Method and system for correlating computer files, in particular for detecting a malicious computer file

Abstract

The invention relates to a method for correlating an analysed file (102) and a database (104) of files, characterised in that the method comprises a step (112) of training a machine learning model (106) configured to obtain a set of characteristic functions associated with a file, a step (114) of determining basic functions of the analysed file (102), a step (116) of vectorising the analysed file (102), in order to obtain a set of vectors each associated with at least one basic function of the analysed file (102), a step (118) of processing the vectors of the set of vectors by the machine learning model in order to associate a characteristic function with each vector, a step (120) of comparing the set of characteristic functions associated with each vector with a database (108) of characteristic functions, and a step (122) of correlating the analysed file and the files of the database.

Description

[0001] DESCRIPTION

[0002] TITLE OF THE INVENTION: METHOD AND SYSTEM FOR CORRELATING COMPUTER FILES, IN PARTICULAR FOR DETECTING MALICIOUS COMPUTER FILES

[0003] Technical field of the invention

[0004] The invention relates to a method and system for correlating a computer file with a database of computer files. In particular, the invention relates to a method and system for rapidly processing a computer file to establish its degree of correlation with other computer files, preferably to establish the probability that the computer file is a malicious computer file or contains a portion of a malicious computer file.

[0005] Technological background

[0006] The invention relates to the field of computer file processing for determining the functional characteristics of these files, in particular for correlating a file with a plurality of files stored in a database, said database preferably containing malicious computer files. The invention therefore also relates to the field of antivirus analysis methods and antivirus systems, in particular static analysis antivirus systems designed to establish the probability of a threat based on the file itself, its characteristics and functions, without requiring its execution.

[0007] A computer file is defined as a computer file containing computer code. This computer code can be, for example, raw code, interpreted code (such as a script), or compiled code, forming an executable computer file, such as a PE (Portable Executable) or ELF (Executable and Linkable Format) executable file. A computer file may also include additional computer data, such as media data (images, sound, video) encoded within the file.

[0008] Current cybersecurity solutions are limited in their ability to detect new variants of malicious computer files that have been modified to evade antivirus and other detection mechanisms. Attackers using such malicious files intentionally alter compilation options and code strings to avoid detection. Traditional static analysis methods, which examine metadata and character strings, are not sufficiently sensitive to code modifications made during compilation. The challenge lies in effectively detecting threats that are unknown or have been cleverly modified to evade detection. Most current solutions, such as antivirus software, often rely on known signatures of malicious computer files to detect threats.This means they may not be effective against new variants of malicious computer files that have been meticulously modified to evade these signatures, which is very limiting.

[0009] Furthermore, reverse engineering software is commonly used to disassemble code for in-depth analysis, but these tools also struggle to handle code modifications made by compilers. Developing reverse engineering solutions with greater tolerance for code changes is essential for improving application security. This improvement helps mitigate risks and threats by quickly identifying vulnerabilities and flaws in computer files.

[0010] Cybercriminals are quick to adapt their methods and malicious code to new detection techniques. Consequently, even if a new detection method is developed, it can quickly become obsolete when attackers change their approaches. Inventors have therefore sought to provide a solution to overcome these drawbacks, and in particular to provide a highly effective method and system for correlating computer files to detect malicious computer files.

[0011] Objectives of the invention

[0012] The invention aims to provide a system and method for correlating computer files, preferably enabling the detection of files containing a malicious computer file.

[0013] The invention aims in particular to provide, in at least one embodiment, a system and a method of correlation enabling adaptation to frequent changes in the source code and / or compilation options of malicious computer files.

[0014] The invention aims in particular to provide, in at least one embodiment, a system and a method of correlation enabling the provision of a reliable and rapid result.

[0015] The invention aims in particular to provide, in at least one embodiment, a system and a correlation method enabling the determination of a family of computer files from which the analyzed computer file is derived.

[0016] The invention aims in particular to provide, in at least one embodiment, a system and a method of correlation enabling the reduction of the number of false positives and false negatives in the estimation of the correlation, in particular in the classification of the analyzed file as a malicious computer file.

[0017] The invention aims in particular to provide, in at least one embodiment, a computer program product for correlation implementing at least some of the steps of the correlation process according to the invention and / or executed in a correlation system according to the invention.

