System and method to detect threats to computer based devices and systems

Aspects of the present disclosure relate to systems and methods for detecting a threat of a computing system. In one aspect, a plurality of instances of input data may be received from at least one sensor. A feature vector based upon at least one instance of the plurality of instances of input data may be generated. The feature vector may be sent to a classifier component, where a threat assessment score is determined for the feature vector. The threat assessment score may be determined by combining information associated with the plurality of instances of input data. A threat assignment may be assigned to the at least one instance of data based on the determined threat assessment score. The threat assignment and threat assessment score may be disseminated.

BACKGROUND

There is an increase in the proliferation of threats with the increased utilization of computer based devices and systems such as desktops, smart-phones, tablets, smart televisions, networks, and the Internet, a proliferation of threats exists with the usage of such devices and systems. The threats, which may be generated by malicious software, include, but are not limited to, financial fraud, loss of privacy, and loss of critical information. Furthermore, threats may evolve and change over time to avoid detection. It is with respect to this general environment that aspects of the present disclosure have been contemplated.

SUMMARY

Aspects of the present disclosure relate to detecting threats to a computing system. A threat identification system may detect threats by analyzing and/or processing a variety of data inputs. The variety of data inputs may be associated with a variety of different types of threats. In this regard, in contrast to identifying threats independently, the threat identification system may combine information from the variety of data inputs to determine a threat in an instance of data from the input data. In one case, the threat identification system may be trained using instances of data that have identified threat assignments. For example, instances of data that have identified threat assignments are instances of data that have a known type of threat. Threat assessment models may be created from training the threat identification system. The threat assessment models may include individual models for a variety of threat types and combined models that process information from a plurality of the individual models. In this regard, a combined model may determine a threat of a first type by utilizing information associated with a threat of a second type.

By creating trained models in the threat identification system, the threat identification system may automatically detect threats that have evolved and changed over time and that have never been observed by the threat identification system. In one example, feature vectors representing information associated with instances of data may be generated and sent to a classifier to determine a threat assessment score for the feature vectors. The threat assessment score may be determined by utilizing information from the threat assessment models. The threat assessment score may facilitate automatically determining whether the instance of data is a threat or not. For example, when the threat assessment score is above a predetermined threshold, this may indicate that the instance of data is a threat. In some cases, the classifier may not determine whether a threat exists or not based on the threat assessment score. As such, the threat assessment score may be reviewed by a third party source to determine whether a threat exists or not. When the third party source determines whether a threat exists or not, the feature vector and determined threat may be sent back to the threat assessment models for retraining. As such, the threat assessment models are consistently retrained to identify changed and evolved types of threats automatically. The threat assignment information and threat assessment scores may be disseminated to a computing device, such as an endpoint, to protect the endpoint from potential threats. In another case, the threat assignment information and threat assessment scores may be disseminated to a database for storage and/or a published white/black-list. This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

DETAILED DESCRIPTION

Aspects of the present disclosure relate to systems and methods for the detection of threats to computer systems. A threat identification system may identify and classify potential threats to a computing system. The threat identification system may use machine learning techniques to automate the identification and classification of the potential threats. In embodiments, a sensor system may collect instances of data from processes, activities, objects, and the like, that are potentially harmful to a computing system. The instances of data may be stored in a repository such that the instances of data may be analyzed and/or assessed by a human reviewer and/or automatically by the threat identification system. The instances of data may be analyzed and/or accessed to determine whether the instances of data have an assigned threat assignment. If an instance of data has a threat assignment, the threat assignment and, in embodiments, a feature vector representation of the instance of data, may be sent to a threat assessment model. In one embodiment, the threat assessment model may be trained by applying various machine learning techniques to the threat assignments and/or feature vector representations. In cases where an instance of data does not have a threat assignment, the threat assessment model may determine threat assessment scores for the instances of data that may be used to determine a threat assignment. The threat assignments may indicate what action should be taken to protect a computing system from a potential threat. While specific threat detection methods are described, one of skill in the art will appreciate that any type of threat detection method may be employed without departing from the scope of this disclosure.

FIG. 1illustrates an exemplary threat identification system100that may be employed by a computing system. The exemplary threat identification system100includes various components for detecting a potential threat to the computing system. As shown inFIG. 1, a representative example of a threat identification system100includes a sensor component104, a pre-processing component108, a feature vector generator116, a repository112, a threat assignment component128, a model training component120, a classifier component124, and a threat assignment dissemination component132. The sensor component104may automatically collect data from processes, activities, objects, and the like, that are potentially harmful to the computing system. The sensor component104may utilize one or more web crawlers, sensors on a customer endpoint (e.g., smartphone, tablet, laptop, etc.), honey pots, third party applications, proxy servers, and/or original equipment manufacturers (OEM) partners for collecting instances of data, which will be described in detail below.

