious computer file.

[0027] According to this aspect of the invention, the correlation method makes it possible to detect a malicious computer file, that is to say, a computer file containing functions that may be undesirable, generally unwanted and / or hidden, such as, for example, unwanted data transmission to a central server, the installation of unwanted features on the workstation, or taking control of the workstation, without being considered malware in the common sense. Examples of such malicious computer files include, for example, spyware, ad tracking software, etc., among software containing undesirable functions., or also software whose features may be considered undesirable if they are not controlled by the administrator of the workstation or the computer network on which the workstation depends, such as computer network management software, remote access software, etc.

[0028] Advantageously and according to the invention, at least one file of the dataset and at least one file of the file database are computer files comprising different versions of the same software library, and in that the correlation step provides data indicating a probability that the analyzed file implements one of the versions of one of the software libraries.

[0029] According to this aspect of the invention, the correlation method makes it possible to detect the different versions of libraries implemented in the analyzed computer file, particularly when the latter is a compiled executable computer file, and to indicate whether a version of an implemented library contains a known vulnerability. If so, the correlation method can suggest implementing a more recent library in which the vulnerability has been corrected.

[0030] Advantageously and according to the invention, the vectors of the set of vectors comprise characteristic values ​​from among at least one or more of the following characteristic values: number of basic blocks of the basic function(s), number of instructions of the basic function(s), - number of procedure calls among the instructions of the basic function(s), - statistical values ​​on the graph of the basic blocks of the basic function(s), - number, position and statistical distribution of one or more types of particular instructions among the instructions of the basic function(s), - architecture of the analyzed file.

[0031] According to this aspect of the invention, the vectors allow a global and quantifiable definition of intrinsic characteristics of the basic functions, allowing their characterization in a simplified way.

[0032] Advantageously and according to the invention, the correlation method includes a preliminary step of generating the database of characteristic functions, comprising: - a step involving the retrieval of computer files from public or private databases stored on a remote server, - a step involving the retrieval of metadata associated with one or more of the retrieved computer files, - a step involving filtering computer files, - a step of labeling the filtered computer files, including a sub-step of adding metadata to each computer file and a sub-step of classification by applying classification rules, - a vectorization step of the labeled file, configured to obtain a second set of vectors, each vector being associated with one or more basic functions of the labeled file and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s), - a step of processing the vectors of the second set of vectors by the machine learning model, so as to associate a characteristic function with each vector, - a step of generating the database of characteristic functions from the characteristic functions associated with each vector of each tagged file

[0033] According to this aspect of the invention, the database is pre-established to allow for rapid processing of the analyzed file. The database generation can be updated regularly by adding new relevant files, in particular new malicious computer files as part of a correlation with malicious computer files.

[0034] Advantageously and according to the invention, the correlation method comprises a step of generating a correlation report, said correlation report comprising at least one of the following pieces of information: - list of computer files whose correlation with the analyzed file reaches a certain threshold - correlation score with each computer file in said list, - number and characteristics of the common characteristic functions shared with each computer file in the list, - family or families of malicious computer files with which the analyzed file shows a strong correlation - information on said malicious computer file family(ies), - relevant sample from the analyzed file in determining the correlation, - distribution of characteristic functions according to their generic, legitimate or malicious quality, - distribution of the addressing of the analyzed file in correspondence with a computer file in the list.

[0035] The invention also relates to a method for training a machine learning model for a correlation method according to the invention, characterized in that it comprises the following steps: - a step involving receiving a training dataset comprising computer files, - a step of tuning the optimal hyperparameters of the machine learning model, - a training stage for the machine learning model using an initial portion of the dataset, - a validation step of the learning model using a second part of the dataset

[0036] The invention also relates to a computer program product for correlation between a computer file, said analyzed file, with at least one computer file from a database of files, said computer program product comprising program code instructions for the execution, when said computer program product is executed on a computer, of the steps according to the correlation method according to the invention.

[0037] The invention also relates to a correlation system between a computer file, referred to as the analyzed file, and at least one computer file in a file database,

[0038] characterized in that it comprises: - a training module for a machine learning model using a dataset comprising a plurality of computer files, the learning model being configured to obtain, from a pre-processed computer file, a set of characteristic functions associated with said file, - a module for determining the basic functions of the analyzed file, - a vectorization module for the analyzed file, configured to obtain a set of vectors, each vector being associated with one or more basic functions of the analyzed file and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s), - a module for processing the vectors of the set of vectors by the trained machine learning model, so as to associate a characteristic function with each vector, - a module for comparing all the characteristic functions associated with each vector with a database of characteristic functions, said database of characteristic functions being generated beforehand by processing the files in the database of files by the machine learning model, - a correlation module between the analyzed file and one or more files in the file database, and providing data representative of the correlation between the analyzed file and one or more files in the file database.

