Ao Kaspersky Lab

Kaspersky Lab, Zao

Sergey V Prokudin

Alexey M Romanenko

Alexander S Chistyakov

Alexander V Liskin

Ilya O Tolstikhin

A method for detecting a false positive outcome in classification of files includes, analyzing a file to determine whether or not the file is to be recognized as being malicious, analyzing a file to determine whether a digital signature certificate is present for the file, in response to recognizing the file as being malicious; comparing the digital certificate of the file with one or more digital certificates stored in a database of trusted files, in response to determining that the digital signature certificate is present for the file; and detecting a false positive outcome if the digital certificate of the file is found in the database of trusted files, when the false positive outcome is detected, excluding the file from further determination of whether the file is malicious and calculating a flexible hash value of the file.

System and method of detecting a false positive outcome in classification of files

Disclosed herein are systems and methods for determining a coefficient of harmfulness of a file using a trained learning model. In one aspect, an exemplary method includes forming a first vector containing a plurality of attributes of a known malicious file. A learning model is trained using the first vector to identify a plurality of significant attributes that influence identification of the malicious file. A second vector is formed containing a plurality of attributes of known safe files. The learning model is trained using the second vector to identify attributes insignificant to the identification of the malicious file. An unknown file is analyzed by the learning model. The learning model outputs a numerical value identifying a coefficient of harmfulness relating to a probability that the unknown file will prove to be harmful.

System and method for determining a coefficient of harmfullness of a file using a trained learning model

Disclosed herein are systems and methods for reducing a number of false positives in classification of files. In one aspect, an exemplary method comprises, analyzing a file to determine whether or not the file is to be recognized as being malicious, when the file is recognized as being malicious, analyzing the file to detect a false positive outcome, when the false positive outcome is detected, excluding the file from being scanned and calculating a flexible hash of the file, and storing the calculated flexible hash in a database of exceptions.

System and method of reducing a number of false positives in classification of files

Disclosed herein are systems and methods of identifying malicious files using a learning model trained on a malicious file. In one aspect, an exemplary method comprises selecting, using a hardware processor, the malicious file from a plurality of malicious files that are known to be harmful, selecting, using the hardware processor, a plurality of safe files from a set of safe files that are known to be safe, generating, using the hardware processor, a learning model by training a neural network with the malicious file and the plurality of safe files, generating, using the hardware processor, rules for detection of malicious files from the learning model, determining, using the hardware processor, whether attributes of an unknown file fulfill the rules for detection of malicious files using the learning model and responsive to determining that the rules for detection are fulfilled, identifying, using the hardware processor, the unknown file as malicious.

System and method of identifying malicious files using a learning model trained on a malicious file

Disclosed herein are methods and systems for detecting malicious files using two stage file classification. An exemplary method comprises selecting, by a hardware processor, a set of attributes of a file under analysis, calculating, by the hardware processor, a hash of the file based on the selected set of attributes, selecting, by the hardware processor, a classifier for the file from a set of classifiers based on the calculated hash of the file, assigning, by the hardware processor, the file under analysis to the one or more categories based on the selected classifier, determining whether the file has been assigned to a category of malicious files and concluding that the file is malicious based on the determination.

System and method for detecting malicious files using two-stage file classification

Disclosed are system and method for distributing most effective antivirus records to user devices. An exemplary method includes: collecting, by a server, statistics on the use of a plurality of antivirus records deployed on a plurality of user devices; calculating, by the server, a coefficient of effectiveness of each antivirus record based on the collected statistics on the use of the plurality of antivirus records by the plurality of user devices; identifying, by the server, a group of the plurality of antivirus records having the largest coefficients of effectiveness, wherein the group is a number of the plurality of antivirus records not exceeding a threshold value; and transmitting, by the server, the group of antivirus records to at least one of the plurality of user devices for storage in an antivirus database for use by an antivirus application of the at least one user device.

System and method for distributing most effective antivirus records to user devices

Disclosed are systems and method for generating a set of antivirus records to be used for detection of malicious files on a user's devices. An exemplary method includes maintaining, by a server, a database of malicious files; generating, by the server, at least one antivirus record for each malicious file; calculating an effectiveness of each antivirus record by determining how many different malicious files were detected using each antivirus record; generating a set of most effective antivirus records; and transmitting, by the server, the set of most effective antivirus records to a client device.

System and method for generating sets of antivirus records for detection of malware on user devices

Disclosed are system and method for distributing antivirus records to user devices. An exemplary method includes collecting, by a server, statistics on the use of antivirus records; calculating a coefficient of effectiveness of each antivirus record based on the statistics; identifying one or more most effective antivirus records whose coefficients of effectiveness exceed a predetermined effectiveness threshold; identifying one or more less effective antivirus records whose coefficients of effectiveness do not exceed the predetermined effectiveness threshold; transmitting identified most effective antivirus records to a plurality of user devices for storage in antivirus databases of the user devices; receiving, from the user devices, one or more less effective antivirus records removed from the antivirus databases of the user devices; and storing the received less effective antivirus records in an antivirus database of the server if said antivirus records were not in the antivirus database of the server.

System and method for distributing antivirus records to user devices

A malware detection rule is evaluated for effectiveness and accuracy. The detection rule defines criteria for distinguishing files having a characteristic of interest from other files lacking that characteristic, for instance, malicious files vs. benign files. The detection rule is applied to a set of unknown files. This produces a result set that contains files detected from among the set of unknown files as having the at least one characteristic of interest. Each file from the result set is compared to at least one file from a set of known files having the characteristic to produce a first measure of similarity, and to at least one file from a set of known files lacking the characteristic to produce a second measure of similarity. In response to the first measure of similarity exceeding a first similarity threshold, the detection rule is deemed effective. In response to the second measure of similarity exceeding a second similarity threshold, the detection rule is deemed inaccurate.

Growing community of inventors

Moscow, Russia

Sergey V Prokudin