In one aspect, the instances of data may include at least IP addresses, URLs, HTML content, Geo-location information, Internet Service Provider (ISP) data, who-is data, static executable data, runtime executable data, static mobile device application data, runtime mobile application data, and network activity data. While specific types of data have been described herein, one of skill in the art will appreciate that the instances of data may have other types. The collected instances of data from the sensor component104may be sent to the pre-processing component108for processing. The pre-processing component108may aggregate the data collected by the sensor component104and store the aggregated data in the repository112.

The repository112may include an interface for the threat assignment component128to review and analyze the aggregated instances of data. The threat assignment component128may include threat assignment sources to review and analyze the aggregated instances of data. The threat assignment sources may include human researchers, crowd sourcing, and third party sources, to name a few. In one case, the threat assignment sources may search for suspicious patterns in the aggregated instances of data, detect harmful instances of the aggregated data, and assign threat assessments (e.g., threat assignments) to potential harmful instances of data in the repository112. The threat assignments may include whether the instance of data is a threat (e.g., malware, phishing site, etc.) or is not a threat. In one example, threat assignments may include a reputation of a URL, a reputation of an IP address, phishing sites, malware, suspicious network activity, suspicious applications, and no threat. In this regard, when the instances of data are reviewed and analyzed, harmful instances of data that are detected may be given a threat assignment based on the type of threat detected. When no threat is detected, the threat assignment may be no threat.

In one aspect, the instances of data in the repository112may be processed to generate various representations of the instances of data. For example, one representation of the instances of data may include a binary representation of an instance of data. In another example, the representations of the instances of data may include numerical and/or categorical values. In yet another example, the representations of the instances of data may include any representation suitable for encoding sequence information, e.g., n-grams. The generated representations of instances of data may be encoded as feature vectors by the feature vector generator116. In one aspect, the representations of the instances of data and the encoded feature vectors may be based on the type of threat assessment model that receives the feature vectors. For example, if the instance of data is an executable file, an executable malware/virus model may process the executable files corresponding feature vector. As such, the encoded feature vector of the executable file may be generated such that the executable malware/virus model can understand and process the data. The generated feature vectors may be stored in the repository112in addition to the instances of data associated with the feature vectors and the determined threat assignments. In this regard, the repository112may include feature vectors associated with instances of data, instances of data with determined threat assignments, and/or instances of data without determined threat assignments (e.g., with unknown threat assignments).

In one aspect, various machine learning techniques may be utilized with the model training component120. For example, exemplary machine learning techniques that may be utilized by the embodiments disclosed herein may include support vector machines (SVM), maximum entropy discrimination (MED), boosted regression/classification trees, feed forward neural networks (FNN), and/or deep believe networks (DBN). In this regard, a subset of the instances of data with determined threat assignments and/or their corresponding feature vectors may be input to the model training component120. The model training component120may include a variety of threat assessment models such as individual base models, intermediate combined models, and a final model, which will be described in detail below. In one aspect, the threat assessment models may be trained using the subset of the instances of data with determined threat assignments and their corresponding feature vectors. In this regard, the threat assessment models can determine a threat assessment score for instances of data with unknown threat assignments. In one example, the threat assessment score may be based on a probability that the instance is a threat.

In one aspect, the classifier component124may determine a threat assessment score and may receive the generated feature vectors from the repository112. As such, the generated feature vectors may be sent to both the classifier component124and the model training component120. In this regard, the generated feature vectors may be sent to the model training component120when a threat assignment has been determined for the corresponding feature vector. As such, the threat assessment models may be trained using the feature vectors and their corresponding threat assignments. Alternatively, the generated feature vectors may be sent to the classifier component124when a threat assignment is unknown for the corresponding feature vector. When the feature vector is sent to the classifier component124, the classifier component may determine a threat assessment score for the received feature vector. In one example, the threat assessment score may be determined based on the received feature vector (e.g., the representation information of the instance) and information from the trained threat assessment models.

