Behaviour based malware prevention

Patent metadata

Field	Value
Publication number	US-10083301-B2
Application number	US-201615362012-A
Country	US
Kind code	B2
Filing date	Nov 28, 2016
Priority date	Dec 3, 2015
Publication date	Sep 25, 2018
Grant date	Sep 25, 2018

Abstract

A method of detecting malware present on a computer system. A set of applications is predefined as benign, and profiles are provided for respective benign applications. Each profile identifies one or more procedures known to be performed by the associated benign application, each procedure being identified by a characteristic action and one or more expected actions. Behavior of the computer system is monitored to detect performance, by a running application, of a characteristic action of a procedure of a benign application. Upon detection of performance of a characteristic action, the profile provided for the associated benign application is used to detect a deviation from the expected actions of the procedure; and the detection of a deviation is used to identify the running application as malicious or suspicious.

First claim

The invention claimed is:

1. A method of detecting malware present on a computer system, the method comprising:
a) predefining a set of applications as benign;
b) providing profiles for respective benign applications, each profile identifying one or more procedures known to be performed by the associated benign application, each procedure being identified by a characteristic action and one or more expected actions;
c) monitoring behaviour of the computer system when a benign application appears to be running;
d) maintaining a log of actions;
e) detecting performance, by the running application, of a characteristic action of a procedure defined for the benign application;
f) upon detection of performance of a characteristic action, using the profile provided for the associated benign application, and said log of actions, to detect a previous deviation from the expected actions of the procedure; and
g) using the detection of a deviation to identify the running application as a modified version of a benign application or an application masquerading as a benign application and therefore as being malicious or suspicious.

2. A method according to claim 1 and comprising, at step c), identifying the benign application using identifying information stored with the associated profile.

3. A method according to claim 2 , wherein the identifying information comprises any one or more of:
a hash of the benign application; and
a digital signature and/or certificate associated with the benign application.

4. A method according to claim 3 and comprising, at step g), identifying the running application as one of:
the benign application running injected code; and
a malicious modification of the benign application.

5. A method according to claim 4 , wherein the running application is identified as the benign application running injected code in the case where the application matches said identification information, and as a malicious modification of the benign application where the application matches only a part of said identification information.

6. A method according to claim 1 , wherein all of the steps are performed at the computer system.

7. A method according to claim 1 , wherein steps c) and e) are performed at the computer system, and steps b), f) and g) are performed at a server, and comprising:
upon detection of performance of a characteristic action, sending from the client computer to the server, details of the characteristic action and other actions taken on the client computer; and
sending from the server to the computer system, an indication as to whether or not the running application is malicious or suspicious.

8. A method according to claim 7 , and comprising, upon detection of a deviation at step f), sending from the server to the computer system, instructions for handling the running application.

9. A method according to claim 1 , wherein said procedures include any one or more of:
establishment of a secure session;
communication over a secure session;
file operations;
registry operations;
memory operations;
network operations.

10. A method according to claim 1 , wherein the characteristic and/or expected actions include one or more of:
API calls made by the running application;
information made available to plugins of the running application;
actions relating to Browser Helper Objects;
file access operations performed by the running application;
network operations performed by the running application;
encrypted communications sent by the running application.

11. A method according to claim 1 and comprising, at step g), handling the running application by one or more of:
terminating a process of the running application;
terminating the characteristic action or an action resulting from the characteristic action;
removing or otherwise making safe the running application; and
performing a further malware scan on the application.

12. A method according to claim 1 , wherein step b) comprises generating a profile for a benign application by one or both of:
monitoring the behaviour of the benign application running on a plurality of client computers and identifying procedures and respective characteristic and expected actions from the aggregate results; and
performing a static analysis of binary code associated with the benign application.

13. The method according to claim 1 , wherein the running application does not run in a sandbox.

14. A computer system comprising:
a memory configured to store a profile for each of a set of benign applications, the profile identifying one or more procedures known to be performed by the associated benign application, each procedure being identified by a characteristic action and one or more expected actions;
a processor configured to:
monitor behaviour of the computer system when a benign application appears to be running and maintain a log of actions;
detect performance, by the running application, of a characteristic action of a procedure defined for the benign application;
upon detection of performance of a characteristic action, use the profile provided for the associated benign application and said log of actions to detect a previous deviation from the expected actions of the procedure; and
use the detection of a deviation to identify the running application as a modified version of a benign application or an application masquerading as a benign application and therefore as being malicious or suspicious.

15. A server comprising:
a memory configured to store a profile for each of a set of benign applications, the profile identifying one or more procedures known to be performed by the associated benign application, each procedure being identified by a characteristic action and one or more expected actions;
a processor configured to:
receive, from a computer system, results of behaviour monitoring of a running application on the computer system including a log of actions;
upon detection of performance of a characteristic action in said results, use the profile provided for the associated benign application and said log of actions to detect a previous deviation from the expected actions of the procedure; and
use the detection of a deviation to identify the running application as a modified version of a benign application or an application masquerading as a benign application and therefore as being malicious or suspicious;
send to the computer system an indication as to whether the running application is malicious or suspicious.

16. A server according to claim 15 , wherein the results comprises an explicit indication of detection of a characteristic action.

17. A computer program product comprising a non-transitory computer readable medium and a computer program comprising computer readable code which, when run on a computer system, causes the computer system to:
store a profile for each of a set of benign applications, the profile identifying one or more procedures known to be performed by the associated benign application, each procedure being identified by a characteristic action and one or more expected actions
monitor behaviour of the computer system when a benign application appears to be running and maintaining a log of actions;
detect performance, by the running application, of a characteristic action of a procedure defined for the benign application;
upon detection of performance of a characteristic action, use the profile provided for the associated benign application, and said log of actions, to detect a previous deviation from the expected actions of the procedu

Assignees

• F Secure Corp

Inventors

• Hentunen Daavid

Classifications

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H05K999/99

  Electricity · mapped topic

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F2221/033

  Test or assess software · CPC title