CN107889551B - 用于识别恶意软件的异常检测 - Google Patents

用于识别恶意软件的异常检测 Download PDF

Info

Publication number
CN107889551B
CN107889551B CN201680037889.8A CN201680037889A CN107889551B CN 107889551 B CN107889551 B CN 107889551B CN 201680037889 A CN201680037889 A CN 201680037889A CN 107889551 B CN107889551 B CN 107889551B
Authority
CN
China
Prior art keywords
metadata
activity
outlier
network
analysis
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201680037889.8A
Other languages
English (en)
Chinese (zh)
Other versions
CN107889551A8 (zh
CN107889551A (zh
Inventor
J.比恩
J.R.斯普尔洛克
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
McAfee LLC
Original Assignee
McAfee LLC
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by McAfee LLC filed Critical McAfee LLC
Publication of CN107889551A publication Critical patent/CN107889551A/zh
Publication of CN107889551A8 publication Critical patent/CN107889551A8/zh
Application granted granted Critical
Publication of CN107889551B publication Critical patent/CN107889551B/zh
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Virology (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Debugging And Monitoring (AREA)
CN201680037889.8A 2015-06-27 2016-05-25 用于识别恶意软件的异常检测 Active CN107889551B (zh)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US14/752893 2015-06-27
US14/752,893 US10129291B2 (en) 2015-06-27 2015-06-27 Anomaly detection to identify malware
PCT/US2016/033978 WO2017003588A1 (en) 2015-06-27 2016-05-25 Anomaly detection to identify malware

Publications (3)

Publication Number Publication Date
CN107889551A CN107889551A (zh) 2018-04-06
CN107889551A8 CN107889551A8 (zh) 2020-08-28
CN107889551B true CN107889551B (zh) 2021-07-06

Family

ID=57602972

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201680037889.8A Active CN107889551B (zh) 2015-06-27 2016-05-25 用于识别恶意软件的异常检测

Country Status (5)

Country Link
US (1) US10129291B2 (enExample)
EP (1) EP3314511B1 (enExample)
JP (1) JP6598221B2 (enExample)
CN (1) CN107889551B (enExample)
WO (1) WO2017003588A1 (enExample)

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10009374B1 (en) * 2015-08-04 2018-06-26 Symantec Corporation Detecting URL scheme hijacking
US10089467B1 (en) 2017-05-23 2018-10-02 Malwarebytes Inc. Static anomaly-based detection of malware files
US10708281B1 (en) * 2018-04-16 2020-07-07 Akamai Technologies, Inc. Content delivery network (CDN) bot detection using primitive and compound feature sets
US10992703B2 (en) 2019-03-04 2021-04-27 Malwarebytes Inc. Facet whitelisting in anomaly detection
CN112583846A (zh) * 2020-12-25 2021-03-30 南京联成科技发展股份有限公司 一种面向中小企业网络安全事件复杂分析系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102195992A (zh) * 2010-11-01 2011-09-21 卡巴斯基实验室封闭式股份公司 用于对从网络下载的数据进行反病毒扫描的系统及方法
CN102932424A (zh) * 2012-09-29 2013-02-13 浪潮(北京)电子信息产业有限公司 一种分布式并行文件系统缓存数据同步的方法及系统
CN102985928A (zh) * 2010-07-13 2013-03-20 F-赛酷公司 识别多态性恶意软件
US8806641B1 (en) * 2011-11-15 2014-08-12 Symantec Corporation Systems and methods for detecting malware variants

