RU2808385C1 - Method for classifying objects to prevent spread of malicious activity - Google Patents

Abstract

FIELD: information security.

SUBSTANCE: methods for identifying malicious packet switch nodes and intermediate nodes through which malware is distributed. According to an implementation option, a method is used to classify objects to prevent the spread of malicious activity, made with the ability to implement steps according to which the following is performed: search for objects on the network that have common information with other objects; constructing a connection graph containing classified and unclassified objects in the form of vertices, and the connection between the objects indicates the presence of common information between the objects, and the classified objects are malicious objects; selecting from the generated connection graph at least one subgraph, including homogeneous objects and containing at least one unclassified object, based on at least one of the approaches: analysis of group connections between objects; analysis of sequential communication between objects; performing a classification of each unclassified object in each subgraph based on the analysis of the objects using classification rules; restricting access to an object that is classified as malicious to prevent the spread of malicious activity.

EFFECT: preventing the spread of malicious activity on a computer network.

15 cl, 7 dwg

Description

Field of technology

The invention relates to the field of information security, and more specifically to methods for identifying malicious network nodes or intermediate network nodes through which malware is distributed.

State of the art

Malware is constantly evolving, challenging information security service providers to keep up with the ever-changing threat landscape. Among other things, attackers are developing ways to distribute malware and using new vulnerabilities to penetrate computer systems (hereinafter referred to as computers).

Currently, various types of attacks on computer network resources are used. For example, an attack on computer network resources, which consists of an attacker registering a domain name for the subsequent distribution of malware or using this domain name for phishing.

Such attacks can be used to redirect users to a malicious or phishing website or fake email service of the attacker's choosing. The pages of these websites may contain, for example, Trojan horses or viruses, and a fake email service may ask the user for a login and password to the mailbox and transfer these credentials to the attacker. A visitor to a phishing website will not be aware of the spoofing and will likely download malware onto their computer.

The solution presented in patent US10178121B2 is known from the prior art. As a solution, a domain rating system is presented based on domain name registration data and the similarity of the domain name to malicious domain names. The system includes a dynamic domain database configured to provide real-time domain registration data across all domain extensions. Domains are regularly re-evaluated for consistency in ratings, helping to maintain the security of visitors to hosted websites or automated connections to the infrastructure present in the domain.

This technology quite effectively solves the problem of classifying malicious domains. But despite a number of advantages, this invention takes into account only the similarity based on WHOIS and DNS information, but does not take into account other factors, for example, such as the connection with malicious domain names by URI and the analysis of the connection of domain names based on homogeneous objects associated with it, while objects are homogeneous if there is general information about the object. Therefore, the technical task of creating a method for classifying objects to prevent the spread of malicious activity remains relevant.

Disclosure of the invention

The objective of the proposed solution is to classify objects to prevent the spread of malicious activity.

The technical result of the present invention is to prevent the spread of malicious activity on a computer network.

As one embodiment of the present invention, a method is provided for classifying objects to prevent the spread of malicious activity, configured to implement the steps of: searching for objects on a network that share information with other objects; constructing a connection graph containing classified and unclassified objects in the form of vertices, and the connection between the objects indicates the presence of common information between the objects, and the classified objects are malicious objects; selecting from the generated connection graph at least one subgraph, including homogeneous objects and containing at least one unclassified object, based on at least one of the approaches: analysis of group connections between objects; analysis of sequential communication between objects; perform a classification of each unclassified object in each subgraph based on the analysis of the objects using classification rules; restrict access to an object that is classified as malicious to prevent the spread of malicious activity.

In another embodiment of the method, the other objects are either objects that are classified as malicious, or objects that have a common relationship with objects that are classified as malicious.

In another embodiment of the method, the classification rules include at least one of the following approaches: analysis for similarity of objects; object analysis using a machine learning model.

In another embodiment of the method, similarity analysis is implemented using the Levenshtein metric.

In another embodiment of the method, the connection graph contains connections only between objects of different types.

In another embodiment of the method, the objects and information about the objects are at least two of the following types of information: IP address; fully qualified domain name; URI information; domain name information, including information about the domain name registrar; information about the owner of the domain name, including the name of the owner to whom the domain name belongs, the address of the owner of the domain name, the range of IP addresses to which the domain name belongs on the network, and contact information of the owner of the domain name; information about the owner of the IP address, including the name and address of the owner of the IP address; name of the computer network range; location corresponding to the range of IP addresses, including country and city; administrator contact details; information about the IP address to which the object being checked belongs; information about public key certificates issued for the domain name; file hash and file path; web addresses containing a domain name.

In yet another embodiment of the method, additional information about objects includes one of the following components of URI information: page address; page loading parameters; other constituent parts of URI information.

In another embodiment, step b) further classifies unclassified domain name objects as trusted if the number of requests received from the domain name system exceeds a predetermined threshold.

