Automatically detecting a malicious file using name mangling strings

Patent metadata

Field	Value
Publication number	US-10243977-B1
Application number	US-201715629397-A
Country	US
Kind code	B1
Filing date	Jun 21, 2017
Priority date	Jun 21, 2017
Publication date	Mar 26, 2019
Grant date	Mar 26, 2019

Abstract

Automatically detecting a malicious file using name mangling strings. In one embodiment, a method may include (a) identifying a file, (b) identifying name mangling strings in the file, (c) concatenating the name mangling strings together, (d) hashing the concatenated name mangling strings to generate a signature for the file, (e) clustering the file with other files with matching signatures into a cluster, (f) determining that any of the files in the cluster is malicious, (g) adding the signature to a list of signatures of files known to be malicious, (f) identifying a network device file stored on a network device, (g) repeating (b)-(d) on the network device file, (h) determining that the signature for the network device file matches any signature in the list of signatures of files known to be malicious, and (i) performing a security action on the malicious file on the network device.

First claim

The invention claimed is:

1. A computer-implemented method for automatically detecting a malicious file using name mangling strings, at least a portion of the method being performed by a computing device comprising at least one hardware processor, the method comprising:
(a) identifying a file;
(b) identifying name mangling strings in the file;
(c) concatenating the name mangling strings together;
(d) hashing the concatenated name mangling strings to generate a signature for the file;
(e) clustering the file together with other files having signatures that match the signature of the file with the name mangling strings into a cluster;
(f) determining that one of the files in the cluster is malicious;
(g) adding the signature to a list of signatures of files known to be malicious;
(h) identifying a network device file stored on a network device;
(i) repeating (b)-(d) on the network device file;
(j) determining that a signature for the network device file matches any signature in the list of signatures of files known to be malicious and that the network device file is therefore a malicious file; and
(k) performing a security action on the malicious file on the network device to protect the network device.

2. The method of claim 1 , wherein the file and the network device file are Portable Executable (PE) files.

3. The method of claim 2 , wherein (b) comprises identifying name mangling strings in a Data section of the PE file.

4. The method of claim 3 , wherein (c) comprises concatenating the name mangling strings together with one or more delimiter characters between each of the name mangling strings.

5. The method of claim 4 , wherein (c) further comprises concatenating the name mangling strings together in a sequence that matches a sequence that the name mangling strings are listed in the Data section of the PE file.

6. The method of claim 4 , wherein (d) comprises performing a Secure Hash Algorithm-256 (SHA-256) algorithm on the concatenated name mangling strings to generate the signature for the PE file.

7. The method of claim 1 , wherein (k) comprises quarantining the malicious file on, or removing the malicious file from, the network device to prevent the malicious file from executing on the network device.

8. A computer-implemented method for automatically detecting a malicious file using name mangling strings, at least a portion of the method being performed by a computing device comprising at least one hardware processor, the method comprising:
(a) identifying a Portable Executable (PE) file;
(b) identifying name mangling strings in a Data section of the PE file;
(c) concatenating the name mangling strings together;
(d) hashing the concatenated name mangling strings to generate a signature for the PE file;
(e) clustering the PE file together with other PE files having signatures that match the signature of the PE file with the name mangling strings into a cluster;
(f) determining that any of the PE files in the cluster is malicious;
(g) adding the signature to a list of signatures of PE files known to be malicious;
(h) identifying a network device PE file stored on a network device;
(i) repeating (b)-(d) on the network device PE file;
(j) determining that a signature for the network device PE file matches any signature in the list of signatures of PE files known to be malicious and that the network device PE file is therefore a malicious PE file; and
(k) performing a security action on the malicious PE file on the network device to protect the network device.

9. The method of claim 8 , (b) comprises identifying all of the name mangling strings in the Data section of the PE file.

10. The method of claim 9 , wherein (c) comprises concatenating the name mangling strings together with one or more delimiter characters between each of the name mangling strings.

11. The method of claim 10 , wherein (c) further comprises concatenating the name mangling strings together in a sequence that matches a sequence that the name mangling strings are listed in the Data section of the PE file.

12. The method of claim 11 , wherein (d) comprising performing a Secure Hash Algorithm-256 (SHA-256) algorithm on the concatenated name mangling strings to generate the signature for the PE file.

13. The method of claim 8 , wherein (k) comprises quarantining the malicious PE file on, or removing the malicious PE file from, the network device to prevent the malicious PE file from executing on the network device.

14. One or more non-transitory computer-readable storage media comprising one or more computer-readable instructions that, when executed by one or more hardware processors of one or more computing devices, cause the one or more computing devices to perform a method for automatically detecting a malicious file using name mangling strings, the method comprising:
(a) identifying a file;
(b) identifying name mangling strings in the file;
(c) concatenating the name mangling strings together;
(d) hashing the concatenated name mangling strings to generate a signature for the file;
(e) clustering the file together with other files having signatures that match the signature of the file with the name mangling strings into a cluster;
(f) determining that any of the files in the cluster is malicious;
(g) adding the signature to a list of signatures of files known to be malicious;
(h) identifying a network device file stored on a network device;
(i) repeating (b)-(d) on the network device file;
(j) determining that a signature for the network device file matches any signature in the list of signatures of files known to be malicious and that the network device file is therefore a malicious file; and
(k) performing a security action on the malicious file on the network device to protect the network device.

15. The one or more non-transitory computer-readable storage media of claim 14 , wherein the file and the network device file are Portable Executable (PE) files.

16. The one or more non-transitory computer-readable storage media of claim 15 , wherein (b) comprises identifying name mangling strings in a Data section of the PE file.

17. The one or more non-transitory computer-readable storage media of claim 16 , wherein (c) comprises concatenating the name mangling strings together with one or more delimiter characters between each of the name mangling strings.

18. The one or more non-transitory computer-readable storage media of claim 17 , wherein (c) further comprises concatenating the name mangling strings together in a sequence that matches a sequence that the name mangling strings are listed in the Data section of the PE file.

19. The one or more non-transitory computer-readable storage media of claim 18 , wherein (d) comprises performing a Secure Hash Algorithm-256 (SHA-256) algorithm on the concatenated name mangling strings to generate the signature for the PE file.

20. The one or more non-transitory computer-readable storage media of claim 14 , wherein (k) comprises quarantining the malicious file on, or removing the malicious file from, the network device to prevent the malicious file from executing on the network device.

Assignees

• Symantec Corp

Inventors

• Govindarajan Srinivasan
• M Yuvaraj
• Ghosh Swapan Kumar

Classifications

• H04L9/0643

  Hash functions, e.g. MD5, SHA, HMAC or f9 MAC · CPC title

• G06F21/564

  by virus signature recognition · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title