Microsoft Technology Licensing, LLC

Tomer Brand

Efim Hudis

Royi Ronen

Elad Ziklik

Shay Kels

Corina Feuerstein

Dan Michelson

Disclosed herein is a system and method for identifying potential sources of malicious activity as well as identifying potentially malicious files that originated from suspected malicious sources. Using an anchor event and telemetry data from devices known to have been infected by malicious activity similar events in the telemetry data between two devices can be identified. These satellite events are then used to identify other files that may have been deposited by the satellite event such that those files can be highlighted to a malware researcher. Additionally, the malware protection may be updated based on this analysis to label an associated site with the satellite event as a malicious site such that the site may be blocked or quarantined.

Identifying suspected malware files and sites based on presence in known malicious environment

Disclosed herein is a system and method for automatically identifying potential malware files or benign files in files that are not known to be malware. Vector distances for select features of the files are compared to vectors both known malware files and benign files. Based on the distance measures a malware score is obtained for the unknown file. If the malware score exceeds a threshold a researcher may be notified of the potential malware, or the file may be automatically classified as malware if the score is significantly high.

Matrix factorization for automated malware detection

Growing community of inventors

Hod Hasharon, Israel

Tomer Brand