In yet another embodiment, related components are extracted from at least one subgraph that contain information about related objects, wherein at least one object is unclassified.

In another embodiment, each of these analysis approaches is carried out using at least one machine learning model.

In another embodiment, the machine learning model is trained using the “decision tree boosting” method.

In another embodiment, the analysis based on serial communication uses at least one neighboring malicious object.

In yet another embodiment, when analyzing a group connection, information about at least four objects is used, and three of them have a connection with the fourth.

In another embodiment, access to an object that is classified as malicious is limited to prevent the spread of malicious activity by one of the following actions: access to the website with which the object is associated is blocked; open the website with which the object is associated in a browser running in protected mode; suspend the transition to the website and inform the user about the connection of the website with a malicious object.

Brief description of drawings

The accompanying drawings illustrate only exemplary embodiments of the invention and therefore should not be considered limiting its scope. Additional objects, features and advantages of the present invention will become apparent from a reading of the following description of the invention with reference to the accompanying drawings, in which:

Fig. 1 illustrates an example of a computer network within which an object classification system is implemented.

Fig. 2 illustrates an example of the composition of an object classification system.

Fig. Figure 3 illustrates an example of a constructed connection graph with subgraphs in which the vertices are classified using sequential connection analysis.

Fig. Figure 4 illustrates an example of a constructed connection graph with subgraphs in which the vertices are classified using group connection analysis.

Fig. 5a-5b illustrate examples of the connection graph and their analysis.

Fig. 6 illustrates a method for classifying objects to prevent the spread of malicious activity.

Fig. 7 illustrates an example of a general purpose computer system.

Carrying out the invention

Objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, but may be embodied in various forms. The substance set forth in the specification is nothing more than the specific details necessary to assist one skilled in the art in fully understanding the invention, and the present invention is defined within the scope of the appended claims.

In FIG. 1 shows an example of a computer network 110, including at least six computers (PC1 - PC6), and a computer device (server) 120, which in turn includes an information collection module 130 and an object classification system 140.

In one embodiment, the computer network 110 is one of the network nodes on the Internet. Another example of a computer network 110 may be the entire Internet.

For the purposes of this invention, a computer means any computing device, in particular a personal computer, laptop, smartphone, tablet, router, storage system, server. An example of a server 120 that implements the classification system 140 is the computer system described in the discussion of FIG. 7.

The information collection module 130 is designed to collect information about objects and transmit the collected information about objects to the object classification system 140. During the collection of information about objects, a search is made for objects in the network 110 that have common information with objects that were previously classified as malicious, or with objects that in turn have common information with objects that are classified as malicious. The objects found in the network 110 are unclassified objects.

The object classification system 140 is designed to classify objects in order to subsequently prevent the spread of malicious activity based on the classification. The objects over which classification is carried out are at least one of the following objects: fully qualified domain name (hereinafter referred to as the domain name); URI information; IP address; domain name information, including information about the domain name registrar; information about the owner of the domain name, including the name of the owner who owns the domain name, the address of the owner of the domain name, the range of IP addresses to which the domain name belongs on the network and contact information of the owner of the domain name; information about the owner of the IP address, including the name and address of the owner of the IP address; name of the computer network range; location corresponding to the range of IP addresses, including country and city; administrator contact details; information about the IP address to which the object being checked belongs; information about public key certificates issued for the domain name; file hash and file path; web addresses containing a domain name. Depending on the implementation option, object classification can be carried out either for one type of object, for example, a domain name, or for two or more types of objects. Classification is carried out on the basis of classification rules that take into account various characteristics and relationships of objects in the subgraph. It is worth noting that in the future, when mentioning any one type of object, other types of objects can be used.

In yet another embodiment, the classification is carried out into two classes, namely malicious and trusted. In this embodiment, it is possible that there is not enough information about the object for an unambiguous classification. In this case, the object remains unclassified until there is enough information about the object for an unambiguous classification.

It is worth noting that in other implementations, the classification of objects can be carried out into two or more classes, and other classes can be selected. For example, objects are classified into malicious, non-malicious, and trusted.

In FIG. 2 shows an example of the composition of an object classification system 140, which contains a graph construction module 210, an object database 205, a malicious object database 220, a trusted object database 230 and an analyzer 240.

The graph construction module 210 is designed to construct a connection graph based on information from the database of malicious objects 220 and information about objects received from the information collection module 130.

The database of malicious objects 220 contains information about known malicious objects, as well as information about objects associated with them. The connection between objects means the presence of common information between these objects. For example, the malicious object database 220 stores the IP address 192.158.0.13, the information collection module 130 collects information about domain names that refer to this IP address from the computer network 110. In this example, the specified IP address is the link (link) between objects.

