利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

3 条记录 (耗时 0.009 秒)

    Systems and methods for identifying associations between malware samples
    3.
    发明公开
    Systems and methods for identifying associations between malware samples 有权
    用于识别恶意软件样本之间关联的系统和方法

    公开(公告)号：EP2560120A2

    公开(公告)日：2013-02-20

    申请号：EP12180484.3

    申请日：2012-08-14

    申请人： Verisign, Inc.

    发明人： Sinclair, Gregory ,  Olson, Ryan ,  Falcone, Robert

    IPC分类号： G06F21/00 ,  G06F17/30

    CPC分类号： G06F21/565 ,  G06F16/338 ,  G06F16/35 ,  G06F16/353 ,  G06F16/38 ,  G06F16/907 ,  G06F21/564 ,  G06F2221/034 ,  G06Q10/10 ,  H04L51/12 ,  H04L63/1416 ,  H04L63/1441 ,  H04L63/145

    摘要： Systems and methods are disclosed for identifying associations between binary samples, such as e-mail files and their attachments or a document and an executable program associated with the document. In one implementation, the method includes receiving a plurality of binary samples, and extracting metadata from the plurality of binary samples. The metadata for a binary sample from the plurality of binary samples includes a set of attributes of the binary sample. The method further includes identifying a set of associations between the plurality of binary samples based on the extracted metadata. Each association is characterized by at least one attribute the associated binary samples have in common, and each association has a confidence level indicative of a strength of the association. The method also includes identifying associations with a confidence level that exceeds a predefined threshold.

    摘要翻译： 公开了用于识别诸如电子邮件文件及其附件或文档以及与文档相关联的可执行程序之间的关联的系统和方法。 在一个实现中，该方法包括接收多个二进制样本，并从多个二进制样本中提取元数据。 来自多个二进制样本的二进制样本的元数据包括二进制样本的一组属性。 该方法进一步包括基于所提取的元数据来识别多个二进制样本之间的一组关联。 每个关联的特征在于至少一个相关联的二进制样本具有共同的属性，并且每个关联具有指示关联的强度的置信度。 该方法还包括识别具有超过预定义阈值的置信度的关联。