44 results about "Malware analysis" patented technology

A method for malware analysis comprising: disassembling executable code to create disassembled instructions; extracting instruction blocks from the disassembled instructions; encoding the instruction blocks to create encoded instruction blocks and generating a first data graph, wherein the first data graph comprises nodes, each node from the first data graph being associated with an encoded instruction block; determining for each node an embedding of the encoded instruction block to create a canonical executable graph; classifying the canonical executable graph into either a benign family or a malicious family; and determining that the executable code is a malware when the canonical executable graph belongs to a malicious family.

The invention relates to the technical field of computer security, in particular to an APT attribution analysis method and system based on large model semantic transformation. The big language model can mine key features of software gene information and spontaneously form association mapping of feature elements in different semantic spaces; extracting a training data set and an evaluation data set for multiple times, training and evaluating the large language model based on the training data set and the evaluation data set extracted each time, updating a hyper-parameter candidate set through a hyper-parameter adaptive selection mechanism, and taking an optimal hyper-parameter obtained after model convergence as an optimal hyper-parameter combination of the large language model; and based on the optimal hyper-parameter combination, full-amount data set task fine tuning is carried out on the large language model by using sample information, so that the large language model learns APT attribution analysis reasoning logic. According to the method, the accuracy and efficiency of APT attribution analysis can be improved, the generalization ability of the model is enhanced, and the method can be applied to multiple application scenes such as network security defense and malicious software analysis.

The present invention provides a malware analysis apparatus, a malware analysis method, and a malware analysis system that, in a case where dynamic analysis and static analysis are combined to analyze malware, make it possible to analyze malware more easily compared with a case where the analysis is performed without using the configuration adopted by the present invention.The malware analysis apparatus includes an analysis section, a conversion section, and a generation section. The analysis section performs dynamic analysis and static analysis of analysis target malware. The conversion section converts results of the dynamic analysis and the static analysis into natural language, and generates explanations of the analysis results. The generation section generates information regarding a behavior of analysis target malware, the information being obtained by comparing the explanations generated respectively from the dynamic analysis and the static analysis.

A communications system for providing secure access to a digital resource of a group of digital resources accessible via the internet, the system comprising: a data processing hub accessible via an IP (internet protocol) address; and a plurality of user equipment (UEs) useable to communicate via the internet, each configured to have a cyber secure isolated environment (CISE) isolated from ambient software in the UE, and comprising a secure web browser (SWB); wherein the hub and CISE are configured so that digital resources in motion and at rest in CISE are visible to the hub.

A malware detector has been designed that uses a combination of NLP techniques on dynamic malware analysis reports for malware classification of files. The malware detector aggregates text-based features identified in different pre-processing pipelines that correspond to different types of properties of a dynamic malware analysis report. From a dynamic malware analysis report, the pre-processing pipelines of the malware detector generate a first feature set based on individual text tokens and a second feature set based on n-grams. The malware detector inputs the first feature set into a neural network having an embedding layer. The malware detector then extracts a dense layer from the neural network and aggregates the extracted layer with the second feature set to form an input for a trained boosting model. The malware detector inputs the cross-pipeline feature values into the boosting model to generate a malware detection output.

To provide a malware analysis device, a malware analysis method, and a malware analysis system which, when analyzing a malware by combining dynamic analysis with static analysis, compare the cases of using and not using the configuration, so as to facilitate the analysis of the malware.SOLUTION: A malware analysis device includes: an analysis section for dynamically and statically analyzing a malware as an analysis object; a conversion section for converting an analysis result by the dynamic and static analyses into natural language so as to generate a descriptive text of the analysis result; and a generation section for generating information on behavior of the malware as an analysis object, which is obtained by comparing each descriptive text by the dynamic and static analyses.SELECTED DRAWING: Figure 1

Communication of dynamically analyzed malware is mediated. Even in a case where communication with the attacker server is stopped, a response accumulated as past data is returned to continue dynamic analysis.

A malware detector has been designed that uses a combination of NLP techniques on dynamic malware analysis reports for malware classification of files. The malware detector aggregates text-based features identified in different pre-processing pipelines that correspond to different types of properties of a dynamic malware analysis report. From a dynamic malware analysis report, the pre-processing pipelines of the malware detector generate a first feature set based on individual text tokens and a second feature set based on n-grams. The malware detector inputs the first feature set into a trained neural network having an embedding layer. The malware detector then extracts a dense layer from the trained neural network and aggregates the extracted layer with the second feature set to form an input for a trained boosting model. The malware detector inputs the cross-pipeline feature values into the trained boosting model to generate a malware detection output.