In one case, when the determined threat assessment score is above a first predetermined threshold value, there is a high probability that the instance associated with the received feature vector is a threat. In another case, when the determined threat assessment score is below a second predetermined threshold value, there is a low probability that the instance associated with the received feature vector is a threat. In another case, when the determined threat assessment score is between the first predetermined threshold value and the second predetermined threshold value, there may be a low probability that the instance associated with the received feature vector is either a threat or not a threat (e.g., it is unknown whether the instance is a threat or not a threat). In one case, the first and second predetermined threshold values may be set by a user of a computing device of the threat identification system100. In another case, the first and second predetermined threshold values may be set automatically by the threat identification system100.

In one aspect, the determined threat assessment score for the instance of data associated with the received feature vector may be sent to the threat assignment component128. The threat assignment component128may give the instance of data associated with the threat assessment score a threat assignment based on the threat assessment score. For example, when the determined threat assessment score is between a first predetermined threshold value and a second predetermined threshold value (e.g., it is unknown whether the instance of data associated with the received feature vector is a threat or not a threat), the threat assignment component128may review the feature vector and the threat assessment score and determine whether the instance of data associated with the feature vector is a threat or not and assign a corresponding threat assignment to the feature vector. In this example, the feature vector and its corresponding threat assignment may be sent to the model training component120to retrain the threat assessment models. The threat assessment score and its corresponding threat assignment may also be sent to the assignment dissemination component132, as will be discussed in detail below.

In another example, when the determined threat assessment score is above the first predetermined threshold value, a positive threat assignment may be given to the instance of data associated with the received feature vector, indicating that a threat exists. In this case, the threat assessment score and its corresponding threat assignment may also be sent to the assignment dissemination component132, as will be discussed in detail below. In another example, when the determined threat assessment score is below the second predetermined threshold value, a negative threat assignment may be given to the instance of data associated with the received feature vector indicating that a threat does not exist. In this case, the threat assessment score and its corresponding threat assignment may also be sent to the assignment dissemination component132, as will be discussed in detail below.

When a threat assignment is determined for an instance of data by the threat assignment component128or the threat assessment score is determined to be above the first predetermined threshold value or below the second predetermined threshold value, the threat assignment and the corresponding threat assessment score may be sent to the threat assignment dissemination component132. When the threat assignment dissemination component132receives the threat assignments and threat assessment scores, the threat assessment dissemination component132may disseminate the threat assignments and/or threat assessment scores to a customer endpoint, a database/server, and/or a published white/black-list. In one example, the threat assignment is sent to an endpoint device such that when a user of the endpoint device attempts to execute the instance of data associated with the threat assignment, the endpoint device may employ a counter measure or otherwise protect itself, data, the user, etc. when the instance is assigned a threat. In another example, the threat assignments and/or the threat assessment scores associated with the instances of data are sent to a database for storage and/or a black/white-list for publishing. In yet another example, the threat assignments and/or threat assessment scores may be made available through web-services accessible view the Internet and/or through Software Development Kits.

In one aspect, the feature vectors are dynamically generated at the endpoint device and transmitted to the database/server over a network. The database/server may determine the threat assessment scores associated with the feature vectors transmitted over the network. The determined threat assessment scores may be transmitted back to the endpoint device via the network. When the endpoint device receives the threat assessment scores, the endpoint device may determine the threat assignment and protect the endpoint device from a threat based on the threat assignment. In another aspect, the threat assessment models are distributed to the endpoint device. In this regard, the threat assessment scores may be determined by the endpoint device. In yet another aspect, some of the threat assessment models may be located at the endpoint device and some of the threat assessment models may be located at the server such that threat assessment scores may be determined at the endpoint device and/or the server.

While specific components are illustrated in the exemplary system100, one of skill in the art will appreciate that other systems may include additional or fewer components and that the exemplary system100is provided for illustrative purposes. As such, the aspects disclosed herein may be practiced with different systems without departing from the spirit or scope of this disclosure.

FIG. 2illustrates various threat assessment models that may be stored or otherwise accessible by the model training component120, according to one or more embodiments of the present disclosure. As discussed above, the model training component120may include a variety of threat assessment models such as individual base models, intermediate combined models, and a final model. As illustrated in FIG.2, the individual base models226may include an IP reputation model228, a URL reputation model230, a webpage content classification model232, a phishing model234, an executable malware/virus model236, a mobile device application malware/virus model238, a botnet detector240, and a general threat model242. As discussed above, instances of aggregated data may be stored in repository112and feature vectors corresponding to the instances of data may be generated and input to the model training component120. In this regard, the input data202may include the instances of data. As discussed above, in one aspect, the instances of data may include IP addresses204, URLs206, HTML content208, Geo-location information210, Internet Service Provider (ISP) data112, who-is data214, static executable data216, runtime executable data218, static mobile device application data220, runtime mobile application data222, and network activity data224.