[0018] Description of the invention

[0019] To this end, the invention relates to a method of correlation between a computer file, referred to as the analyzed file, with at least one computer file from a database of files, characterized in that it comprises: a preliminary step of training a machine learning model from a dataset comprising a plurality of computer files, the learning model being configured to obtain, from a pre-processed computer file, a set of characteristic functions associated with said file; a step of determining the basic functions of the analyzed file; a step of vectorizing the analyzed file, configured to obtain a set of vectors, each vector being associated with one or more basic functions of the analyzed file and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s).a step of processing the vectors of the set of vectors by the trained machine learning model, so as to associate a characteristic function with each vector, a step of comparing the set of characteristic functions associated with each vector with a database of characteristic functions, said database of characteristic functions being generated beforehand by processing the files of the file database by the machine learning model, a step of correlation between the analyzed file and one or more files of the file database, and of providing data representative of the correlation between the analyzed file and one or more files of the file database,

[0020] A correlation method according to the invention thus makes it possible to establish the correlation between an analyzed file and a plurality of computer files by determining the characteristic functions of the analyzed file on the one hand, and the characteristic functions of the computer files on the other. The use of these characteristic functions allows for rapid processing by comparing all the characteristic functions associated with each vector.

[0021] Advantageously, and according to the invention, the correlation process is implemented by computer. In particular, each step of the correlation process is implemented by computer.

[0022] Vectors are associated with basic functions that are determined from the analyzed or disassembled file, or, in some cases, during disassembly by the disassembly software. A basic function is a set of expressions and / or instructions that provide continuity in the code or execution flow, for example, that allows a feature to be implemented. Basic functions generally include one or more basic blocks if the analyzed file is an executable file. Vectors result from exhaustive statistical processing to extract the features and signatures of these basic functions, with the results of this processing being compiled into vectors.Each vector is associated with one or more basis functions, for example a main basis function and associated basis functions, such as basis functions called by the main basis function and allowing context to be added to that main basis function.

[0023] Correlation represents a proximity, or similarity, between the analyzed file and one or more files in the database. Two computer files are assumed to be correlated when they contain similarities. The correlation is stronger when the number of common or similar characteristic features is greater, which can indicate that code, a portion of code, or the use of a library or set of libraries is shared between the analyzed file and the file(s) in the database. This correlation with respect to characteristic features makes it possible to bypass minor code changes that escape a textual comparison of prior art.The analyzed files are therefore not reduced to their source code, but to the characteristic functions that can be implemented; that is, code linked to a concept, or concept-code, implemented in the computer file, regardless of its implementation, its implementation algorithm, its programming language, etc. These similarities may be due to shared common code, the fact that the computer files were developed by the same team, etc.

[0024] The processing time for the analyzed file is significantly reduced compared to previous systems. The generation of the characteristic function database is performed beforehand and therefore does not affect the processing time of the analyzed file. The generation of characteristic functions for the analyzed file is fast, as it is limited to that single file. Finally, the comparison of the characteristic functions of the analyzed file with the characteristic function database is an optimized processing operation that can be performed quickly even with a large characteristic function database (several billion characteristic functions). These file analysis operations can thus be implemented by a standard computer, or even an embedded system, without requiring a supercomputer.

[0025] The characteristic functions, as determined by the learning model, are key functions that allow for very precise classification based on their proximity to other files, particularly for determining their malicious nature. Characteristic functions are elements of computer files that can be found from one computer file to another without any constraints on the implementation or programming language used to create the computer file.Thus, an analyzed computer file containing a variant of another computer file will have common characteristic functions with that computer file from which it derives if the latter has a similar behavior when interpreted or executed from compiled code, even if the implementation algorithm has been modified to escape classic antivirus software, if the programming language is different, if obfuscation techniques have been implemented, etc.

[0026] The machine learning model, more commonly known as the machine learning model in English, and in particular a deep learning model.

[0027] Advantageously and according to the invention, the correlation process includes a step of disassembling the analyzed file by a disassembler if the analyzed file is an executable computer file, to obtain a file disassembled into machine instructions, and in that the correlation process applies the steps of determining the basic functions and vectorization to the disassembled file.

