17 results about "Malware analysis" patented technology

A malware detector has been designed that uses a combination of NLP techniques on dynamic malware analysis reports for malware classification of files. The malware detector aggregates text-based features identified in different pre-processing pipelines that correspond to different types of properties of a dynamic malware analysis report. From a dynamic malware analysis report, the pre-processing pipelines of the malware detector generate a first feature set based on individual text tokens and a second feature set based on n-grams. The malware detector inputs the first feature set into a trained neural network having an embedding layer. The malware detector then extracts a dense layer from the trained neural network and aggregates the extracted layer with the second feature set to form an input for a trained boosting model. The malware detector inputs the cross-pipeline feature values into the trained boosting model to generate a malware detection output.

The embodiment of the invention discloses a security detection method and device of a mobile application, computer equipment and a storage medium. The method comprises the following steps: acquiring an installation package file of a target mobile application, and acquiring a decompiled file of the installation package file; performing static risk detection on the decompiled file according to a static risk analysis rule to obtain a static risk analysis result; configuring a Hook point of dynamic instrumentation for the target mobile application according to a static risk analysis result; running the target mobile application, and obtaining running behavior data of the target mobile application through the Hook point; performing dynamic risk detection on the operation behavior data according to a dynamic risk analysis rule to obtain a dynamic risk analysis result; performing feature matching on a preset malicious software feature library and the decompiled file to obtain a malicious software analysis result; and generating a security detection result of the target mobile application according to each analysis result. By implementing the method provided by the embodiment of the invention, the security detection precision of the mobile application can be improved.

An article of manufacture includes a non-transitory medium including machine-readable instructions. The instructions are to be read and executed by a processor. The instructions, when read and executed by the processor, to cause the processor to receive a malware analysis of a malware from a computer security source and receive other malware analyses. Each other malware analysis is of another malware from another computer security source. The instructions may further cause the processor to perform a fuzzy matching algorithm to quantify a similarity of the malware analyses, determine that the malware is a same malware as other malware based upon results of the fuzzy matching algorithm, and later take a same corrective action for malware based upon a receipt of the malware analysis.

This invention proposes a hybrid-mode-based static analysis method for Android software, belonging to the field of malware analysis technology. It primarily addresses the accuracy degradation problem caused by existing Android cross-language static analysis frameworks using function digests for inter-function data flow connections. The main solutions include: function-level data flow analysis of the Android Java layer; lightweight inter-function data dependency analysis of the Android Native layer, generating dynamic function digests for each function; and full-program data flow analysis of the Android Java layer, where data flow connections involving Native function calls are reconstructed using function digests.

This invention discloses a method for training a large-scale reverse engineering model for malware analysis based on artificial intelligence, relating to the field of malware analysis technology. The method includes: assigning unified closed-loop identifiers to closed-loop source samples in a closed-loop source sample library for malicious behavior and vulnerability exploitation; generating closed-loop aligned intermediate representations; constructing shadow execution control samples based on a shadow redirection mechanism to obtain effective closed-loop aligned intermediate representations and corresponding shadow execution control samples; inputting the effective closed-loop aligned intermediate representations and corresponding shadow execution control samples into a dedicated training architecture, sequentially performing closed-loop consistency pre-training, supervised fine-tuning, and closed-loop evidence distillation processes to obtain a dedicated large-scale model for reverse engineering; performing reverse processing on the target sample to be tested to generate closed-loop aligned intermediate representations, inputting these representations into the dedicated large-scale model for reverse engineering, outputting structured analysis results, and writing the structured analysis results, which have undergone closed-loop integrity verification, into a security knowledge base.