[0039] Throughout the text, a module may, for example, consist of a computing device such as a computer, a set of computing devices, an electronic component or a set of electronic components, or, for example, a computer program, a set of computer programs, a computer program library or a computer program function executed by a computing device such as a computer, a set of computing devices, an electronic component or a set of electronic components.

[0040] Advantageously and according to the invention, the correlation system includes a disassembler configured to obtain a disassembled file into machine instructions from the analyzed file if the analyzed file is an executable computer file, the basic function determination module and the vectorization module being configured to process the disassembled file.

[0041] Advantageously and according to the invention, at least one file in the dataset and at least one file in the file database are malicious computer files, and in that the correlation module is configured to provide data indicating a probability that the analyzed file is a malicious computer file.

[0042] Advantageously and according to the invention, at least one file in the dataset and at least one file in the file database are unhealthy computer files implementing at least one feature that is likely to be undesirable, and in that the correlation module provides data indicating a probability that the analyzed file is an unhealthy computer file.

[0043] Advantageously and according to the invention, at least one file of the dataset and at least one file of the file database are computer files comprising different versions of the same software library, and in that the correlation module provides data indicating a probability that the analyzed file implements one of the versions of one of the software libraries.

[0044] Advantageously and according to the invention, the correlation system comprises a module for receiving the analyzed file sent by a remote computer for determining a correlation between the analyzed file and at least one computer file from a file database, and a module for sending a correlation report to said remote computer.

[0045] According to this aspect of the invention, the system forms a remote system capable of receiving computer files to be analyzed, thus providing a remote service, for example, accessible on the Internet, in particular via a Web service allowing the uploading of the file to be analyzed and the receipt of a correlation report, either directly on a Web page, or by sending a computer file containing the report data, or both, or other means of transmitting the report.

[0046] The invention also relates to a correlation method, a training method, a correlation system and a correlation computer program product characterized in combination by all or part of the characteristics mentioned above or below. List of figures

[0047] Other objects, features and advantages of the invention will become apparent from the following description, given by way of non-limiting example only, and which refers to the accompanying figures in which: • [Fig. 1] is a schematic view representing a correlation process according to one embodiment of the invention, • [Fig.2] is a schematic view representing a correlation ratio according to an embodiment of the invention.

[0048] Detailed description of an embodiment of the invention

[0049] In the figures, the scales and proportions are not strictly respected for the purposes of illustration and clarity.

[0050] Identical, similar or analogous elements are designated by the same references in all figures.

[0051] Fig. 1 schematically represents a correlation method according to an embodiment of the invention.

[0052] The process 100 allows the correlation between a computer file, called the analyzed file 102, with at least one computer file from a database 104 of file data.

[0053] If the analyzed file is an executable file, the correlation process 100 includes a step 110 of disassembling the analyzed file using a disassembler, to obtain a disassembled file into machine instructions. The disassembler could, for example, be the IDA Pro disassembler.

[0054] The correlation method 100 also includes a prior step 112 of training a machine learning model 106 from a dataset comprising a plurality of computer files, the learning model being configured to obtain, from a pre-processed computer file, a set of characteristic functions associated with said file.

[0055] The machine learning model 106 is preferably a deep learning model, such as a neural network. The neural network may, in particular, be a recurrent neural network (RNN), especially a recurrent neural network with long-term memory (LSTM), or a transformer-type neural network. The machine learning model 106 is trained according to a training procedure comprising the following steps: - a step involving receiving a training dataset comprising computer files, - a step of tuning the optimal hyperparameters of the machine learning model, - a training stage for the machine learning model using an initial portion of the dataset, - a validation step of the learning model using a second part of the dataset.

[0056] The steps of optimal hyperparameter tuning (or optimal hyperparameter search), training, and validation are carried out in a conventional manner for a machine learning model, particularly a deep learning model, to implement the definition of characteristic functions. For example, Hyperparameter optimization can be performed using a BOHB-type optimization technique, as described in particular in the publication "Falkner, Stefan, Aaron Klein, and Frank Hutter. "BOHB: Robust and efficient hyperparameter optimization at scale." International Conference on Machine Learning. PMLR, 2018."