[0028] Advantageously and according to the invention, the architecture of the machine learning model used, associating a characteristic function with each vector, consists of at least two modules, called the first and second modules.

[0029] The first module is a feature extraction and dimensionality reduction module, configured to receive as input a vector, of positive integer dimension NI, from the set of vectors obtained in the file vectorization step, and whose vector components include characteristic values ​​to produce a vector of positive integer dimension N2, with N2 <N1.

[0030] The second module is a neural network, specifically a recurrent neural network, taking as input each N2-dimensional vector output from the first module to produce a positive integer-dimensional vector M, with M <N2 et représentant une fonction caractéristique.

[0031] Thus, the machine learning model allows us to represent characteristic functions as points of a submanifold of the space R Mwhich, equipped with a metric, in particular the Euclidean distance, makes it a metric space capable of representing the characteristic functions according to a degree of functional proximity.

[0032] Advantageously and according to the invention, at least one file in the dataset and at least one file in the file database are malicious computer files, and in that the correlation step provides data indicating a probability that the analyzed file is a malicious computer file.

[0033] According to this aspect of the invention, the correlation method enables the detection of a malicious computer file by correlating the analyzed computer file with a database of malicious files. In particular, the correlation allows the analyzed file to be associated with one or more malicious computer files forming a family of malicious computer files, because they share a common design and / or functionalities.

[0034] The use of characteristic functions thus makes it possible to thwart the usual methods of modifying malicious computer files to avoid their detection by conventional antivirus software.

[0035] Advantageously and according to the invention, at least one file in the dataset and at least one file in the file database are unhealthy computer files implementing at least one feature that is likely to be undesirable, and in that the correlation step provides data indicating a probability that the analyzed file is an unhealthy computer file.

[0036] According to this aspect of the invention, the correlation process enables the detection of a malicious computer file, that is, a computer file containing potentially undesirable, generally unwanted and / or hidden functions, such as, for example, unwanted data transmission to a central server, the installation of unwanted features on the workstation, or taking control of the workstation, without being considered malware in the common sense. Examples of such malicious computer files include, among software containing undesirable functions, spyware, advertising tracking software, etc., or also software whose features may be considered undesirable if they are not controlled by the administrator of the workstation or the computer network on which the workstation depends, such as computer network management software, remote access software, etc.

[0037] Advantageously and according to the invention, at least one file of the dataset and at least one file of the file database are computer files comprising different versions of the same software library, and in that the correlation step provides data indicating a probability that the analyzed file implements one of the versions of one of the software libraries.

[0038] According to this aspect of the invention, the correlation method makes it possible to detect the different versions of libraries implemented in the analyzed computer file, particularly when the latter is a compiled executable computer file, and to indicate whether a version of an implemented library contains a known vulnerability. If so, the correlation method can suggest implementing a more recent library in which the vulnerability has been corrected.

[0039] Advantageously and according to the invention, the vectors of the set of vectors comprise characteristic values ​​from among at least one or more of the following characteristic values:

[0040] - number of basic blocks of the basic function(s);

[0041] - size of basic blocks, in particular the number of instructions contained in the first basic block;

[0042] - number of instructions in the basic function(s);

[0043] - structure and statistics of a basic block graph (e.g. average degree, minimum distance between blocks or to a terminal block, etc.);

[0044] - number of basic decision blocks (blocks containing a branch instruction);

[0045] - number of procedure calls among the instructions of the basic function(s);

[0046] - total number of functions present in the analyzed file,

[0047] - minimum distance between two functions or between a function and a terminal function;

[0048] - number of basic functions imported from an external block and number of internal functions called within the same basic block;

[0049] - statistical values ​​on the graph of the basic blocks of the basic function(s), in particular among the group including: minimum, maximum, mean, variance, kurtosis, skewness;

[0050] - number, position and statistical distribution of one or more types of particular instructions among the instructions of the basic function(s), including in particular the classes: write, read, call, mov, string, float, conditions, arithmetic, logic, test, shift, clear, index, etc.;

[0051] - architecture of the analyzed file.