The invention relates to the technical field of network security, in particular to an automatic malicious software feature conversion and unified management method, system and device based on an MAEC standard and a storage medium. The method comprises the following steps: acquiring a malicious software analysis report and analyzing static feature and dynamic feature data, establishing a field semantic mapping relationship based on a preset rule base, and automatically associating features to a behavior tag, a capability tag and a feature tag of an MAEC standard; feature extraction, mapping and standard object generation are achieved through a Python script, malicious software instance objects and behavior objects in the MAEC data model are instantiated, the incidence relation between the objects is created, and a structured description file meeting the MAEC-5. 0 standard is generated; performing semantic classification on the generated malicious software behavior objects, classifying the behavior objects related to semantics into behavior entities, and establishing a hierarchical relationship; a MongoDB and MySQL dual-database architecture is established to store an original report and structured data, and automatic operation is realized through a Linux timed task.

Techniques for providing enhanced live virtual machine file system instrumentation for security analysis are disclosed. In some embodiments, a system / process / computer program product for providing enhanced live virtual machine file system instrumentation for security analysis includes receiving a sample for automated dynamic analysis using a computing environment; freezing time in the computing environment in response to detecting an event during execution of the sample in the computing environment and reassemble one or more files; and performing an automated malware analysis using results of the automated dynamic analysis and the one or more reassembled files.

This application provides a hierarchical classification-based method and system for malware analysis. The application relates to the technical field of data processing, and includes: acquiring malware samples to be analyzed; extracting features from the malware samples to obtain feature vectors; inputting the feature vectors into a preset hierarchical classification model to obtain hierarchical classification results of the malware samples; calculating the contribution of each feature in the feature vector to each classification node in the hierarchical classification results; constructing high-dimensional numerical vectors based on the contribution; calculating the cosine similarity between the high-dimensional numerical vectors of different classification nodes; and performing correlation analysis on the cosine similarity to obtain a correlation analysis report between different malware categories. By using a hierarchical classification model to determine the family category and variant category of malware samples level by level, this method overcomes the problems of insufficient classification granularity, difficulty in characterizing category differences, and difficulty in analyzing category correlations when dealing with complex family systems or multiple variant malware.

A cyber threat information processing method, a cyber threat information processing processor, and a storage medium storing a program for processing cyber threat information may process an executable file to ensure characteristic information of the executable file, transmit the ensured characteristic information of the executable file over an independent network, and receive malware profiling information generated based on the characteristic information of the executable file over the independent network.

Embodiments of the present application disclose a mobile application security detection method and device, a computer device and a storage medium. The method comprises: obtaining an installation package file of a target mobile application, and obtaining a decompiled file of the installation package file; performing static risk detection on the decompiled file according to a static risk analysis rule to obtain a static risk analysis result; configuring a dynamic plug-in Hook point for the target mobile application according to the static risk analysis result; running the target mobile application, and obtaining running behavior data of the target mobile application through the Hook point; performing dynamic risk detection on the running behavior data according to a dynamic risk analysis rule to obtain a dynamic risk analysis result; performing feature matching on a preset malicious software feature library and the decompiled file to obtain a malicious software analysis result; and generating a security detection result of the target mobile application according to each analysis result. The security detection accuracy of the mobile application can be improved by implementing the method of the embodiments of the present application.

The invention provides a troubleshooting processing method, device, equipment and medium for a botnet infected machine in an intranet environment, and the method comprises the steps: carrying out the abnormality analysis of network flow and network behaviors corresponding to an intranet, so as to determine target equipment infected by a botnet from a plurality of pieces of communication equipment in communication connection with the intranet; isolating the target equipment from the intranet; the propagation module is used for carrying out malicious software analysis on the target equipment so as to extract the botnet from the target equipment; embedding an executable code corresponding to the propagation module into a preset special killing tool to obtain a disposal tool; the method comprises the following steps: comprehensively scanning an intranet environment through a disposal tool to determine transmission equipment with botnet infection; botnet clearing and reinforcement protection are performed on the target device and the propagation device, so that the protection capability of the infected machine in the intranet is further enhanced, and it is ensured that the infected machine does not become an attack target of the Botnet any more.