The invention relates to the technical field of recognition for open set shelled software, in particular to a recognition method, system, equipment and medium for open set shelled software, which comprises the following steps of: extracting function call graph structure information from a binary executable file to be recognized through a disassembling tool and a user-defined plug-in thereof; generating a structured graph representation file; on the basis of the graph representation file, graph statistical features and file section structure features are extracted, and a spliced feature vector is formed; and based on a multi-model single-class identification strategy constructed for open set identification, carrying out classification identification on the binary executable file corresponding to the current feature vector. The method has the beneficial effects that the identification efficiency of the shelled software is integrally improved, the detection capability of the unknown type of shelled software is particularly enhanced, and powerful support is provided for dynamic malicious software analysis.

This application relates to the field of network information security technology, and in particular, to a method and device for malicious software analysis based on the PE file format. In this method, multiple PE files are obtained. The multiple PE files are parsed to obtain file information. According to the file information, the feature vectors corresponding to the multiple PE files are determined. Each feature vector in the feature vector set is clustered to obtain a cluster set. Among them, the similarity between any feature vectors included in any cluster in the cluster set is less than or equal to the first threshold. Each cluster in the cluster set is clustered to obtain a target cluster set. Among them, the similarity between any clusters included in any target cluster in the target cluster set is less than or equal to the second threshold, and the second threshold is greater than the first threshold. The target cluster set is displayed. The above solution uses a clustering method to analyze malicious software in the PE file format, improving the efficiency of malicious software analysis.

A malware detector has been designed that uses a combination of NLP techniques on dynamic malware analysis reports for malware classification of files. The malware detector aggregates text-based features identified in different pre-processing pipelines that correspond to different types of properties of a dynamic malware analysis report. From a dynamic malware analysis report, the pre-processing pipelines of the malware detector generate a first feature set based on individual text tokens and a second feature set based on n-grams. The malware detector inputs the first feature set into a neural network having an embedding layer. The malware detector then extracts a dense layer from the neural network and aggregates the extracted layer with the second feature set to form an input for a trained boosting model. The malware detector inputs the cross-pipeline feature values into the boosting model to generate a malware detection output.

A method for malware analysis comprising: disassembling executable code to create disassembled instructions; extracting instruction blocks from the disassembled instructions; encoding the instruction blocks to create encoded instruction blocks and generating a first data graph, wherein the first data graph comprises nodes, each node from the first data graph being associated with an encoded instruction block; determining for each node an embedding of the encoded instruction block to create a canonical executable graph; classifying the canonical executable graph into either a benign family or a malicious family; and determining that the executable code is a malware when the canonical executable graph belongs to a malicious family.

The embodiment of the invention discloses a security detection method and device of a mobile application, computer equipment and a storage medium. The method comprises the following steps: acquiring an installation package file of a target mobile application, and acquiring a decompiled file of the installation package file; performing static risk detection on the decompiled file according to a static risk analysis rule to obtain a static risk analysis result; configuring a Hook point of dynamic instrumentation for the target mobile application according to a static risk analysis result; running the target mobile application, and obtaining running behavior data of the target mobile application through the Hook point; performing dynamic risk detection on the operation behavior data according to a dynamic risk analysis rule to obtain a dynamic risk analysis result; performing feature matching on a preset malicious software feature library and the decompiled file to obtain a malicious software analysis result; and generating a security detection result of the target mobile application according to each analysis result. By implementing the method provided by the embodiment of the invention, the security detection precision of the mobile application can be improved.

An article of manufacture includes a non-transitory medium including machine-readable instructions. The instructions are to be read and executed by a processor. The instructions, when read and executed by the processor, to cause the processor to receive a malware analysis of a malware from a computer security source and receive other malware analyses. Each other malware analysis is of another malware from another computer security source. The instructions may further cause the processor to perform a fuzzy matching algorithm to quantify a similarity of the malware analyses, determine that the malware is a same malware as other malware based upon results of the fuzzy matching algorithm, and later take a same corrective action for malware based upon a receipt of the malware analysis.

Systems and methods for optimal load distribution and data processing of a plurality of files in anti-malware solutions are provided herein. In some embodiments, the system includes: a plurality of node processors; a control processor programmed to: receiving a plurality of files used for malware analysis and training of anti-malware ML models; separating the plurality of files into a plurality of subsets of files based on byte size of each of the files, such that processing of each subset of files produces similar workloads amongst all available node processors; distributing the plurality of subsets of files amongst all available node processors such that each node processor processes its respective subset of files in parallel and within a similar timeframe as the other node processors; and receiving, by the control processor, a report of performance and / or anti-malware processing results of the subset of files performed from each node processor.