[0052] According to this aspect of the invention, the vectors allow a global and strictly quantifiable definition of the intrinsic characteristics of the basic functions: by aggregating structural measures (size of blocks, minimum distances in the graph, number of decision blocks), control flow indicators (presence of terminal blocks or functions), high-level statistics (mean, variance, kurtosis, skewness) as well as the fine distribution of the different instruction families, they offer a synthetic, compact representation that can be directly used by analysis or machine learning algorithms to characterize, compare or classify the basic functions in a simplified and robust way.

[0053] Advantageously, and according to the invention, the correlation method comprises a preliminary step of generating the database of characteristic functions, including: a step of retrieving computer files from public or private databases stored on a remote server, a step of retrieving metadata associated with one or more of said retrieved computer files, a step of filtering the computer files, a step of labeling the filtered computer files, including a substep of adding metadata to each computer file and a substep of classification by applying classification rules, a step of vectorizing the labeled file, configured to obtain a second set of vectors,each vector being associated with one or more basic functions of the labeled file and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s), a step of processing the vectors of the second set of vectors by the machine learning model, so as to associate a characteristic function with each vector, a step of generating the database of characteristic functions from the characteristic functions associated with each vector of each labeled file,

[0054] According to this aspect of the invention, the database is pre-established to allow for rapid processing of the analyzed file. The database generation can be updated regularly by adding new relevant files, particularly new malicious computer files as part of a correlation with existing malicious computer files.

[0055] Advantageously and according to the invention, the correlation method includes a step of generating a correlation report, said correlation report comprising at least one of the following pieces of information: a list of computer files whose correlation with the analyzed file reaches a certain threshold, a correlation score with each computer file in said list, the number and characteristics of the characteristic functions in common with each computer file in the list, the family or families of malicious computer files with which the analyzed file has a strong correlation, information on said or said families of malicious computer files, a sample of the analyzed file relevant in determining the correlation, a distribution of the characteristic functions according to their generic, legitimate or malicious quality, and a distribution of the addressing of the analyzed file in correspondence with a computer file in the list.

[0056] The invention also relates to a method for training a machine learning model for a correlation method according to the invention, characterized in that it comprises the following steps: a step of receiving a training dataset comprising computer files, a step of tuning optimal hyperparameters of the machine learning model, a step of training the learning model from a first part of the dataset, and a step of validating the learning model from a second part of the dataset.

[0057] The invention also relates to a computer program product for correlation between a computer file, said analyzed file, with at least one computer file from a database of files, said computer program product comprising program code instructions for the execution, when said computer program product is executed on a computer, of the steps according to the correlation method according to the invention.

[0058] The invention also relates to a correlation system between a computer file, called the analyzed file, and at least one computer file from a file database, characterized in that it comprises: a training module for a machine learning model from a dataset comprising a plurality of computer files, the learning model being configured to obtain, from a pre-processed computer file, a set of characteristic functions associated with said file; a module for determining the basic functions of the analyzed file; a vectorization module for the analyzed file, configured to obtain a set of vectors, each vector being associated with one or more basic functions of the analyzed file and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s).a module for processing the vectors of the set of vectors by the trained machine learning model, so as to associate a characteristic function with each vector; a module for comparing the set of characteristic functions associated with each vector with a database of characteristic functions, said database of characteristic functions being generated beforehand by processing the files of the file database by the machine learning model; a module for correlating the analyzed file with one or more files in the file database, and for providing data representative of the correlation between the analyzed file and one or more files in the file database.

[0059] Throughout the text, a module may, for example, consist of a computing device such as a computer, a set of computing devices, an electronic component or a set of electronic components, or, for example, a computer program, a set of computer programs, a computer program library or a computer program function executed by a computing device such as a computer, a set of computing devices, an electronic component or a set of electronic components.

[0060] Advantageously and according to the invention, the correlation system includes a disassembler configured to obtain a disassembled file into machine instructions from the analyzed file if the analyzed file is an executable computer file, the basic function determination module and the vectorization module being configured to process the disassembled file.

[0061] Advantageously and according to the invention, at least one file in the dataset and at least one file in the file database are malicious computer files, and in that the correlation module is configured to provide data indicating a probability that the analyzed file is a malicious computer file.

[0062] Advantageously and according to the invention, at least one file in the dataset and at least one file in the file database are unhealthy computer files implementing at least one feature that is likely to be undesirable, and in that the correlation module provides data indicating a probability that the analyzed file is an unhealthy computer file.

