Avoidance of malicious content in nested files

Patent metadata

Field	Value
Publication number	US-10409996-B2
Application number	US-201715613878-A
Country	US
Kind code	B2
Filing date	Jun 5, 2017
Priority date	Jun 8, 2016
Publication date	Sep 10, 2019
Grant date	Sep 10, 2019

Abstract

A nested file having a primary file and at least one secondary file embedded therein is parsed using at least one parser of a cell. The cell assigns a maliciousness score to each of the parsed primary file and each of the parsed at least one secondary file. Thereafter, the cell generates an overall maliciousness score for the nested file that indicates a level of confidence that the nested file contains malicious content. The overall maliciousness score is provided to a data consumer indicating whether to proceed with consuming the data contained within the nested file.

First claim

The invention claimed is:

1. A computer-implemented method for processing a nested file having a primary file and at least one secondary embedded within the primary file, the method comprising:
parsing, using at least one parser of a cell, both of the primary file and the at least one secondary file;
assigning, using the cell, a maliciousness score for the parsed primary file and the parsed at least one secondary file;
generating, by the cell, an overall maliciousness score for the nested file, the overall maliciousness score based on at least one of the assigned maliciousness score for the parsed primary file and the parsed at least one secondary file, the overall maliciousness score indicating a level of confidence that the nested file contains malicious content; and
providing, the overall maliciousness score to a data consumer indicating whether to proceed with consuming the nested file;
wherein the at least one secondary file has a second file format unknown to the cell and the operations further comprise:
identifying, by the cell, that the second file format is unknown to the cell;
requesting, from a cloud service accessed over a network, parsing information associated with the second file format;
receiving, from the cloud computing database over a network, the parsing information associated with the second file format;
instantiating, using the parsing information associated with the second file format, a parser associated with the second file format for parsing files having the second file format and,
parsing using the parser associated with the second file format the at least one second file having the second file format.

2. The method as in claim 1 , further comprising:
identifying a request to execute the nested file, the nested file including a primary file and at least one secondary file nested within the primary file.

3. The method as in claim 1 , wherein the maliciousness score of the parsed primary file indicates a level of confidence that the parsed primary file contains malicious content and wherein the maliciousness score of the parsed at least one secondary file indicates a level of confidence that the parsed at least one secondary file primary file contains malicious content.

4. The method as in claim 1 , further comprising:
exploring the content of the parsed primary file and the at least one secondary file nested within the primary file.

5. The method as in claim 1 , wherein the primary file has a first file format and the at least one secondary file has a second file format and parsing the primary file and the at least one secondary file comprises:
parsing, using a parser associated with the first file format, the primary file; and,
parsing, using a parser associated with the second file format, the at least one secondary file.

6. The method as in claim 1 , wherein the primary file has a primary file format satisfying a plurality of file formats, and parsing the primary file comprises:
individually parsing the primary file with parsers associated with each of the file formats satisfied by the primary file; and,
assigning, using the cell, a maliciousness score to the primary file based on the parsing of the primary file with each of the parsers associated with each of the file formats satisfied by the primary file.

7. The method as in claim 1 , wherein the one or more secondary files has a secondary file format satisfying a plurality of file formats, and parsing the one or more secondary files comprises:
individually parsing the one or more secondary files with parsers associated with each of the formats satisfied by the one or more secondary files; and,
assigning, using the cell, a maliciousness score to the one or more secondary files based each parsing of the one or more secondary files.

8. The method as in claim 1 , wherein the maliciousness score is generated using one or more machine learning models.

9. The method as in claim 1 , wherein the primary file has a first file format and the at least one secondary file includes a second file having a second file format and a third file having a third file format.

10. The method as in claim 9 , wherein the third file is nested within the second file.

11. The method as in claim 1 , wherein the computing system is an enterprise server and/or a client device configured to communicate with the enterprise server.

12. The method as in claim 1 , wherein the cell is operated by a secure operating environment logically separate from a primary operating environment of the computer system.

13. The method as in claim 1 , wherein the cell comprises:
one or more parsers; and,
a dispatcher configured to dispatch at least a portion of the nested file to the one or more parsers; and, a file interface configured to interface between the cell and a computing platform, the file interface configured to expose one or more functions of the cell to the computing platform to receive the nested file from the computing platform and provide information associated with the nested file to the computing platform.

14. The method as in claim 1 , wherein one or more of the operations are performed in a static environment.

15. The method as in claim 1 , wherein one or more of the operations are performed in a dynamic environment.

16. The method as in claim 15 , wherein the dynamic environment includes a secure operating environment separate from a primary operating environment of the computing system.

17. The method as in claim 1 , wherein the overall maliciousness score for the nested file is generated in response to a maliciousness score assigned to one of the primary file or the at least one secondary file meeting a predefined criteria.

18. A system for processing a nested file having a primary file and at least one secondary embedded within the primary file, the system comprising:
at least one programmable processor;
a machine-readable medium storing instructions that, when executed by the at least one programmable processor, cause the at least one programmable processor to perform operations comprising:
parsing, using at least one parser of a cell, both of the primary file and the at least one secondary file;
assigning, using the cell, a maliciousness score for the parsed primary file and the parsed at least one secondary file;
generating, by the cell, an overall maliciousness score for the nested file, the overall maliciousness score based on the assigned maliciousness score for at least one of the parsed primary file and the parsed at least one secondary file, the overall maliciousness score indicating a level of confidence that the nested file contains malicious content; and
providing, the overall maliciousness score to a data consumer indicating whether to proceed with consuming the nested file;

wherein the at least one secondary file has a second file format unknown to the cell and the operations further comprise:
identifying, by the cell, that the second file format is unknown to the cell;
requesting, from a cloud service accessed over a network, parsing information associated with the second file format;
receiving, from the cloud computing database over a network, the parsing information associated with the second file format;
instantiating, using the parsing information associated with the second file format, a parser associated with the second file format for parsing files having the second file format; and
parsing using the parser associated with the second file format the at least one second file having the second file format.

19. The system

Assignees

• Cylance Inc

Inventors

• Petersen Eric
• Soeder Derek A

Classifications

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06N20/00 Primary

  Machine learning · CPC title

• G06F21/562

  Static detection · CPC title