An artificial intelligence (AI) based advanced malware detection tool (AIMaD), which uses a combination of both static and dynamic malware analysis in a machine learning (ML) framework. It uses reverse engineering and feature extraction technique at DLL, function call, and assembly levels; these multi-level features are then processed with N-gram (i.e., Natural Language Processing, NLP), association rule mining to feed in different machine learning classifiers. The AIMaD is able to detect malware / ransomware with high accuracy and low false-positive rate.

This invention proposes a hybrid-mode-based static analysis method for Android software, belonging to the field of malware analysis technology. It primarily addresses the accuracy degradation problem caused by existing Android cross-language static analysis frameworks using function digests for inter-function data flow connections. The main solutions include: function-level data flow analysis of the Android Java layer; lightweight inter-function data dependency analysis of the Android Native layer, generating dynamic function digests for each function; and full-program data flow analysis of the Android Java layer, where data flow connections involving Native function calls are reconstructed using function digests.

The present application provides a kind of malware analysis system and method, belong to malware analysis field.The system includes: sample acquisition module, for utilizing multiple acquisition methods to collect malware samples, and the malware samples are stored;Threat intelligence integration module, for utilizing multiple platforms to collect threat intelligence, and the threat intelligence is integrated and stored;Automated analysis module, utilizes automated analysis tool, combines analysis process and automated process, generates the automated analysis result of malware;Result verification module, utilizes selected verification method, combines multiple verification indexes, and the credibility of automated analysis result is checked;And report generation module, generates corresponding defense measures, generates malware analysis report.The present application improves the update speed of threat intelligence and the detection efficiency of new malware, reduces the false alarm rate, improves the determination accuracy, shortens the deployment time of defense measures, and reduces the amount of manual operation.

The application relates to a software analysis method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: obtaining request information of software to be analyzed, and sending the request information to a target address; obtaining real response traffic generated by the target address based on the request information, and generating simulation response traffic based on the real traffic; sending the simulation response traffic to the software to be analyzed, and obtaining behavior data generated by the software to be analyzed based on the simulation response traffic. The application solves the problem that malicious software analysis cannot be performed in the case of no Internet environment or loss of effectiveness of the software to be analyzed, and improves the accuracy of malicious software analysis.

A set of virtual machines (VMs) with different guest operating systems installed is initially booted and prepared to facilitate rapid creation, or “forking,” of a child VM(s) for malware analysis of a software sample. Because malicious code may be packaged for a specific operating system version, subsets of the VMs may have different versions of the same guest operating system installed. Upon detection of a sample indicated for malware analysis, a child VM(s) running the appropriate guest operating system is created based on a corresponding one(s) of the set of VMs. A process in which the corresponding VM(s) has been booted is forked to create a child process. A child VM which is a copy of the VM booted in the parent process is then created in the child process. The sample is then sandboxed in the child VM for analysis to determine if the sample comprises malware.

A computerized method for cluster selection is described. Initially, a cloud-based enrollment service advertises features and capabilities of clusters performing malware analyses within a cloud-based malware detection system. Upon receiving an enrollment request message, including tenant credentials associated with a sensor having an object to be analyzed for malware, the cloud-based enrollment service returns an enrollment response message. The tenant credentials are used to authenticate the sensor and determine a type of subscription assigned to the sensor. The enrollment response message includes a portion of the advertised features and capabilities of a selected cluster of the cloud-based malware detection system in response to the sensor being authenticated. The portion of the advertised features and capabilities enables the sensor to establish communications with the selected cluster.

This invention discloses a method for training a large-scale reverse engineering model for malware analysis based on artificial intelligence, relating to the field of malware analysis technology. The method includes: assigning unified closed-loop identifiers to closed-loop source samples in a closed-loop source sample library for malicious behavior and vulnerability exploitation; generating closed-loop aligned intermediate representations; constructing shadow execution control samples based on a shadow redirection mechanism to obtain effective closed-loop aligned intermediate representations and corresponding shadow execution control samples; inputting the effective closed-loop aligned intermediate representations and corresponding shadow execution control samples into a dedicated training architecture, sequentially performing closed-loop consistency pre-training, supervised fine-tuning, and closed-loop evidence distillation processes to obtain a dedicated large-scale model for reverse engineering; performing reverse processing on the target sample to be tested to generate closed-loop aligned intermediate representations, inputting these representations into the dedicated large-scale model for reverse engineering, outputting structured analysis results, and writing the structured analysis results, which have undergone closed-loop integrity verification, into a security knowledge base.