[0063] Advantageously and according to the invention, at least one file of the dataset and at least one file of the file database are computer files comprising different versions of the same software library, and in that the correlation module provides data indicating a probability that the analyzed file implements one of the versions of one of the software libraries.

[0064] Advantageously and according to the invention, the correlation system includes a module for receiving the analyzed file sent by a remote computer for determining a correlation between the analyzed file and at least one computer file in a file database, and a module for sending a correlation report to said remote computer.

[0065] According to this aspect of the invention, the system forms a remote system capable of receiving computer files to be analyzed, thus providing a remote service, for example accessible on the Internet, in particular via a Web service allowing the uploading of the file to be analyzed and the receipt of a correlation report, either directly on a Web page, or by sending a computer file including the report data, or both, or other means of transmitting the report.

[0066] The invention also relates to a correlation method, a training method, a correlation system and a correlation computer program product characterized in combination by all or part of the characteristics mentioned above or below.

[0067] List of figures

[0068] Other objects, features and advantages of the invention will become apparent from the following description, given by way of non-limiting example only, and which refers to the accompanying figures in which:

[0069] - [Fig. 1] is a schematic view representing a correlation process according to one embodiment of the invention,

[0070] - [Fig. 2] is a schematic view representing a correlation ratio according to one embodiment of the invention.

[0071] Detailed description of an embodiment of the invention

[0072] In the figures, scales and proportions are not strictly to scale for illustrative and clarity purposes. Identical, similar, or analogous elements are designated by the same reference numerals in all figures.

[0073] Figure 1 schematically represents a correlation method 100 according to one embodiment of the invention.

[0074] Process 100 allows the correlation between a computer file, called analyzed file 102, with at least one computer file from a database 104 of file data.

[0075] If the analyzed file is an executable file, the correlation process 100 includes a step 110 of disassembling the analyzed file using a disassembler, to obtain a disassembled file into machine instructions. The disassembler could, for example, be the IDA Pro disassembler.

[0076] The correlation process 100 also includes a prior step 112 of training a machine learning model 106 from a dataset comprising a plurality of computer files, the learning model being configured to obtain, from a pre-processed computer file, a set of characteristic functions associated with said file.

[0077] The 106 machine learning model is preferably a deep learning model, such as a neural network. The neural network can in particular be a recurrent neural network (often called an RNN), specifically a recurrent neural network with long-term memory (often called an LSTM), or a transformer-type neural network.The machine learning model 106 is trained according to a training process comprising the following steps: a step of receiving a training dataset including computer files, a step of tuning optimal hyperparameters of the machine learning model, a step of training the learning model from a first part of the dataset, a step of validating the learning model from a second part of the dataset.

[0078] The steps of optimal hyperparameter tuning (or optimal hyperparameter search), training, and validation are performed in a standard manner for a machine learning model, particularly a deep learning model, to implement the definition of characteristic functions. For example, hyperparameter optimization can be performed using a BOHB-type optimization technique, as described in particular in the publication "uFalkner, Stefan, Aaron Klein, and Frank Hutter. "BOHB: Robust and efficient hyperparameter optimization at scale." International conference on machine learning. PMLR, 2018."

[0079] The training dataset can come from one or more data sources. For example, these data sources can be among one or more of the following: Linux distribution repositories, open-source software repositories, especially software whose license allows the processing of the source code, for example GitHub, software package managers, for example Conan.io and Chocolatey, proprietary software repositories whose data exploitation is permitted, for example, specific computer file sources, especially malicious computer file sources, for example Malware-Bazaar, VirusTotal, VX-Underground and VirusShare.

[0080] The dataset is pre-processed to maximize training results.

[0081] The correlation process 100 then includes a step 114 for determining the basic functions of the disassembled file (or of the analyzed file in embodiments where the analyzed file is not disassembled because it is not an executable file requiring disassembly). This step allows the instructions of the analyzed file to be grouped into basic functions. Basic functions are a set of expressions and / or instructions that provide continuity in the code or in the execution flow, for example, that allow a feature to be implemented. When the analyzed file is source code, a basic function is, for example, a function consisting of a portion of code that can be called during the execution or interpretation of the analyzed file. When the analyzed file is an executable file, a basic function comprises one or more basic blocks.The grouping of several basic blocks to form a function is, for example, determined by the disassembler during the disassembly of the analyzed file when it is compiled.

