Patent ID: 11960597
Assignee: F.A.C.C.T. NETWORK SECURITY LLC
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 11:
12. A system for static analysis of executable files using predictive models,
the system comprising:
a processor; and
a non-transitory computer-readable medium storing instructions;
the processor, upon executing the instructions, being configured to:
in a training phase:
obtain a plurality of training executable files, the plurality of training executable files including at least one malicious training executable file and at least one benign training executable file;
analyze each one of the plurality of training executable files to extract data therefrom including a plurality of features of each one of the plurality of training executable files;
transform the data organizing the plurality of features in sets of features, each set of features of which includes features of a respective predetermined type;
enrich a set of features of the sets of features with additional features of the respective predetermined type for increasing accuracy of a respective predictive model to be applied to the set of features, the respective predictive model having been configured for identifying informative features of the respective predetermined type, the informative features being indicative of a training executable file of the plurality of training executable files being one of malicious and benign, by:
enriching the set of features with at least one of additional feature obtained after examining Portable Executable (PE) files and indicators of compromise having been identified by human specialists in analysis of malicious code;

apply to the set of features the respective predictive model to identify therein the informative features indicative of the training executable file being one of malicious and benign, thereby generating at least one feature vector,
train, based on the at least one feature vector, at least one of an ensemble of classifiers to determine if an executable file is one of malicious and benign; and
assign, to each one of the ensemble of classifiers, a respective weight value indicative of a priority of a respective predicted indicator thereof associated with the executable file amongst respective predicted indicators of other ones of the ensemble of classifiers;

in an execution phase:

obtain the executable file;
analyze, the executable file, to extract therefrom data including execution features;
transform the data organizing the execution features in at least one execution set of features;
generate, based on the at least one execution set of features, a respective execution feature vector;
apply each one of the ensemble of classifiers to the respective execution feature vector to generate the respective predicted indicator of the executable file being one of malicious and benign;
apply, to the respective predicted indicators generated by the ensemble of classifiers, respective weight values associated therewith to generate respective weighted predicted indicators of the executable file being one of malicious and benign;
determine an aggregate predicted indicator based on the respective weighted predicted indicators; and
in response to the aggregate predicted indicator being indicative of the in executable file being malicious, block the executable file.