In some aspects, the generated feature vectors for each type of instance of data may be input to a different base model226. In one case, IP addresses204and Geo-location information210may be input to the IP reputation model228for training and/or processing. In another case, URLs206, HTML content208, Geo-location information210, ISP data212, and who-is data214may be input to the URL reputation model230for training and/or processing. In another case, HTML content208may be input to the webpage content classification model232for training and/or processing. In another case, IP addresses204, URLs206, HTML content208, Geo-location information210, ISP data212, and who-is data214may be input to the phishing model234for training and/or processing. In another case, static executable data216and runtime executable data218may be input to the executable malware/virus model236for training and/or processing. In another case, the static mobile device application data220and runtime mobile device application data222may be input to the mobile device application malware/virus model238for training and/or processing. In another case, the network activity data224maybe input to the botnet detector240for training and/or processing. In another case, IP addresses204, URLs206, HTML content208, Geo-location information210, Internet Service Provider (ISP) data112, who-is data214, static executable data216, runtime executable data218, static mobile device application data220, runtime mobile application data222, and network activity data224may be input to the general threat model242for training and/or processing.

As discussed above, the model training component120may include a variety of threat assessment models including at least intermediate combined models. In this regard, intermediate models244may include hierarchical models, linearly blended models, boosted models, and models that are trained from combining various feature vectors of the instances of data (e.g., inputs202). Specifically, as illustrated inFIG. 2, the intermediate models244may include a webpage reputation model246, a derived executable malware/virus model248, and a derived mobile device application malware/virus model250. In this regard, the base models226may determine threat assessment scores for instances of data using the received feature vectors and send the determined threat assessment scores to the intermediate models244. In one exemplary aspect, the phishing model234may determine a threat assessment score for a webpage that indicates how likely the webpage is a phishing site. In this regard, the input information used by the phishing model234to determine the threat assessment score may include the IP addresses204, URLs206, HTML content208, Geo-location information210, ISP data212, and who-is data214. In the exemplary aspect, the threat assessment score for each instance may be based on a probability that the instance is a phishing site. The determined threat assessment score for each instance may be sent to at least one intermediate model244.

When the threat assessment scores are determined by the base models226, the threat assessment scores may be sent to the intermediate models244. In one case, the threat assessment scores from the reputation model228are sent to the webpage reputation model246and the derived executable malware/virus model248. In one case, the threat assessment scores from the URL reputation model230are sent to the webpage reputation model246and the derived executable malware/virus model248. In one case, the threat assessment scores from the webpage content classification model232are sent to the webpage reputation model246and the derived executable malware/virus model248. In one case, the threat assessment scores from the phishing model234are sent to the webpage reputation model246. In one case, the threat assessment scores from the executable malware/virus model236are sent to the derived executable malware/virus model248. In one case, the threat assessment scores from the mobile device application malware/virus model238are sent to the derived mobile device application malware/virus model250. In one case, the threat assessment scores from the botnet detector240are sent to the webpage reputation model246, the derived executable malware/virus model248, and the derived mobile device application malware/virus model250. In one case, the threat assessment scores from the general threat model242are sent to the final threat model252.

Using a combination of threat assessment models (e.g., base models226, intermediate models244, and the final threat model252) may facilitate accurate and robust threat assignments for instances of data that are incomplete and/or have never been observed by the threat identification system100. For example, an instance such as an executable file may not have a threat assignment due to incomplete information from the executable file. In this case, a feature vector may be generated and sent to the classifier component124. In one example, at least one of the intermediate models244may have information and/or a threat assessment score associated with the IP address through which the executable file was obtained. In this regard, the intermediate model244may determine a threat assessment score for the executable file using the information and/or threat assessment score associated with the IP address. As such, the classifier component124may use the information from the intermediate models244and the received feature vector to determine a threat assessment score. As discussed above, the threat assessment score may then be used to determine, with high confidence, whether the instance of data has a threat assignment.

As more information associated with the executable file becomes available, the generated feature vectors and corresponding threat assessment scores associated with the executable file may be updated. In one example, as discussed above, the threat assessment scores may be sent to the threat assignment component128where a threat assignment may be assigned to the executable file. If the executable file is given a threat assignment by one of the threat assignment sources, the threat assessment models may be re-trained with the threat assignment and corresponding feature vector.