Techniques for malware detection using watermark cookies are disclosed. In some embodiments, a system, process, and / or computer program product for malware detection using watermark cookies includes receiving a sample at a cloud security service; injecting a watermark cookie in a virtual environment to provide a modified virtual environment; detonating the sample in the modified virtual environment, wherein the modified virtual environment is instrumented for monitoring activities associated with the sample during automated malware analysis of the sample; detecting whether the watermark cookie was accessed in the modified virtual environment during the automated malware analysis of the sample; and determining whether the sample is malware based on whether the watermark cookie was accessed in the modified virtual environment.

There is disclosed a computer-implemented system and method of analyzing a batch of objects, including bucketizing the batch of objects into a plurality of buckets according to a feature of the objects; for objects within a batch, performing malware analysis on the objects to assign a malware analysis score, and adjusting the malware analysis score based on the batch; and performing respective security actions on the objects within the batch, based on the adjusted malware analysis score.

The invention relates to the technical field of network security, in particular to an automatic malicious software feature conversion and unified management method, system and device based on an MAEC standard and a storage medium. The method comprises the following steps: acquiring a malicious software analysis report and analyzing static feature and dynamic feature data, establishing a field semantic mapping relationship based on a preset rule base, and automatically associating features to a behavior tag, a capability tag and a feature tag of an MAEC standard; feature extraction, mapping and standard object generation are achieved through a Python script, malicious software instance objects and behavior objects in the MAEC data model are instantiated, the incidence relation between the objects is created, and a structured description file meeting the MAEC-5. 0 standard is generated; performing semantic classification on the generated malicious software behavior objects, classifying the behavior objects related to semantics into behavior entities, and establishing a hierarchical relationship; a MongoDB and MySQL dual-database architecture is established to store an original report and structured data, and automatic operation is realized through a Linux timed task.

Techniques for providing enhanced live virtual machine file system instrumentation for security analysis are disclosed. In some embodiments, a system / process / computer program product for providing enhanced live virtual machine file system instrumentation for security analysis includes receiving a sample for automated dynamic analysis using a computing environment; freezing time in the computing environment in response to detecting an event during execution of the sample in the computing environment and reassemble one or more files; and performing an automated malware analysis using results of the automated dynamic analysis and the one or more reassembled files.

The invention relates to a malicious software dynamic analysis-oriented automatic interaction method for data between a virtual machine and a host, which comprises the following steps of: S1, initializing the virtual machine, copying a daemon and a dynamic execution program to the virtual machine, and storing a current virtual machine snapshot; s2, resetting the virtual machine to the stored virtual machine snapshot, compressing a to-be-detected sample program, sending the compressed to-be-detected sample program to the virtual machine, and starting a daemon; s3, the virtual machine decompresses the compressed sample, and a dynamic execution program is used for testing; s4, the host program sends a keyboard event to simulate keyboard keys, and file copying is executed; and S5, when the host program detects that the virtual machine daemon program is ended, decompressing the compressed track flow file to a specified directory, finishing transmission of the decompressed track flow file, resetting the state of the virtual machine until the snapshot is stored, analyzing the track flow file, and finishing analysis and test of the malicious software. A network port and a shared directory do not need to be opened, risks caused in the transmission process are reduced, and the implementation is safer.

This application provides a hierarchical classification-based method and system for malware analysis. The application relates to the technical field of data processing, and includes: acquiring malware samples to be analyzed; extracting features from the malware samples to obtain feature vectors; inputting the feature vectors into a preset hierarchical classification model to obtain hierarchical classification results of the malware samples; calculating the contribution of each feature in the feature vector to each classification node in the hierarchical classification results; constructing high-dimensional numerical vectors based on the contribution; calculating the cosine similarity between the high-dimensional numerical vectors of different classification nodes; and performing correlation analysis on the cosine similarity to obtain a correlation analysis report between different malware categories. By using a hierarchical classification model to determine the family category and variant category of malware samples level by level, this method overcomes the problems of insufficient classification granularity, difficulty in characterizing category differences, and difficulty in analyzing category correlations when dealing with complex family systems or multiple variant malware.

The present invention discloses a multi-feature-based automated malware detection method, comprising the following steps: step S1: preprocessing data; step S2: extracting features from the data to obtain a feature vector; step S3: effectively aligning and fusing the binary feature vector obtained in the above step S2 and the operation code feature vector generated by the triangular attention mechanism to generate a final fusion vector; step S4: detecting and classifying malware; the present invention can more effectively detect malware variants with a higher accuracy. In an actual production environment, the present invention enhances the performance of automatic malware analysis tools by increasing the recognition efficiency of malware variants, thereby reducing labor costs.

A cyber threat information processing method, a cyber threat information processing processor, and a storage medium storing a program for processing cyber threat information may process an executable file to ensure characteristic information of the executable file, transmit the ensured characteristic information of the executable file over an independent network, and receive malware profiling information generated based on the characteristic information of the executable file over the independent network.