In one embodiment, the information collection module 130 contains a database of objects 205. The object database 205 contains information about the relationships and class of objects collected by the information collection module 130. In this embodiment, the malicious object database 220 stores at least markup for the objects. When applied to domain names, the malicious object database 220 stores masks for malicious and phishing domain names. Mask - limited regular expressions that replace part of a domain name with asterisks. The object database 205 also contains the date the mask was added and other attributes, for example, the malware family (hereinafter referred to as malware), malware category, etc. In the case of, for example, a file, the malicious object database 220 contains the md5 of the file, the malware name, etc. In other words, the malicious object database 220 stores malicious object keys (e.g., masks and hashes) that correspond to several objects from the object database 205 In this case, the graph construction module 210 builds a graph based on information from the malicious object database 220 and information about objects from the object database 205.

An example of information contained in the database of malicious objects 220 and/or the information collection module 130 (depending on the implementation) is:

• malicious domain name “malware.com”;

• IP address 192.158.0.13;

• information that the specified domain name refers to the specified IP address.

Information about known malicious objects contains at least one of:

• information about the object obtained using the WHOIS service;

• information about the object obtained using the WHOIS IP service;

• information about the object obtained using the domain name system;

• information about public key certificates issued for the domain name;

• web addresses containing information about the page, its download parameters and the files located on it.

The database of malicious objects 220 can receive information from various sources. Such sources can be either external sources, for example, the WHOIS service, or internal ones, namely, the 240 analyzer.

In turn, information about an entity obtained using the WHOIS service contains at least one of:

• information about the owner of the domain name, including the name of the owner who owns the domain name, the name of the company, the address of the owner of the domain name or contact information of the owner of the domain name;

• contact details of the domain name administrator;

• information about the domain name registrar;

• date of creation of the domain name;

• domain name registration period;

• current status of the domain name.

Entity information obtained using the WHOIS IP service contains information about at least one of:

• the range of IP addresses to which the object being scanned belongs;

• name of the computer network range;

• the owner of the IP address, including the name and address of the owner of the IP address;

• the country to which this range of IP addresses corresponds;

• the city to which this range of IP addresses corresponds.

Information about an object obtained using the domain name system means information about the IP address to which the object being checked belongs.

Information about public key certificates issued for a domain name contains information about certificates issued for a domain name by certification authorities. An example of such certificates is an SSL certificate (Secure Sockets Layer).

Web address information contains information about the protocol, fully qualified domain name, port, as well as the hash (from the English hash) of a specific file on the web server, the path to a specific file on the web server and URI information (from the English Uniform Resource Identifier ) of the form <scheme>:[//<host>[:<port>]][/<page address>][?<page loading parameters>].

In a particular implementation case, information about each malicious object is contained in the database of malicious objects 220 until the object classification system 120 receives a notification that the corresponding object has been blocked. After receiving information about blocking an object, the object classification system 120 updates the information using the analyzer 240 in the database of malicious objects 220.

In another particular implementation case, the database of malicious objects 220 additionally contains information about the storage time of information about each malicious object, for example, six months, after which this information about the malicious object is deleted from the database of malicious objects 220. For the most efficient storage of information, as well as for To minimize false positives during analysis, the storage time of information can be chosen in a practical way. For example, attackers often exploit short-lived domain names, often linking new domain names to previously used IP addresses, after which sites distributing malware are blocked by antivirus solutions. Therefore, to update information about malicious objects, it is necessary to periodically update the database of malicious objects 220.

In another particular case of implementation, both in the malicious object database 220, which stores object markings, and in the object database 205, data is periodically updated, for example, once every six months, based on information received from external sources, for example, the WHOIS service.

The trusted object database 230 contains a list of trusted objects. For example, a trusted domain name is a domain name that is requested from a DNS server with high frequency, that is, the frequency exceeds a predefined threshold. Also, trusted objects are objects that have been analyzed in advance and recognized as legitimate.

In a preferred embodiment, graph builder 210 builds a link graph as follows:

At the first stage, it forms vertices, which are objects from the database of malicious objects 220 and information about objects received from the information collection module 130.

In a particular implementation, it generates vertices using information about objects from the object database 205. In this case, objects that are not classified are stored in the object database 205, and malicious objects are stored in the malicious object database 220. If information about an object from the object database 205 is present in the malicious object database 220, the corresponding vertex is classified as malicious.

At the second stage, the graph construction module 210 connects two vertices with an edge in cases where the corresponding objects are connected. For example, two vertices correspond to two domain names, and they refer to the same IP address. In this case, edges will be built in the graph between the vertex, which is an IP address, and each of the two vertices, which are domain names. Another example is that forty vertices corresponding to IP addresses belong to one IP range. In this case, edges will be built in the graph between a vertex that is an IP range with each of the forty vertices that are IP addresses. Thus, the graph construction module 210 builds all the edges based on information about the connections between objects.

In a particular implementation, the connection graph contains connections only between objects of different types. That is, a connection like domain name and domain name will not be built.