In one aspect, the threat identification system100may determine the threat assignments and threat assessment scores of all the instances in the repository112. The results of the determined threat assignments and threat assessment scores of all the instances in the repository112may be stored with the threat assignments that have been determined by the threat assignment component128(e.g., human researchers, crowd sourcing, and third party sources). When there is a conflict between determined threat assignments for an instance, logic may be applied to resolve the conflict. In one case, the logic includes a rule that threat assignments determined by a human researcher/reviewer overrule all other threat assignments.

While specific examples have been described to illustrate the base models226receiving various feature vectors from inputs202and intermediate models244receiving threat assessment scores from various base models226, one of skill in the art will appreciate that other examples may include the base models226receiving feature vectors from inputs202different from those described and the intermediate models244receiving threat assessment scores from base models226different from those described and that the exemplary aspects are provided for illustrative purposes. As such, the aspects disclosed herein may be practiced using various combinations of inputs202, base models226, intermediate models244, and the final threat model252without departing from the spirit or scope of this disclosure.

FIG. 3illustrates an exemplary embodiment of a sensor component104. The sensor component104may include a web crawler304, customer endpoint sensors308, honey pots312, third party applications316, proxy servers320, and OEM partners324. The web crawler304may accumulate instances of data such as URLs, IP addresses, and HTML content. The customer endpoint sensors308may accumulate instances of data such as executable information, runtime behavior of executables, mobile device applications, and network activity. The honey pots312may accumulate instances of data such as executable information, runtime behavior of executables and network activity. The third party applications316may accumulate instances of data such as Geo-location information of IP addresses, ISP (Internet Service Provider) information, and who-is information. The proxy servers320may accumulate instances of data such as URLs, IP addresses, HTML content, web activity, and hornet patterns. The OEM partners324may accumulate instances of data such as URLs, IP addresses, HTML content, executable information, behavior data on mobile device applications, runtime behavior of executables and network activity. In this regard, as discussed above relative toFIG. 1, the instances of collected data are pre-processed and stored in the repository112.

FIG. 4illustrates an exemplary embodiment of an IP reputation model228. The IP reputation model228may include a binary representation model404, a Geo-information model408, and a final IP reputation model412. The inputs from the sensor component104(e.g., instances of data in the form of vector features) may be received at the binary representation model404and the Geo-information model408for processing. For example, as discussed above, the IP addresses204and Geo-location information210may be input to the IP reputation model228. The binary representation model404may assess a binary representation of the IP addresses204input to the binary representation model404. The binary representation model404may determine that at least some clusters of the IP addresses204may not be a threat and that at least some clusters of the IP addresses204may be a threat.

The Geo-information model408may receive Geo-location information such as locality information and ASN information, the type of connection, the speed of the connection, etc. The Geo-information model408may assess the Geo-location information to determine the information that indicates a threat and the information that does not indicate a threat. Both the binary representation model404and the Geo-information model408may determine threat assessment scores based on an analysis of the IP addresses204and Geo-location information210. The threat assessment scores may be sent to the final IP reputation model412where the threat assessment scores are combined to create a final IP reputation threat assessment score416. The final IP reputation threat assessment score416may be sent to an intermediate model.

FIG. 5illustrates an exemplary embodiment of an executable malware/virus model236. The executable malware/virus model236may include a support vector machine504, a gradient boosting machine508, and a final model512. The inputs from the sensor component104(e.g., instances of data in the form of vector features) may be received at the support vector machine504and/or gradient boosting machine508for processing. For example, as discussed above, the static executable data216and runtime executable data218may be input to the executable malware/virus model236for training and/or processing. In one aspect, the support vector machine504and/or the gradient boosting machine508are standard machine learning techniques.

Both the support vector machine504and the gradient boosting machine508may determine threat assessment scores based on an analysis of the static executable data216and runtime executable data218. The threat assessment scores may be sent to the final model512where the threat assessment scores are combined to create a final threat assessment score516. In one example, the threat assessment scores are combined by using boosting and/or a neural network. The final threat assessment score516may be sent to an intermediate model244.

FIG. 6illustrates an exemplary embodiment of a mobile device application malware/virus model238. The mobile device application malware/virus model238may include an application unpacker604, a SVM-based classifier608, a threat detection engine612, a finger printer616, an IP reputation classifier620, a URL reputation classifier624, a third party classifier628, a heuristic classifier632, and a sum classifier638. The inputs from the sensor component104(e.g., instances of data in the form of vector features) may be received at the application unpacker604for processing. For example, as discussed above, the static mobile device application data220and runtime mobile device application data222may be input to the mobile device application malware/virus model238for training and/or processing. In one aspect, the application unpacker604may verify the validity of a mobile device application and extract the mobile device application components. The SVM-based classifier608may convert selected mobile device application attributes into feature vectors and send the selected mobile device application attributes into an actively trained classifier. In one example, the SVM-classifier608may receive permission paths, digital certificate information, feature paths, and the like, from the application unpacker604. In this regard, the SVM-classifier608may output a numeric score that identifies an affiliation with a classification mode.