[0082] The correlation process 100 then includes a step 116 of vectorizing the disassembled file (or the analyzed file if it is not disassembled), configured to obtain a set of vectors, each vector being associated with one or more basic functions of the analyzed file and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s). These vectors function as statistical and exhaustive descriptions of the basic functions.The characteristics taken into account are for example: number of basic blocks of the basic function(s), number of instructions of the basic function(s), number of procedure calls among the instructions of the basic function(s), statistical values ​​on the graph of the basic blocks of the basic function(s), number, position and statistical distribution of one or a plurality of particular instruction types among the instructions of the basic function(s), architecture of the analyzed file.

[0083] These characteristics are derived from exhaustive statistical processing of the analyzed file.

[0084] The correlation process 100 then includes a step 118 of processing the vectors in the set of vectors by the trained machine learning model 116, so as to associate a characteristic function with each vector. This processing step 118 may include a substep of taking into account the proximity of vectors, for example by defining groups of nearby vectors submitted to the learning model, in order to add meaning to the vectors when they represent geographically close basic functions in the execution or interpretation of the analyzed file.

[0085] Characteristic functions allow us to conceptualize a computer file in terms of its intrinsic functions, without considering the implementation algorithm or programming language used. These functions are not necessarily representative of a known mathematical function or algorithm, nor are they intended to describe the computer file in such a way that these functions are directly interpretable by a human operator. Rather, their purpose is to be compared with a database of characteristic functions to estimate the correlation with other computer files.

[0086] The correlation process 100 then includes a step 120 of comparing the set of characteristic functions associated with each vector with a database 108 of characteristic functions, said database 108 of characteristic functions being generated beforehand by processing the files of the database of files by the machine learning model.

[0087] For the establishment of the database, the correlation process 100 includes a preliminary step 124 of generating the database of characteristic functions, comprising firstly a step of retrieving computer files from public or private databases stored on a remote server.

[0088] For example, these databases may be among one or more of the following: Linux distribution repositories, open-source software repositories, especially software whose license permits processing of the source code, e.g. GitHub, software package managers, e.g. Conan.io and Chocolatey, proprietary software repositories whose data exploitation is permitted, e.g., sources of specific computer files, especially sources of malicious computer files, e.g. Malware-Bazaar, VirusTotal, VX-Underground and VirusShare.

[0089] These databases are the same types of data sources used during the machine learning model training, but they are regularly accessed to retrieve computer files in order to have the most up-to-date files for regular updates to the feature function database. During the implementation of the correlation process for detecting malicious computer files, this frequent and regular updating ensures that the latest malware versions are available, enabling a rapid response to protect against new threats. The preliminary step of generating the feature function database can thus be performed periodically for regular updates of the feature functions.

[0090] The preliminary step 124 of generating the database of characteristic functions also includes a step of retrieving metadata associated with one or more of said retrieved computer files and a step of filtering the computer files.

[0091] The preliminary step 124, which generates the database of characteristic functions, then includes a step for labeling the filtered computer files. This step comprises a substep for adding metadata to each computer file and a substep for classifying the files using classification rules. The classification rules are, for example, YARA-type rules for classifying malicious computer files.

[0092] The preliminary step 124 for generating the feature function database then includes a vectorization step of the labeled file, configured to obtain a second set of vectors. Each vector is associated with one or more basic functions of the labeled file and comprises a set of feature values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s). A further step involves processing the vectors of the second set of vectors using the machine learning model to associate each vector with a feature function. These vectorization and vector processing steps for obtaining the feature functions are analogous to the vectorization and vector processing steps of the correlation process 100.

[0093] The preliminary step 124 of generating the database of characteristic functions finally includes a step of generating the database of characteristic functions from the characteristic functions associated with each vector of each labeled file.

[0094] The correlation process 100 then includes a step 122 of correlation between the analyzed file and one or more files in the file database, and of providing data representative of the correlation between the analyzed file and one or more files in the file database. This correlation step 122 makes it possible to determine the characteristic functions found in the analyzed file that allow it to be matched with a computer file in the database.