[0057] The training dataset can come from one or more data sources. For example, these data sources can be one or more of the following: - Linux distribution repositories, - open-source software repositories, in particular software whose license allows the processing of the source code, for example GitHub, - software package managers, for example Conan.io and Chocolatey, - proprietary software repositories whose data exploitation is authorized, for example, - specific computer file sources, in particular malicious computer file sources, for example Malware-Bazaar, VirusTotal, VX-Underground and VirusShare.

[0058] The dataset is preprocessed to maximize training results.

[0059] The correlation method 100 then includes a step 114 of determining the basic functions of the disassembled file (or of the analyzed file in embodiments where the analyzed file is not disassembled because it is not an executable file requiring disassembly). This step allows the instructions of the analyzed file to be grouped into basic functions. Basic functions are a set of expressions and / or instructions that provide continuity in the code or in the execution flow, for example, that allow a feature to be implemented. When the analyzed file is source code, a basic function is, for example, a function consisting of a portion of code and capable of being called during the execution or interpretation of the analyzed file. When the analyzed file is an executable file, a basic function comprises one or more basic blocks.The grouping of several basic blocks to form a function is, for example, determined by the disassembler during the disassembly of the analyzed file when it is compiled.

[0060] The correlation method 100 then includes a step 116 of vectorizing the disassembled file (or the analyzed file if it is not disassembled), configured to obtain a set of vectors, each vector being associated with one or more basic functions of the analyzed file and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s). These vectors function as statistical and exhaustive descriptions of the basic functions. The characteristics taken into account are, for example: - number of basic blocks of the basic function(s), - number of instructions in the basic function(s), - number of procedure calls among the instructions of the basic function(s), - statistical values ​​on the graph of the basic blocks of the basic function(s), - number, position and statistical distribution of one or more types of particular instructions among the instructions of the basic function(s), - architecture of the analyzed file.

[0061] These characteristics are derived from statistical and exhaustive processing of the analyzed file.

[0062] The correlation method 100 then includes a step 118 of processing the vectors of the set of vectors by the trained machine learning model 116, so as to associate a characteristic function with each vector. This processing step 118 may include a substep of taking into account the proximity of vectors, for example by defining groups of nearby vectors submitted to the learning model, in order to add meaning to the vectors when they represent geographically close basic functions in the execution or interpretation of the analyzed file.

[0063] Characteristic functions allow the computer file to be conceptualized in terms of its intrinsic functions, without taking into account the implementation algorithm used or the programming language used. Characteristic functions are not necessarily representative of a known mathematical function or algorithm and are not intended to describe the computer file in such a way that these functions are directly interpretable by a human operator, but rather are intended to be compared with a database of characteristic functions to estimate the correlation with other computer files.

[0064] The correlation method 100 then includes a step 120 of comparing the set of characteristic functions associated with each vector with a database 108 of characteristic functions, said database 108 of characteristic functions being generated beforehand by processing the files of the database of files by the machine learning model.

[0065] For the establishment of the database, the correlation method 100 includes a preliminary step 124 of generating the database of characteristic functions, comprising firstly a step of retrieving computer files from public or private databases stored on a remote server.

[0066] For example, these databases may be one or more of the following: - Linux distribution repositories, - open-source software repositories, in particular software whose license allows the processing of the source code, for example GitHub, - software package managers, for example Conan.io and Chocolatey, - proprietary software repositories whose data exploitation is authorized, for example, - specific computer file sources, in particular malicious computer file sources, for example Malware-Bazaar, VirusTotal, VX-Underground and VirusShare.

[0067] These databases are the same types of data sources used during the training of the machine learning model, but the databases are regularly consulted to retrieve computer files in order to have the most recent computer files for establishing regular updates to the feature function database. During the implementation of the correlation process for detecting malicious computer files, this frequent and regular updating makes it possible, in particular, to have the latest versions of malware available, enabling a rapid response for protection against new threats. The preliminary step 124 of generating the feature function database can thus be performed periodically for regular updating of the feature functions.

[0068] The preliminary step 124 of generating the database of characteristic functions also includes a step of retrieving metadata associated with one or more of said retrieved computer files and a step of filtering the computer files.

[0069] The preliminary step 124 of generating the database of characteristic functions then includes a step of labeling the filtered computer files, comprising a substep of adding metadata to each computer file and a substep of classification by applying classification rules. The classification rules are, for example, YARA-type rules for classifying malicious computer files.

