System and method of detecting malicious files based on file fragments

Abstract

Disclosed herein are systems and methods for detecting malicious files based on file fragments. In one example, an exemplary method comprises, extracting data fragments from a file, for each extracteddata fragment, determining a category selected from a list of categories that includes at least: trusted, malicious, and untrusted, when a number of data fragments categorized as being malicious is below a predetermined threshold, avoiding categorization of the file as malicious, and when a number of data fragments categorized as being malicious reaches or exceeds the predetermined threshold, determining whether at least one malicious file detection rule having criteria for detecting a malicious file is found, when at least one malicious file detection rule whose criteria is met is found, categorizing the file as a malicious file, and when no malicious file detection rule whose criteria is met is found, avoiding categorization of the file as a malicious file.

Description

technical field [0001] The invention relates to the field of information protection, more specifically to a system and method for detecting malicious files based on file fragments. Background technique [0002] A large number of malicious files appear every day, spurring the development of antivirus technology. Antivirus programs are using increasingly sophisticated techniques to adequately protect computing devices. At the same time, however, cybercriminals are developing new ways to create malware, especially executable files. Cybercriminals are seeking newer and more sophisticated techniques to hide the presence of malware on computing devices. In fact, these techniques hinder the analysis of such malware. [0003] When developing antivirus software to detect targeted attacks (sometimes called Advanced Persistent Threat (APT)), pay special attention to the use of the above techniques. Targeted malware (especially obfuscated files) is difficult to analyze and combat us...

AI Technical Summary

Problems solved by technology

In fact, these techniques hinder the analysis of such malware

Images