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6073142A (en) 1997-06-23 2000-06-06 Park City Group Automated post office based rule analysis of e-mail messages and other data objects for controlled distribution in network environments
US5987610A (en) 1998-02-12 1999-11-16 Ameritech Corporation Computer virus screening methods and systems
US6460050B1 (en) 1999-12-22 2002-10-01 Mark Raymond Pace Distributed content identification system
US6901519B1 (en) 2000-06-22 2005-05-31 Infobahn, Inc. E-mail virus protection system and method
US20070050777A1 (en) * 2003-06-09 2007-03-01 Hutchinson Thomas W Duration of alerts and scanning of large data stores
US8505092B2 (en) * 2007-01-05 2013-08-06 Trend Micro Incorporated Dynamic provisioning of protection software in a host intrusion prevention system
US8171554B2 (en) 2008-02-04 2012-05-01 Yuval Elovici System that provides early detection, alert, and response to electronic threats
US8732825B2 (en) * 2008-05-28 2014-05-20 Symantec Corporation Intelligent hashes for centralized malware detection
US9781148B2 (en) * 2008-10-21 2017-10-03 Lookout, Inc. Methods and systems for sharing risk responses between collections of mobile communications devices
US8561180B1 (en) * 2008-10-29 2013-10-15 Symantec Corporation Systems and methods for aiding in the elimination of false-positive malware detections within enterprises
US8997219B2 (en) * 2008-11-03 2015-03-31 Fireeye, Inc. Systems and methods for detecting malicious PDF network content
US8225406B1 (en) * 2009-03-31 2012-07-17 Symantec Corporation Systems and methods for using reputation data to detect shared-object-based security threats
US7640589B1 (en) 2009-06-19 2009-12-29 Kaspersky Lab, Zao Detection and minimization of false positives in anti-malware processing
US8302194B2 (en) * 2009-10-26 2012-10-30 Symantec Corporation Using file prevalence to inform aggressiveness of behavioral heuristics
US8516576B2 (en) * 2010-01-13 2013-08-20 Microsoft Corporation Network intrusion detection with distributed correlation
US8528088B2 (en) 2011-05-26 2013-09-03 At&T Intellectual Property I, L.P. Modeling and outlier detection in threat management system data
US8984581B2 (en) 2011-07-27 2015-03-17 Seven Networks, Inc. Monitoring mobile application activities for malicious traffic on a mobile device
US8931092B2 (en) 2012-08-23 2015-01-06 Raytheon Bbn Technologies Corp. System and method for computer inspection of information objects for shared malware components

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102985928A (zh) * 2010-07-13 2013-03-20 F-赛酷公司 识别多态性恶意软件
CN102195992A (zh) * 2010-11-01 2011-09-21 卡巴斯基实验室封闭式股份公司 用于对从网络下载的数据进行反病毒扫描的系统及方法
US8806641B1 (en) * 2011-11-15 2014-08-12 Symantec Corporation Systems and methods for detecting malware variants
CN102932424A (zh) * 2012-09-29 2013-02-13 浪潮(北京)电子信息产业有限公司 一种分布式并行文件系统缓存数据同步的方法及系统

Also Published As

Publication number Publication date
US20160381041A1 (en) 2016-12-29
CN107889551A8 (zh) 2020-08-28
EP3314511A1 (en) 2018-05-02
JP2018524716A (ja) 2018-08-30
JP6598221B2 (ja) 2019-10-30
WO2017003588A1 (en) 2017-01-05
EP3314511B1 (en) 2020-05-06
US10129291B2 (en) 2018-11-13
EP3314511A4 (en) 2019-02-13
CN107889551A (zh) 2018-04-06

Similar Documents

Publication Publication Date Title
US10579544B2 (en) Virtualized trusted storage
US11379583B2 (en) Malware detection using a digital certificate
US10176344B2 (en) Data verification using enclave attestation
CN107409120B (zh) 检测恶意外设的装置、方法及系统
CN107980123B (zh) 敏感数据的保护
US20160180092A1 (en) Portable secure storage
US20180007070A1 (en) String similarity score
CN107431694A (zh) 加密密钥取回
US11032266B2 (en) Determining the reputation of a digital certificate
CN107409119B (zh) 通过网络特性来确定信誉
CN107889551B (zh) 用于识别恶意软件的异常检测
JP2018524716A5 (enExample)

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
CI02 Correction of invention patent application
CI02 Correction of invention patent application

Correction item: Applicant

Correct: MCAFEE, Inc.

False: MCAFEE, Inc.

Number: 14-02

Page: The title page

Volume: 34

Correction item: Applicant

Correct: MCAFEE, Inc.

False: MCAFEE, Inc.

Number: 14-02

Volume: 34

GR01 Patent grant
GR01 Patent grant