[0070] The preliminary step 124 of generating the database of characteristic functions then includes a step of vectorizing the labeled file, configured to obtain a second set of vectors, each vector being associated with one or more basic functions of the labeled file and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s), and a step of processing the vectors of the second set of vectors by the machine learning model, so as to associate a characteristic function with each vector. These vectorization and vector processing steps to obtain the characteristic functions are analogous to the vectorization and vector processing steps of correlation method 100.

[0071] The preliminary step 124 of generating the database of characteristic functions finally includes a step of generating the database of characteristic functions from the characteristic functions associated with each vector of each labeled file.

[0072] The correlation method 100 then includes a correlation step 122 between the analyzed file and one or more files in the file database, and the provision of data representative of the correlation between the analyzed file and one or more files in the file database. This correlation step 122 makes it possible to determine the characteristic functions found in the analyzed file that allow it to be matched with a computer file in the database.

[0073] In particular: - If at least one file in the dataset and at least one file in the file database are malicious, the correlation step can provide data indicating the probability that the analyzed file is malicious. The correlation process can then be used as an antivirus method to determine whether the analyzed file is malicious. - If at least one file in the dataset and at least one file in the file database are malicious files implementing at least one potentially undesirable feature, the correlation step can provide data indicating the probability that the analyzed file is malicious. The correlation process can then be used as an anti-espionage or anti-tracking method to determine whether the analyzed file is malicious. - If at least one file in the dataset and at least one file in the file database are computer files containing different versions of the same software library, the correlation step can provide data indicating the probability that the analyzed file implements one version of one of the software libraries. The correlation process can then be used as a vulnerability detector, for example, when a computer file uses a library that has not been updated recently and contains vulnerabilities.

[0074] The correlation process can also determine whether an analyzed file is malicious, unhealthy, vulnerable, or none of these cases.

[0075] The correlation method 100 may also include a step of generating a correlation report, in particular in the correlation step 122.

[0076] Figure 2 represents an embodiment of such a correlation report, as it can be displayed in a software window within a computer operating system, for example, dedicated software or a web browser. Figure 2 specifically represents a correlation report showing the correlation of the analyzed file with a malicious computer file, with a particular focus on the match with virus 1 (a malicious file from the computer file database).

[0077] Report 200 includes, for example, at least one of the following pieces of information: - list 204 of computer files whose correlation with the analyzed file reaches a certain threshold, - a correlation score of 206 with each computer file in said list, - number and characteristics 208 of the common characteristic functions with each computer file in the list, graphic - family 210 or families of malicious computer files with which the analyzed file shows a strong correlation, - information 212 on the said malicious computer file family(ies), - relevant sample from the analyzed file in determining the correlation, - distribution 214 of characteristic functions according to their generic, legitimate or malicious quality, - distribution 216 of the addressing of the analyzed file in correspondence with a computer file in the list.

Claims

Demands

1. A method for correlating a computer file, called the analyzed file (102), with at least one computer file from a database (104) of files, characterized in that it comprises: - a preliminary step (112) of training a machine learning model (106) from a dataset comprising a plurality of computer files, the learning model being configured to obtain, from a preprocessed computer file, a set of characteristic functions associated with said file, - a step (114) of determining the basic functions of the analyzed file (102), - a step (116) of vectorizing the analyzed file (102), configured to obtain a set of vectors,each vector being associated with one or more basic functions of the analyzed file (102) and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s), - a step (118) of processing the vectors of the set of vectors by the trained machine learning model, so as to associate a characteristic function with each vector, - a step (120) of comparing the set of characteristic functions associated with each vector with a database (108) of characteristic functions, said database (108) of characteristic functions being generated beforehand by processing the files of the file database by the machine learning model, - a step (122) of correlation between the analyzed file and one or more files of the file database,and the provision of data representative of the correlation between the analyzed file (102) and one or more files in the file database (104).

2. A correlation method according to claim 1, characterized in that it comprises a step (110) of disassembling the analyzed file (102) by a disassembler if the analyzed file (102) is an executable computer file, to obtain a file disassembled into machine instructions, and in that the correlation method applies the steps of determining the basic functions and vectorizing to the disassembled file.

3. A correlation method according to any one of claims 1 or 2, characterized in that at least one file in the dataset and at least one file in the file database (104) are malicious computer files, and in that the correlation step (122) provides data indicating a probability that the analyzed file is a malicious computer file.

4. A correlation method according to any one of claims 1 to 3, characterized in that at least one file in the dataset and at least one file in the file database (104) are malicious computer files implementing at least one feature that is likely to be undesirable, and in that the correlation step (122) provides data indicating a probability that the analyzed file is a malicious computer file.