Initially, the connection graph contains two classes of vertices: malicious and unclassified. Malicious vertices correspond to malicious objects from the database of malicious objects 220. Unclassified vertices correspond to objects about which information was received from the information collection module 130. It is worth noting that during the analysis described below, if there is sufficient information about the object, unclassified vertices are changed to one of two classes vertices, namely malicious or trusted. If there is not enough information about the object for an unambiguous classification, the vertex will remain unclassified. The class to which the vertex will correspond depends on the results of the analysis performed.

In a particular implementation, the graph builder 210 further connects vertices based on URI information (eg, page address, page load parameters, and other components of the URI information), WHOISIP, and WHOIS information.

Analyzer 240 serves to extract at least one subgraph from the relationship graph, as well as to analyze unclassified objects in the subgraph. It is worth noting that all objects located in the same subgraph are homogeneous.

Analyzer 240 extracts from the relationship graph at least one subgraph that includes homogeneous objects and contains at least one unclassified object, based on at least one of the following approaches:

• analysis of group communication between objects;

• analysis of sequential communication between objects.

It is worth noting that the analyzer 240 for each approach uses a corresponding machine learning model that is trained to implement the corresponding approach. Each machine learning model is based on one of the above approaches.

In a particular implementation, the machine learning model is based on the principle of “boosting decision trees.” A decision tree is a hierarchical tree structure consisting of a rule of the form “If ... then ...”. During training, the machine learning model receives as input a sample of information about objects from triplets of objects of the form “malicious of one type, intermediate of another type, malicious of the same type as the first” and “malicious of one type, intermediate of another type, trusted of the same type as the first " It is worth noting that an intermediate object is an object associated with the first and last object of a triple of objects.

In other particular implementations, the machine learning model is based on principles such as the k-nearest neighbors method (from the English k Nearest Neighbors, kNN), neural network, support vector machine, etc.

In a particular implementation, before extracting a subgraph from the link graph, analyzer 240 determines for each unclassified vertex in the link graph the number of queries corresponding to these vertices for domain names to the DNS server. If the number of queries to the DNS server exceeds a predetermined threshold, for example 10,000 queries, then the analyzer 240 classifies this vertex as trusted and adds the corresponding domain name to the trusted object database 230. The specified domain name is excluded from further analysis.

In yet another particular implementation, before extracting a subgraph from the link graph, analyzer 240 determines for each unclassified vertex in the link graph the number of queries corresponding to these vertices of domain names to the DNS server. If the number of queries to the DNS server exceeds a specified threshold, for example 10,000 queries, then the analyzer 240 eliminates the corresponding vertex from the relationship graph.

Depending on the implementation option, these analysis approaches can be applied in various combinations and sequences. In one implementation, the analyzer 240 uses both approaches in sequence when analyzing, for example, in the following order: serial communication analysis, group communication analysis. In another implementation, analyzer 240 uses approaches in parallel. In yet another embodiment, the analyzer 240, when using the approaches sequentially after each approach, determines whether to use the subsequent approach. The need to use a subsequent approach is determined based on the results obtained from the previous approach. In another implementation, the analyzer 240 uses the approaches in parallel and, after receiving the results, generates a single result.

When the analyzer 240 uses a serial link analysis approach, the analyzer 240 analyzes triplets of vertices in a link graph based on feature information using a machine learning model trained for the task. It is worth noting that when analyzing using the serial communication analysis approach, the analyzer 240 analyzes triplets of vertices of the form “a malicious vertex of one type, an intermediate vertex of another type, an unclassified vertex of the same type as the first.”

In a particular embodiment, analysis based on serial communication uses at least one neighboring malicious object, as well as information about at least three objects that have a connection.

Let us consider the operation of this approach based on the connection graph constructed by the graph construction module 240 and presented in FIG. 3. Unclassified vertices of the domain type are designated as “u”, malicious vertices of the domain type are designated as “m”, vertices corresponding to uri information as “uri”, and vertices corresponding to ip as “ip”. For example, analyzer 240 provides the machine learning model with information about a malicious domain name corresponding to vertex m2 and information about an unclassified domain name corresponding to vertex u2. The vertices u2 and m2 are connected through the vertex uri, which corresponds to the common part of the URI information. If the machine learning model determines that the information about these domain names is similar, then the analyzer 240 will add this trio of vertices to a subgraph for further analysis.

Let's look at another example. Analyzer 240 provides the machine learning model with information about the malicious domain names corresponding to vertices m3 and m1, as well as information about the unclassified domain name corresponding to vertex u3. If the machine learning model decides that vertices m1 and u3 are similar, then analyzer 240 will add the trio of vertices m1, ip, u3 to the subgraph for further analysis. If the machine learning model decides that the vertices m3 and u3 are similar, then the analyzer 240 will add the trio of vertices m3, uri, u3 to the subgraph for further analysis, and since the vertex u3 was already in the subgraph, the subgraph will be supplemented with new vertices. Thus, the subgraph will consist of the following vertices: m1, ip, u3, uri, m3.