[0095] In particular: if at least one file in the dataset and at least one file in the file database are malicious, the correlation step can provide data indicating the probability that the analyzed file is malicious. The correlation process can then be used as an antivirus method to determine whether the analyzed file is malicious. Similarly, if at least one file in the dataset and at least one file in the file database are malicious files implementing at least one potentially undesirable feature, the correlation step can provide data indicating the probability that the analyzed file is malicious. The correlation process can then be used as an anti-spyware or anti-tracking method to determine whether the analyzed file is malicious.If at least one file in the dataset and at least one file in the file database are computer files containing different versions of the same software library, the correlation step can provide data indicating the probability that the analyzed file implements one version of one of the software libraries. The correlation process can then be used as a vulnerability detector, for example, when a computer file uses a library that has not been recently updated and contains vulnerabilities.

[0096] The correlation process can also determine whether an analyzed file is malicious, unhealthy, vulnerable, or none of these.

[0097] The correlation process 100 may also include a step of generating a correlation report, particularly in correlation step 122.

[0098] Figure 2 illustrates one embodiment of such a correlation report, as it might be displayed in a software window within a computer operating system, such as dedicated software or a web browser. Figure 2 specifically depicts a correlation report showing the correlation of the analyzed file with a malicious computer file, focusing particularly on the match with virus 1 (a malicious file from the computer file database).

[0099] Report 200 includes, for example, at least one of the following: a list 204 of computer files whose correlation with the analyzed file reaches a certain threshold, a correlation score 206 with each computer file in said list, the number and characteristics 208 of the characteristic functions in common with each computer file in the list, a family 210 graph of malicious computer file families with which the analyzed file has a strong correlation, information 212 on said malicious computer file family or families, a sample of the analyzed file relevant in determining the correlation, a distribution 214 of the characteristic functions according to their generic, legitimate or malicious quality, and a distribution 216 of the addressing of the analyzed file in correspondence with a computer file in the list.

Claims

DEMANDS 1. A method for correlating a computer file, referred to as the analyzed file (102), with at least one computer file from a database (104) of files, characterized in that it comprises: a preliminary step (112) of training a machine learning model (106) from a dataset comprising a plurality of computer files, the learning model being configured to obtain, from a preprocessed computer file, a set of characteristic functions associated with said file; a step (114) of determining the basic functions of the analyzed file (102); a step (116) of vectorizing the analyzed file (102), configured to obtain a set of vectors, each vector being associated with one or more basic functions of the analyzed file (102) and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s).a step (118) of processing the vectors of the set of vectors by the trained machine learning model, so as to associate a characteristic function with each vector, a step (120) of comparing the set of characteristic functions associated with each vector with a database (108) of characteristic functions, said database (108) of characteristic functions being generated beforehand by processing the files of the file database by the machine learning model, a step (122) of correlation between the analyzed file and one or more files of the file database, and of providing data representative of the correlation between the analyzed file (102) and one or more files of the file database (104).

2. A correlation method according to claim 1, characterized in that it comprises a step (110) of disassembling the analyzed file (102) by a disassembler if the analyzed file (102) is a computer file executable, to obtain a file disassembled into machine instructions, and in that the correlation process applies the steps of determining the basic functions and vectorization to the disassembled file.

3. Correlation method according to any one of claims 1 or 2, characterized in that at least one file in the dataset and at least one file in the file database (104) are malicious computer files, and in that the correlation step (122) provides data indicating a probability that the analyzed file is a malicious computer file.

4. Correlation method according to any one of claims 1 to 3, characterized in that at least one file in the dataset and at least one file in the database (104) of file data are malicious computer files implementing at least one feature that is likely to be undesirable, and in that the correlation step (122) provides data indicating a probability that the analyzed file is a malicious computer file.

5. Correlation method according to any one of claims 1 to 4, characterized in that at least one file of the dataset and at least one file of the database (104) of file data are computer files comprising different versions of the same software library, and in that the correlation step (122) provides data indicating a probability that the analyzed file implements one of the versions of one of the software libraries.