5. A correlation method according to any one of claims 1 to 4, characterized in that at least one file of the dataset and at least one file of the file database (104) are computer files comprising different versions of the same software library, and in that the correlation step (122) provides data indicating a probability that the analyzed file implements one of the versions of one of the software libraries.

6. Correlation method according to any one of claims 1 to 5, characterized in that the vectors of the set of vectors comprise characteristic values ​​among at least one or more of the following characteristic values: - number of basic blocks of the basic function(s), - number of instructions of the basic function(s), - number of procedure calls among the instructions of the basic function(s), - statistical values ​​on the graph of the basic blocks of the basic function(s), - number, position and statistical distribution of one or a plurality of particular instruction types among the instructions of the basic function(s), - architecture of the analyzed file.

7. A correlation method according to any one of claims 1 to 6, characterized in that it comprises a preliminary step (124) of generation of the characteristic function database, comprising: - a step of retrieving computer files from public or private databases stored on a remote server, - a step of retrieving metadata associated with one or more of said retrieved computer files, - a step of filtering the computer files, - a step of labeling the filtered computer files, comprising a sub-step of adding metadata to each computer file and a sub-step of classification by applying classification rules, - a step of vectorizing the labeled file, configured to obtain a second set of vectors, each vector being associated with one or more basic functions of the labeled file and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s),- a step of processing the vectors of the second set of vectors by the machine learning model, so as to associate a characteristic function with each vector, - a step of generating the database of characteristic functions from the characteristic functions associated with each vector of each labeled file.

8. A correlation method according to any one of claims 1 to 7, characterized in that it comprises a step of generating a correlation report (200), said correlation report comprising at least one of the following pieces of information: - a list (204) of computer files whose correlation with the analyzed file reaches a certain threshold, - a correlation score (206) with each computer file in said list, - the number and characteristics (208) of characteristic functions in common with each computer file in the list, - a family (210) or families of malicious computer files with which the analyzed file exhibits a strong correlation, - information (212) on said family or families of malicious computer files, - sample of the analyzed file relevant in determining the correlation, - distribution (214) of the characteristic functions according to their generic, legitimate or malicious quality, - distribution (216) of the addressing of the analyzed file in correspondence with a computer file from the list.

9. Method for training a machine learning model (116) for a correlation method according to any one of claims 1 to 8, characterized in that it comprises the following steps: - a step of receiving a training dataset comprising computer files, - a step of tuning optimum hyperparameters of the machine learning model, - a step of training the learning model from a first part of the dataset, - a step of validating the learning model from a second part of the dataset.

10. Computer program product for correlating a computer file, said analyzed file (102), with at least one computer file from a database (104) of files, said computer program product comprising program code instructions for executing, when said computer program product is executed on a computer, the steps of the correlation method (100) according to any one of claims 1 to 8.

11. A correlation system between a computer file, referred to as the analyzed file (102), and at least one computer file from a file database (104), characterized in that it comprises: - a training module for a machine learning model (116) from a dataset comprising a plurality of computer files, the training model being configured to obtain, from a preprocessed computer file, a set of characteristic functions associated with said file, - a module for determining the basic functions of the analyzed file, - a vectorization module for the analyzed file, configured to obtain a set of vectors, each vector being associated with one or more basic functions of the analyzed file and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s), - a vector processing module of the set of vectors by the trained machine learning model (116), so as to associate a characteristic function with each vector, - a comparison module of the set of characteristic functions associated with each vector with a database (108) of characteristic functions, said database of characteristic functions being generated beforehand by processing the files of the file database by the machine learning model, - a correlation module between the analyzed file (102) and one or more files of the file database, and of providing a data representative of the correlation between the analyzed file and one or more files of the file database.

12. Correlation system according to claim 11, characterized in that it comprises a disassembler configured to obtain a disassembled file into machine instructions from the analyzed file (102) if the analyzed file is an executable computer file, the basic function determination module and the vectorization module being configured to process the disassembled file.

13. Correlation system according to any one of claims 11 or 12, characterized in that at least one file in the dataset and at least one file in the file database (104) are malicious computer files, and in that the correlation module is configured to provide data indicating a probability that the analyzed file (102) is a malicious computer file.

14. Correlation system according to any one of claims 11 to 13, characterized in that it comprises a module for receiving the analyzed file (102) sent by a remote computer for determining a correlation between the analyzed file (102) and at least one computer file from a file database (104), and a module for sending a correlation report to said remote computer.

Images