Analyzer 240 analyzes the remaining links in the link graph of the form “malicious node, intermediate node of a different type, unclassified node of the same type as the first” similar to the examples that were described earlier.

In the case where the analyzer 240 uses a group link analysis approach, the analyzer 240 analyzes the links in the link graph based on the entity information using a machine learning model trained for the task. During training, a machine learning model receives as input an object that is not a domain name and aggregated information about all objects associated with the analyzed object. Let us consider the operation of this approach based on the connection graph constructed by the graph construction module 210 and presented in FIG. 4. The unclassified vertex is denoted as “u”, the malicious vertex as “m”, the vertex corresponding to the public IP address as “ip1”, and the vertex corresponding to the common part of the URI as “uri1”. Peaks m1, u1 and u2 are connected to node ip1, since their corresponding domain names have a common IP address, and nodes u2, u3, u4, m2, m3, m4 are connected to node uri1, since their corresponding domain names have a common part URI. In this approach, analyzer 240 analyzes vertices uri1 and ip1. For example, analyzer 240 provides the machine learning model with the object uri1 and information about all vertices connected by an edge to vertex uri1. If the machine learning model provides output to analyzer 240 that the object corresponding to vertex uri1 is similar to a malicious URI information object, then analyzer 240 will add vertex uri1 and all its associated vertices to the subgraph for further analysis. The vertex ip1 will be analyzed in a similar way.

In a particular embodiment, when analyzing based on the group connection analysis approach, information about at least four objects is used, and three of them must be associated with the fourth.

In a particular implementation, the objects identified by analyzer 240 are not added to the overall subgraph, but are analyzed only based on neighboring vertices.

After extracting a subgraph from the link graph, analyzer 240 classifies the unclassified objects of the extracted subgraph based on the analysis of the objects using classification rules.

In a particular embodiment, from at least one subgraph, using the analysis approaches described above, related components are extracted that contain information about related objects, wherein at least one object is unclassified.

Classification rules include at least one of the following approaches:

• analysis for similarity of objects;

• analysis of objects using classification rules.

When using the feature similarity analysis approach, analyzer 240 analyzes the vertices of a subgraph based on feature information in one of the following ways:

a) similarity based on the Levenshtein metric (V.I. Levenshtein, Binary codes with correction of deletions, insertions and substitutions of symbols, Dokl. AN USSR, 1965, volume 163, number 4, 845-848);

b) similarity based on the machine learning model.

Analyzer 240 contains at least one machine learning model. First, the machine learning model is trained on a data sample consisting of pairs of objects, namely pairs of similar objects and pairs of dissimilar objects, and the objects must be of the same type. The result of training is a model that determines the similarity of the objects received as input. By using a similarity analysis approach using a machine learning model, analyzer 240 analyzes more complex dependencies of pairs of objects. For example, two random domain names of approximately the same length - jsidfjk.com and reuhuh.com - would be identified by a machine learning model as similar. Another pair of domain names - jsidfjk.com and myaddress.com - will be identified by the machine learning model as dissimilar because the first domain name consists of a random set of characters and the second does not.

In one implementation, the machine learning model, when provided with a decision about the similarity of information about objects, calculates a value indicating how similar or different the objects are.

In a particular implementation, a value indicating how similar objects are, expressed as a percentage.

In yet another particular implementation, a value indicating how similar the objects are is represented as a number between 0 and 1.

In another implementation, a value indicating how similar objects are is expressed by degree of similarity: “not similar”, “somewhat similar”, “similar”.

If the analyzer 240, based on the use of at least one of the mentioned methods, has classified an unclassified vertex from the subgraph as malicious, then the analyzer 240 adds either the corresponding object or the object markup (masks, hashes) to the database of malicious objects 220.

When using the "object analysis using classification rules" approach, analyzer 240 analyzes the vertices of a subgraph using specified classification rules. Typically, classification rules are formed with the help of a user who has the necessary qualifications and knowledge in the field of information security. For example, if the machine learning model provides output to analyzer 240 that the object corresponding to vertex uri1 is similar to a malicious URI information object, but the number of unclassified vertices in the subgraph is greater than a certain number or the number of unclassified vertices is less than a certain percentage of the total number of vertices associated with the vertex uri, the parser 240 will not classify previously unclassified vertices as malicious. Such rules are necessary to minimize false positive classification.

In a particular embodiment, analyzer 240 analyzes the vertices of a subgraph using a machine learning model, namely a graph neural network.

Above, two main analysis approaches were presented for identifying subgraphs based on the analysis of the link graph by the analyzer 240 (serial link analysis and group link analysis). It is worth noting that the results of extracting subgraphs from the connection graph and subsequent classification using these approaches may differ. Thus, analyzer 240 can analyze vertices using one of the presented analysis approaches, however, when using both types of analysis, the number of detected malicious vertices increases, resulting in increased efficiency of the analysis.