The threat detection engine612may perform a signature-based scan of the mobile device application and generate a binary result based on a threat detection or lack thereof. In this regard, the threat detection engine612may receive a hash of the mobile device application binary, a package/bundler identifier, an application manifest, and a certificate fingerprint. The threat detection engine612may output a malware family affiliation and/or a determination of whether the received data is a potential threat or not (e.g., whether the data is good or bad). The finger printer616may perform a statistical evaluation of the mobile device application's sectional hashes and determine a probability that the application contains binary code that has been observed previously in mobile device applications received during training. In embodiments, finger printer616may receive sectional MD5 hashes of an executable portion of the mobile device application (e.g., a DEX file). In other embodiments, other hashing functions, both cryptographic or otherwise, may be employed without departing from the scope of this disclosure. The finger printer616may output determination of whether the received data is a potential threat or not (e.g., whether the data is good or bad) and a confidence metric associated with the determination.

The IP reputation classifier620may perform IP reputation cross-referencing using IP addresses extracted from the mobile device application at runtime and source code. The IP reputation classifier620may receive IP addresses associated with the mobile device application. The IP addresses may be extracted from source code and network runtime capture. The IP reputation classifier620may output IP reputation/classification, IP threat categories, and IP Geo-location information. The URL reputation classifier624may perform URL reputation cross-referencing using URLs extracted from the mobile device application runtime capture and source code. The URL reputation classifier624may receive URLs associated with the mobile device application. The URLs may be extracted from source code and network runtime capture. The URL reputation classifier624may output IP addresses that are associated with the URLs and a URL category and categorization confidence score.

The third party classifier628may perform mobile device application lookup against third party application analysis engines and compute classification determination based on the lookup results. The third party classifier628may receive an application MD5. The third party classifier628may output a determination of whether the received data is a potential threat or not (e.g., whether the data is good or bad) and a confidence score based on weighted third party classification results. The heuristic classifier632may perform policy based classification of a mobile device application by using a weighted sum of tangible mobile device application attributes and attributes derived from cross-referencing with previously classified mobile device applications. The heuristic classifier632may receive permission paths, known sources of the mobile device application, cross-references of the digital certificate fingerprint, other classifier results, and the like. The heuristic classifier632may output a weighted sum of determinations based on available mobile device application attributes. The sum classifier638may be a Neural Network based sum classifier that normalizes the results of other statistical classifiers and sends the associated classification values into a back-propagation trained Artificial Neural Network. The sum classifier638may receive the outputs from the SVM-based classifier608, the threat detection engine612, the finger printer616, the third party classifier628, and the heuristic classifier632. The sum classifier638may output a threat assessment score636representing a combined threat/no threat determination. The threat assessment score636may be output to an intermediate model244(FIG. 2).

FIG. 7illustrates an exemplary embodiment of botnet detector240. The botnet detector240may include a scanner704, a SVM-based classifier708, and a risk score calculator712. The inputs from the sensor component104(e.g., instances of data in the form of vector features) may be received at the scanner704and the SVM-based classifier708for processing. For example, as discussed above, the network activity data224maybe input to the botnet detector240for training and/or processing. The scanner704may perform signature-based scans of URLs and generate triggered detections. In this regard, the scanner704may receive Network IP addresses HTTP, DNS, SSH, FTP requests/responses, TCP/UDP packet headers, and TCP flags.

As discussed above, the SVM-based classifier708may convert selected mobile device application attributes into feature vectors and send the selected mobile device application attributes into an actively trained classifier. The SVM-based classifier708may receive inputs similar to those received at the scanner704such as Network IP addresses HTTP, DNS, SSH, FTP requests/responses, TCP/UDP packet headers, TCP flags, and the like. Both the scanner704and the SVM-based classifier708may determine threat assessment scores based on an analysis of the inputs. The threat assessment scores may be sent to the risk score calculator712where the threat assessment scores are combined to create a final threat assessment score716. The final threat assessment score716may be sent to an intermediate model.