6. A correlation method according to any one of claims 1 to 5, characterized in that the vectors of the set of vectors comprise characteristic values ​​among at least one or more of the following characteristic values: number of basic blocks of the basic function(s), size of the basic blocks, number of instructions of the basic function(s), structure and statistics of a graph of the basic blocks, number of decision-making basic blocks, number of procedure calls among the instructions of the basic function(s). basic functions, total number of functions present in the analyzed file, minimum distance between two functions or between a function and a terminal function, statistical values ​​on the graph of the basic blocks of the basic function(s), number, position and statistical distribution of one or a plurality of particular instruction types among the instructions of the basic function(s), architecture of the analyzed file.

7. Correlation method according to any one of claims 1 to 6, characterized in that it comprises a preliminary step (124) for generating the database of characteristic functions, comprising: a step for retrieving computer files from public or private databases stored on a remote server, a step for retrieving metadata associated with one or more of said retrieved computer files, a step for filtering the computer files, a step for labeling the filtered computer files, comprising a substep for adding metadata to each computer file and a substep for classification by applying classification rules, a step for vectorizing the labeled file, configured to obtain a second set of vectors,each vector being associated with one or more basic functions of the labeled file and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s), a step of processing the vectors of the second set of vectors by the machine learning model, so as to associate with each vector a characteristic function, a step of generating the function database, characteristics from the characteristic functions associated with each vector in each labeled file.

8. A correlation method according to any one of claims 1 to 7, characterized in that it comprises a step of generating a correlation report (200), said correlation report comprising at least one of the following pieces of information: a list (204) of computer files whose correlation with the analyzed file reaches a certain threshold, a correlation score (206) with each computer file in said list, the number and characteristics (208) of the characteristic functions in common with each computer file in the list, a family (210) or families of malicious computer files with which the analyzed file exhibits a strong correlation, information (212) on said or said families of malicious computer files, a sample of the analyzed file relevant in determining the correlation, and a distribution (214) of the characteristic functions according to their generic, legitimate, or malicious nature.distribution (216) of the addressing of the analyzed file in correspondence with a computer file in the list.

9. A method for training a machine learning model (116) for a correlation method according to any one of claims 1 to 8, characterized in that it comprises the following steps: a step of receiving a training dataset comprising computer files, a step of tuning optimal hyperparameters of the machine learning model, a step of training the learning model from a first part of the dataset, a step of validating the learning model from a second part of the dataset.

10. Computer program product for correlation between a computer file, said analyzed file (102), with at least one computer file of a database (104) of files, said computer program product comprising program code instructions for the execution, when said computer program product is executed on a computer, of the steps of the correlation method (100) according to any one of claims 1 to 8.

11. Correlation system between a computer file, referred to as the analyzed file (102), and at least one computer file from a file database (104), characterized in that it comprises: a training module for a machine learning model (116) from a dataset comprising a plurality of computer files, the learning model being configured to obtain, from a pre-processed computer file, a set of characteristic functions associated with said file; a module for determining the basic functions of the analyzed file; a vectorization module for the analyzed file, configured to obtain a set of vectors, each vector being associated with one or more basic functions of the analyzed file and comprising a set of characteristic values ​​calculated from a machine instruction and / or a group of machine instructions of said basic function(s).a module for processing the vectors of the set of vectors by the trained machine learning model (116), so as to associate a characteristic function with each vector, a module for comparing the set of characteristic functions associated with each vector with a database (108) of characteristic functions, said database of characteristic functions being generated beforehand by processing the files of the file database by the machine learning model, a module for correlating the analyzed file (102) with one or more files of the file database, and for providing data, representative of the correlation between the analyzed file and one or more files in the file database.

12. Correlation system according to claim 11, characterized in that it comprises a disassembler configured to obtain a disassembled file into machine instructions from the analyzed file (102) if the analyzed file is an executable computer file, the basic function determination module and the vectorization module being configured to process the disassembled file.

13. Correlation system according to any one of claims 11 or 12, characterized in that at least one file in the dataset and at least one file in the file database (104) are malicious computer files, and in that the correlation module is configured to provide data indicating a probability that the analyzed file (102) is a malicious computer file.

14. Correlation system according to any one of claims 11 to 13, characterized in that it comprises a module for receiving the analyzed file (102) sent by a remote computer for determining a correlation between the analyzed file (102) and at least one computer file from a file database (104), and a module for sending a correlation report to said remote computer.

Images