Based on the classification of objects carried out by the analyzer 240, the spread of malicious activity is prevented using one of the means of protection (not shown in Fig. 1) of the user’s computer device from malicious objects, among others, in one of the following ways:

• restrict access to an object that is classified as malicious;

• completely block access to a website that belongs to a malicious object;

• open a website related to a malicious object in a browser running in protected mode;

• pause the transition to the website and inform the user about the connection of the website with a malicious object.

To better understand the operation of the present invention, let us consider an example of its operation.

The information collection module 130, after collecting information about objects, transmits information about the objects to the graph construction module 210. Based on the information about objects received from the information collection module 130, as well as information stored in the database of malicious objects 220, the graph construction module 210 builds a connection graph . Analyzer 240 analyzes the number of requests for each unclassified vertex of type domain name. If the number of requests exceeds a certain number, then the analyzer 240 classifies the vertex to which the corresponding unclassified domain name belongs as trusted and adds the corresponding domain name and IP address to the trusted object database 230. Next, the analyzer 240 uses serial communication analysis and/or or group communication analysis identifies at least one subgraph, such as those shown in FIG. 5a and fig. 5 B.

In fig. 5a, unclassified vertices are represented as squares, malicious vertices as circles, and IP addresses as triangles. The vertex triple m2, URI 2, u1 was added to the subgraph using serial link analysis. Vertex URI 1 and its associated vertices were added to the subgraph using group link analysis. URI vertex 1 is malicious, URI vertex 2 is unclassified.

After identifying at least one subgraph, analyzer 240 analyzes the object information of each pair of malicious and unclassified vertices using object similarity analysis using a machine learning model. If the machine learning model outputs to analyzer 240 a decision that the unclassified object is similar to a malicious object, analyzer 240 classifies the previously unclassified vertex as malicious.

When analyzing the pair of vertices URI 1 and URI 2 in Fig. 5a, the analyzer 240 classified the vertex URI 2 as malicious and added the corresponding object to the database of malicious objects 220.

In the next step, analyzer 240 applies object analysis using classification rules. In this example, the rule “If the number of malicious vertices is more than 75% of the total number of vertices in the subgraph, classify all vertices as malicious” worked. Thus, the analyzer 240 classifies all unclassified vertices as malicious and added objects corresponding to these vertices to the database of malicious objects 220.

Let's look at another example of how the invention works. In FIG. 5b shows the subgraph extracted by analyzer 240. The IP link vertex and its associated vertices were added to the subgraph using group link analysis. The top IP connection is malicious.

In the first step, analyzer 240 analyzes the object information of each pair of malicious and unclassified vertices using object similarity analysis using a machine learning model. If the machine learning model provides output to analyzer 240 that an unclassified object is similar to a malicious object, analyzer 240 will classify the previously unclassified vertex as malicious and add the corresponding object to the database of malicious objects 220. In this example, when analyzing a pair of vertices u1 and m3, the analyzer 210 classified vertex u1 as malicious and added the corresponding object to the database of malicious objects 220.

In the next step, analyzer 240 applies object analysis using classification rules. In this example, none of the rules worked.

Fig. 6 illustrates a special case of implementing a method for classifying objects, namely a method for classifying domain names to prevent the spread of malicious activity. Further, when describing the stages of the method, the “domain name” attribute is used as the “object” attribute, and depending on the implementation options, any other object specified within the scope of the present invention, or a combination of them, can be used.

At step 610, the information collection module 130 collects information about objects, in particular domain names, in the network 110. During the collection of information about objects, a search is made for objects in the network 110 that have common information with:

• objects that were previously classified as malicious,

• objects that, in turn, have common information with objects that are classified as malicious.

The objects found in the network 110 are unclassified objects.

At step 620, the graph builder 210 constructs a link graph containing classified and unclassified objects as vertices, where the link between the objects indicates the presence of common information between the objects, the classified objects being malicious objects.

In a particular implementation, a connection graph is constructed, in which the connection graph contains connections only between objects of different types.

Objects and information about objects are at least two of the following types of information: IP address; fully qualified domain name; URI information; domain name information, including information about the domain name registrar; information about the owner of the domain name, including the name of the owner to whom the domain name belongs, the address of the owner of the domain name, the range of IP addresses to which the domain name belongs on the network, and contact information of the owner of the domain name; information about the owner of the IP address, including the name and address of the owner of the IP address; name of the computer network range; location corresponding to the range of IP addresses, including country and city; administrator contact details; information about the IP address to which the object being checked belongs; information about public key certificates issued for the domain name; file hash and file path; web addresses containing a domain name, as well as one of the following components of the URI information: page address; page loading parameters; other constituent parts of URI information.