FIG. 8illustrates an exemplary embodiment of a general threat model242. The general threat model242may include a general web reputation model804, a general executable malware/virus model808, a general device application malware/virus model812and a final threat model816. The inputs from the sensor component104(e.g., instances of data in the form of vector features) may be received at the general web reputation model804, the general executable malware/virus model808, and the general device application malware/virus model812for processing. For example, as discussed above, IP addresses204, URLs206, HTML content208, Geo-location information210, Internet Service Provider (ISP) data112, who-is data214, static executable data216, runtime executable data218, static mobile device application data220, runtime mobile application data222, and network activity data224may be input to the general threat model242for training and/or processing.

The general web-reputation model804may include functionality similar to that described above relative to the IP reputation model228, the URL reputation model230, and the webpage content classification model232. The general executable malware/virus model808may include functionality similar to that described above relative to the executable malware/virus model236. The general device application malware/virus model812may include functionality similar to that described above relative to the mobile device application malware/virus model238.

The general web reputation model804, the general executable malware/virus model808, and the general device application malware/virus model812may all determine threat assessment scores based on an analysis of the IP addresses204, URLs206, HTML content208, Geo-location information210, Internet Service Provider (ISP) data112, who-is data214, static executable data216, runtime executable data218, static mobile device application data220, runtime mobile application data222, and network activity data224. The threat assessment scores may be sent to the final threat model816where the threat assessment scores are combined to create a final threat assessment score820. The final threat assessment score820may be sent to an intermediate model244.

FIG. 9illustrates an exemplary method900for detecting a threat of a computing system. The method900may be performed by a threat identification system, such as threat identification system100, antivirus software, antimalware software, an operating system, or any other type or security related application. Additionally, the method900may be implemented in software (e.g., though execution of computer-executable instructions by a processor), implemented in hardware, or implemented as a combination of hardware and software. Flow begins at operation902where an instance of input data is received. For example, the instance of input data may be received from at least one sensor of the computing system. The instance of the input data may be received at a pre-processor to be processed and sent to a repository for storage and analysis. The instance of input data may include at least one of IP addresses, URLs, HTML content, Geo-location information, Internet Service Provider (ISP) data, who-is data, static executable data, runtime executable data, static mobile device application data, runtime mobile application data, and network activity data.

Upon receiving an instance of input data, flow continues to operation904where a feature vector may be generated. In embodiments, the received instance of input data may be processed to generate a representation of the instance of input data. For example, one representation of the instance of input data may include a binary representation of the instance of data. The generated representation of the instance of input data may be encoded as a feature vector by a feature vector generator.

Flow continues to operation906where a determination is made as to whether the received instance of input data is a threat. If it is determined that a threat is present in the instance of input data, flow branches Yes and proceeds to operation908where a positive threat assignment may be assigned to the instance of input data. A positive threat assignment may indicate that the instance of input data has a threat. For example, a positive threat assignment may include a reputation of a URL, a reputation of an IP address, phishing sites, malware, suspicious network activity, and suspicious applications.

After a positive threat assignment has been assigned to the instance of input data, flow proceeds to operation910where the positive threat assignment is disseminated. For example, the positive threat assignment may be disseminated to at least one of an endpoint device, a server, a published white-list, and/or a published black-list. When the positive threat assignment is sent to the endpoint device, the endpoint device may employ a counter measure or otherwise protect itself, data, the user, etc. when the instance is assigned a threat classification.

If it cannot be determined whether a threat is present in the instance of input data (e.g., it is unknown whether a threat exists), flow branches No and proceeds to operation912where the generated feature vector is sent to the classifier component. The training component may use data from the model training component to determine a threat assessment score for the generated feature vector. The model training component may include a plurality of threat assessment models. For example, the threat assessment models may include basic models, intermediate models, and a final model. The threat assessment models may be trained based on processing previously received feature vectors and threat assignments associated with other instances of input data. In this regard, the classifier module may assess the received feature vector based on data associated with other instances of input data.

At operation914, a threat assessment score for the feature vector may be determined. For example, the classifier module may compare information contained in the feature vector with information from the threat assessment models to determine a threat assessment score for the feature vector. In one aspect, determining the threat assessment score for the feature vector includes combining information associated with the plurality of instances of input data. The threat assessment score may be based on a probability that the instance of input data is a threat.

When a threat assessment score for the feature vector is determined, flow proceeds to operation916where it is determined whether the threat assessment score is above a first predetermined threshold value. For example, the first predetermined threshold value may indicate the likelihood of whether the instance of input data is a threat or not. If the threat assessment score is above the first predetermined threshold value, flow proceeds to operation920where a positive threat assignment is assigned to the instance of input data. As discussed above, a positive threat assignment may indicate that the instance of input data has a threat. After a positive threat assignment has been assigned to the instance of input data, flow proceeds to operation926, where the threat assessment score and the positive threat assignment are disseminated. For example, the threat assessment score and the positive threat assignment may be disseminated to at least one of an endpoint device, a server, a published white-list, and a published black-list. When the threat assessment score and positive threat assignment are sent to the endpoint device, the endpoint device may employ a counter measure or otherwise protect itself, data, the user, etc.