Embodiments of the present disclosure relate to explainable malware analysis. Systems, methods, and software can be used to detect malware files. In some aspects, a method includes obtaining features from a binary file to be classified as a malware file or a non-malware file; inputting the obtained features to a first trained machine learning model; outputting, by the first trained machine learning model, an encoding vector; inputting the encoding vector to a second trained machine learning model that generates text as an output; and outputting, by the second trained machine learning model, a human understandable textual explanation of malicious activities that can be performed by the binary file, the human understandable textual explanation being generated without executing the binary file, the textual explanation supporting classification of the binary file.

The invention provides a malicious software analysis system based on semantic embedding. The system comprises an input interface, a file parser, a cross-CPU architecture disassembling module, a deployed and similarity analysis module, an output interface and a malicious software similarity model training module. The input interface receives and converts suspicious malware into a machine readable format. A file parser pre-processes a binary file to generate a normalized binary file by detecting and reversing a bypass technique in a sandbox. The cross-CPU disassembly module lifts the binary file to an intermediate representation (IR), extracts and normalizes the function, and generates a function base block (NF). The deployed embedding model translates the function base block into semantic embedding. And the similarity analysis module queries the malicious sample library by using the embedded vector, calculates a similarity score and generates an analysis result containing a potential malicious software family. The output interface generates a malware report. The training module is used for offline training, and the trained model is used for runtime analysis.

Disclosed herein are systems and method for optimizing artificial intelligence (A.I)-based malware analysis on offline endpoints in a network. In one aspect, a method includes identifying a file that has not been executed on an endpoint system and scanning the endpoint system to detect malicious behavior using a machine learning algorithm. In response to determining that the endpoint system does not exhibit malicious behavior based on the machine learning algorithm, the method includes enabling execution of the file. Subsequent to the execution of the file, the method includes rescanning the endpoint system to detect malicious behavior using the machine learning algorithm. In response to determining that the endpoint system does exhibit malicious behavior subsequent to the execution, the method includes extracting attributes of the file and retraining the machine learning algorithm using the extracted attributes to detect malicious behavior associated with the file without having to execute the file.

The application relates to an anti-aging high-efficiency malicious APP detection method for constructing API correlation confidence, and belongs to the technical field of cyberspace security. First, the method is used for coping with the deviation caused by the continuous upgrading of an Android system on malicious software analysis by performing layer abstraction on API package names in APK files; second, the method is used for extracting high-level behavior semantics of software by calculating the correlation confidence between APIs; and finally, the method is used for completing the detection of malicious software by constructing classifiers for APKs in different release periods, selecting representative classifiers to learn the behavior patterns between API combinations, and completing the detection of malicious software. Current malicious software detection methods have weak software intention representation and anti-aging capability, and are difficult to detect continuously evolving and variant malicious software. The application establishes a high-level behavior intention representation mode, proposes an anti-aging strategy for a malicious software classifier, and can effectively detect continuously evolving malicious software, and has high detection efficiency and anti-aging property.

A malware detector has been designed that uses a combination of NLP techniques on dynamic malware analysis reports for malware classification of files. The malware detector aggregates text-based features identified in different pre-processing pipelines that correspond to different types of properties of a dynamic malware analysis report. From a dynamic malware analysis report, the pre-processing pipelines of the malware detector generate a first feature set based on individual text tokens and a second feature set based on n-grams. The malware detector inputs the first feature set into a trained neural network having an embedding layer. The malware detector then extracts a dense layer from the trained neural network and aggregates the extracted layer with the second feature set to form an input for a trained boosting model. The malware detector inputs the cross-pipeline feature values into the trained boosting model to generate a malware detection output.

Systems, methods, and software can be used to detect a malware file. In some aspects, a method includes: obtaining features from a binary file to be classified as either a malware file or a non-malware file; inputting the obtained features to a first trained machine learning model; outputting, by the first trained machine learning model, an encoded vector; inputting the encoded vector to a second trained machine learning model, the second trained machine learning model generating text as output; and outputting, by the second trained machine learning model, a human-understandable text explanation of malicious activities that can be performed by the binary file, the human-understandable text explanation being generated without executing the binary file, the text explanation enabling a classification of the binary file.