Systems and methods for identifying associations between malware samples
US8874579B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Dec 28, 2011 |
| Grant date | Oct 28, 2014 |
| Priority date | — |
| Expiry date | Sep 22, 2032 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/034
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
Systems and methods are disclosed for identifying associations between binary samples, such as e-mail files and their attachments or a document and an executable program associated with the document. In one implementation, the method includes receiving a plurality of binary samples, and extracting metadata from the plurality of binary samples. The metadata for a binary sample from the plurality of binary samples includes a set of attributes of the binary sample. The method further includes identifying a set of associations between the plurality of binary samples based on the extracted metadata. Each association is characterized by at least one attribute the associated binary samples have in common, and each association has a confidence level indicative of a strength of the association. The method also includes identifying associations with a confidence level that exceeds a predefined threshold.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.