If the threat assessment score is not above the first predetermined threshold value, flow proceeds to operation918where it is determined if the threat assessment score is below a second predetermined threshold value. For example, the second predetermined threshold value may indicate the likelihood of whether the instance of input data is not a threat. If the threat assessment score is below the second predetermined threshold value, flow proceeds to operation922where a negative threat assignment is assigned to the instance of input data. A negative threat assignment may indicate that there is no identified threat in the instance of input data. When no threat is identified in the instance of input data, flow may proceed to operation926where the threat assessment score and negative threat assignment are disseminated.

If the threat assessment score is not below the second predetermined threshold value, flow proceeds to operation928where the threat assessment score is sent to the threat assignment component for review. The threat assessment score and corresponding feature vector may be reviewed by at least one of a human reviewer, crowd sourcing, and a third party source. In this regard, the human reviewer, crowd sourcing, and/or third party source may determine and assign either a positive or negative threat assignment for the instance of data.

When the instance of data has been assigned a threat assignment, flow proceeds to operation924where the model training component is retrained. For example, the feature vector and the assigned threat assignment may be sent back to the model training component such that the threat assessment models can be retrained to include the information in the feature vector and its associated threat assignment. In this regard, the threat assessment models may identify a potential threat in an instance of input data in the future that is similar to the instance of data that is used to retrain the threat assessment models. When the instance of data has been assigned a threat assignment, flow also proceeds to operation926, where the threat assessment score and threat assignment are disseminated.

FIG. 10and the additional discussion in the present specification are intended to provide a brief general description of a suitable computing environment in which the present disclosure and/or portions thereof may be implemented. Although not required, the embodiments described herein may be implemented as computer-executable instructions, such as by program modules, being executed by a computer, such as a client workstation or a server. Generally, program modules include routines, programs, objects, components, data structures and the like that perform particular tasks or implement particular abstract data types. Moreover, it should be appreciated that the disclosure and/or portions thereof may be practiced with other computer system configurations, including hand-held devices, multi-processor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers and the like. The disclosure may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

FIG. 10illustrates one example of a suitable operating environment1000in which one or more of the present embodiments may be implemented. This is only one example of a suitable operating environment and is not intended to suggest any limitation as to the scope of use or functionality. Other well-known computing systems, environments, and/or configurations that may be suitable for use include, but are not limited to, personal computers, server computers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, programmable consumer electronics such as smart phones, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.

In its most basic configuration, operating environment1000typically includes at least one processing unit1002and memory1004. Depending on the exact configuration and type of computing device, memory1004(storing, among other things, threat detection component(s) and/or other components or instructions to implement or perform the system and methods disclosed herein, etc.) may be volatile (such as RAM), non-volatile (such as ROM, flash memory, etc.), or some combination of the two. This most basic configuration is illustrated inFIG. 10by dashed line1006. Further, environment1000may also include storage devices (removable,1008, and/or non-removable,1010) including, but not limited to, magnetic or optical disks or tape. Similarly, environment1000may also have input device(s)1014such as keyboard, mouse, pen, voice input, etc. and/or output device(s)1016such as a display, speakers, printer, etc. Also included in the environment may be one or more communication connections,1012, such as LAN, WAN, point to point, etc.

The different aspects described herein may be employed using software, hardware, or a combination of software and hardware to implement and perform the systems and methods disclosed herein. Although specific devices have been recited throughout the disclosure as performing specific functions, one of skill in the art will appreciate that these devices are provided for illustrative purposes, and other devices may be employed to perform the functionality disclosed herein without departing from the scope of the disclosure.

This disclosure described some aspects of the present technology with reference to the accompanying drawings, in which only some of the possible embodiments were shown. Other aspects may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these aspects were provided so that this disclosure was thorough and complete and fully conveyed the scope of the possible embodiments to those skilled in the art.

Although specific aspects were described herein, the scope of the technology is not limited to those specific embodiments. One skilled in the art will recognize other embodiments or improvements that are within the scope and spirit of the present technology. Therefore, the specific structure, acts, or media are disclosed only as illustrative embodiments. The scope of the technology is defined by the following claims and any equivalents therein.