Symantec Corporation

Symatec Corporation

Jugal Parikh

Sandeep B Bhatkar

Reuben Feinman

Carey S Nachenberg

Andrew B Gardner

Nikolaos Vasiloglou

A computer-implemented method for selecting features for classification may include (1) generating a matrix X, a column vector Y, and a matrix Z from a training dataset that includes a plurality of samples with a plurality of features, (2) generating an augmented matrix from the matrix X, the column vector Y, and the matrix Z, (3) identifying one or more most-relevant features from the plurality of features by iteratively applying a sweep operation to the augmented matrix, and (4) training a classification model using the most-relevant features from the plurality of features rather than all of the plurality of features. Various other methods, systems, and computer-readable media may have similar features.

Systems and methods for selecting features for classification

The disclosed computer-implemented method for detecting malware based on event dependencies may include (1) applying, to a malware detection system capable of analyzing event dependencies, an event sequence derived from the execution of an application, (2) obtaining, from the malware detection system, a malware confidence score for the event sequence which the malware detection system calculates after a certain event within the event sequence has executed based at least in part on one or more dependencies between the certain event and at least one other event within the event sequence, (3) determining that the malware confidence score exceeds a threshold, and (4) classifying the application as malicious in response to determining that the malware confidence score exceeds the threshold. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting malware based on event dependencies

The disclosed computer-implemented method for detecting malware may include (1) identifying a plurality of programs represented in machine code, (2) deriving a plurality of opcode n-grams from opcode sequences within the plurality of programs, (3) training an autoencoder by using the plurality of opcode n-grams as input, (4) discovering a set of features within the autoencoder after training the autoencoder, each feature within the set of features comprising a linear combination of opcode n-grams from the plurality of opcode n-grams, and (5) classifying a potentially malicious program as malicious by using the set of features discovered within the autoencoder to analyze the potentially malicious program. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for detecting malware

Telemetry data concerning multiple samples convicted as malware by different endpoints is tracked over time. During a period of time in which telemetry data concerning convicted samples are tracked, specific samples can be convicted multiple times, both on a single endpoint and/or on multiple endpoints. The tracked telemetry data concerning the convicted samples is analyzed, and data that is indicative of false positives is identified. Convictions of samples can be exonerated as false positives, based on the results of analyzing the tracked telemetry data. More specifically, multiple data points from the tracked telemetry data that comprise evidence of false positives can be quantified and weighted. Where the evidence of false positives exceeds a given threshold, convictions of a given sample can be exonerated.

Using telemetry data to detect false positives

A computer-implemented method for detecting malware may include (1) identifying a behavioral trace of a program, the behavioral trace including a sequence of runtime behaviors exhibited by the program, (2) dividing the behavioral trace to identify a plurality of n-grams within the behavioral trace, each runtime behavior within the sequence of runtime behaviors corresponding to an n-gram token, (3) analyzing the plurality of n-grams to generate a feature vector of the behavioral trace, and (4) classifying the program based at least in part on the feature vector of the behavioral trace to determine whether the program is malicious. Various other methods, systems, and computer-readable media are also disclosed.

Growing community of inventors

Mountain View, CA, United States of America

Jugal Parikh