In yet another particular embodiment, block 620 further classifies unclassified domain name entities as trusted if the number of requests received from the domain name system exceeds a predetermined threshold.

At step 630, using the analyzer 240, at least one subgraph is selected from the generated connection graph, including homogeneous objects and containing at least one unclassified object, based on at least one of the approaches: analysis of group connections between objects; analysis of sequential communication between objects.

In a particular implementation, each of these analysis approaches is carried out using at least one machine learning model trained by the “decision tree boosting” method.

In a particular embodiment, when analyzing based on sequential communication, at least one neighboring malicious object and information about at least three objects having a connection are used, and when analyzing based on group communication, information about at least four objects is used, and three of them have a connection with the fourth.

At step 640, analyzer 240 classifies each unclassified object in each subgraph based on the analysis of the objects using classification rules. In particular implementation cases, classification rules include at least one of the following approaches: analysis of objects using a machine learning model and analysis of object similarity, which is implemented using the Levenshtein metric.

At step 650, restricting access to the object that is classified as malicious to prevent the spread of malicious activity by one of the following actions: blocking access to the website with which the object is associated; open the website with which the object is associated in a browser running in protected mode; suspend the transition to the website and inform the user about the connection of the website with a malicious object.

Thus, thanks to the above invention, the technical problem of creating a method for classifying objects into malicious and trusted objects to prevent the spread of malicious activity is solved.

In FIG. 7 illustrates a computer system on which various embodiments of the systems and methods disclosed herein can be implemented. Computer system 20 may be a system configured to implement the present invention and may be in the form of a single computing device or multiple computing devices, such as a desktop computer, a laptop computer, a notebook computer, a mobile computing device, a smartphone, a tablet computer, a server, a mainframe computer. , embedded device, and other forms of computing devices.

As shown in FIG. 7, the computer system 20 includes: a central processing unit 21, a system memory 22, and a system bus 23 that communicates various system components, including memory, coupled to the central processing unit 21. The system bus 23 is implemented as any bus known in the art. a structure that in turn contains a bus memory or bus memory controller, a peripheral bus, and a local bus capable of interfacing with any other bus architecture. Examples of buses include: PCI, ISA, PCI-Express, HyperTransport™, InfiniBand™, Serial ATA, I2C, and other suitable connections between components of the computer system 20. The central processing unit 21 includes one or more processors having one or more cores. The central processing unit 21 executes one or more sets of computer-readable instructions implementing the methods presented herein. System memory 22 may be any memory for storing data and/or computer programs executed by the central processing unit 21. System memory may include both read-only memory (ROM) 24 and random access memory (RAM) 25. Main input/output system (BIOS) 26 contains basic procedures that ensure the transfer of information between elements of the computer system 20, for example, when the operating system is loaded using ROM 24.

Computer system 20 includes one or more data storage devices, such as one or more removable storage devices 27, one or more non-removable storage devices 28, or combinations of removable and non-removable devices. One or more removable storage devices 27 and/or non-removable storage devices 28 are connected to the system bus 23 through an interface 32. In one embodiment, removable storage devices 27 and associated computer-readable storage media are non-volatile modules for storing computer instructions, data structures, program modules and other data of the computer system 20. System memory 22, removable storage devices 27, and non-removable storage devices 28 may use various computer-readable storage media. Examples of computer-readable storage media include computer memory such as cache memory, SRAM, DRAM, capacitorless RAM (Z-RAM), thyristor memory (T-RAM), eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM, RRAM, SONOS, PRAM; flash memory or other memory technologies such as solid-state drives (SSDs) or flash drives; magnetic cassettes, magnetic tapes and magnetic disks such as hard disks or floppy disks; optical media such as compact discs (CD-ROMs) or digital versatile discs (DVDs); and any other media that can be used to store the desired data and that can be accessed by the computer system 20.

System memory 22, removable storage devices 27, and non-removable storage devices 28 contained in the computer system 20 are used to store the operating system 35, applications 37, other program modules 38, and program data 39. The computer system 20 includes a peripheral interface 46 for data transfer. from input devices 40 such as a keyboard, mouse, stylus, game controller, voice input device, touch input device, or other peripheral devices such as a printer or scanner through one or more input/output ports such as a serial port, a parallel port , Universal Serial Bus (USB), or other peripheral interface. A display device 47, such as one or more monitors, projectors, or embedded displays, is also connected to the system bus 23 through an output interface 48, such as a video adapter. In addition to the display devices 47, the computer system 20 is equipped with other peripheral output devices (not shown in FIG. 7), such as speakers and other audiovisual devices.

The computer system 20 may operate in a networked environment using a network connection to one or more remote computers 49. The remote computer(s) 49 is a working personal computer or server that contains most or all of the components noted previously in describing the nature of the computer system 20 , presented in Fig. 7. There may also be other devices in the network environment, such as routers, network stations or other network nodes. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating with remote computers 49 over one or more networks, such as a local area network (LAN) 50, a wide area network (WAN), an intranet, and the Internet. Examples of network interface 51 are an Ethernet interface, a Frame Relay interface, a SONET interface, and wireless interfaces.

Embodiments of the present invention may be a system, a method, or a computer-readable medium (or storage medium).

A computer-readable storage medium is a tangible device that stores and stores program code in the form of machine-readable instructions or data structures that can be accessed by the central processing unit 21 of a computer system 20. The computer-readable storage medium may be an electronic, magnetic, optical, electromagnetic, semiconductor storage device, or any suitable their combination. By way of example, such a computer-readable storage medium may include random access memory (RAM), read-only memory (ROM), EEPROM, compact disc read-only memory (CD-ROM), digital versatile disk (DVD) ), flash memory, hard drive, portable computer floppy disk, memory card, floppy disk, or even a mechanically encoded device such as punch cards or embossed structures with instructions written on them.

The system and method of the present invention can be thought of in terms of means. The term "device" as used herein refers to an actual device, component, or group of components implemented in hardware, such as an application-specific integrated circuit (ASIC) or FPGA, or a combination of hardware and software. providing, for example, using a microprocessor system and a set of machine-readable instructions to implement the functionality of a tool that (in the process of execution) turns the microprocessor system into a special-purpose device. The tool may also be implemented as a combination of these two components, with some functions being implemented by hardware alone and other functions being implemented by a combination of hardware and software. In some embodiments, at least a portion, and in some cases all, of the means may be executed on the central processing unit 21 of the computer system 20. Accordingly, each means may be implemented in various suitable configurations and should not be limited to any particular implementation. given in this document.

In conclusion, it should be noted that the information given in the description are examples that do not limit the scope of the present invention as defined by the formula.

Claims (42)

1. A method for classifying objects to prevent the spread of malicious activity, implemented on a computer device, including memory and a hardware processor, configured to implement steps according to which: a) search for objects on the network that have common information with other objects; b) build a connection graph containing classified and unclassified objects in the form of vertices, and the connection between the objects indicates the presence of common information between the objects, while the classified objects are malicious objects; c) at least one subgraph is selected from the generated connection graph, which includes homogeneous objects and contains at least one unclassified object, based on at least one of the approaches: • analysis of group communication between objects; • analysis of sequential communication between objects; d) perform classification of each unclassified object on each subgraph based on the analysis of objects using classification rules; e) restrict access to an object that is classified as malicious to prevent the spread of malicious activity. 2. The method of claim 1, wherein the other objects are either objects that are classified as malicious or objects that have a common relationship with objects that are classified as malicious. 3. The method according to claim 1, in which the classification rules include at least one of the following approaches: • analysis for similarity of objects; • analysis of objects using a machine learning model. 4. The method according to claim 3, in which similarity analysis is implemented using the Levenshtein metric. 5. The method according to claim 1, in which the connection graph contains connections only between objects of different types. 6. The method of claim 1, wherein the objects and information about objects are at least two of the following types of information: • IP address; • fully qualified domain name; • URI information; • domain name information, including information about the domain name registrar; • information about the owner of the domain name, including the name of the owner to whom the domain name belongs, the address of the owner of the domain name, the range of IP addresses to which the domain name belongs on the network, and contact information of the owner of the domain name; • information about the owner of the IP address, including the name and address of the owner of the IP address; • name of the computer network range; • location corresponding to the range of IP addresses, including country and city; • administrator contact details; • information about the IP address to which the object being checked belongs; • information about public key certificates issued for the domain name; • file hash and path to the file; • web addresses containing a domain name. 7. The method according to claim 6, in which the additional URI information is at least: • page address; • page loading parameters. 8. The method of claim 1, further comprising, after step b), classifying unclassified domain name objects as trusted if the number of requests received from the domain name system exceeds a predetermined threshold. 9. The method according to claim 1, wherein from at least one subgraph, related components are extracted that contain information about related objects, wherein at least one object is unclassified. 10. The method according to claim 1, in which each of these analysis approaches is carried out using at least one machine learning model. 11. The method according to claim 10, in which the machine learning model is trained using the “decision tree boosting” method. 12. The method according to claim 1, in which at least one neighboring malicious object is used in the analysis based on serial communication. 13. The method according to claim 1, in which when analyzing a serial connection, information about at least three objects having a connection is used. 14. The method according to claim 1, in which when analyzing a group connection, information about at least four objects is used, and three of them have a connection with the fourth. 15. The method according to claim 1, in which access to an object that is classified as malicious is limited to prevent the spread of malicious activity by one of the following actions: • block access to the website with which the object is associated; • open the website to which the item is associated in a browser running in protected mode; • pause the transition to the website and inform the user about the connection of the website with a malicious object.