Method and system for automatic detection and analysis of malware

Patent metadata

Field	Value
Publication number	US-10530802-B2
Application number	US-201615003273-A
Country	US
Kind code	B2
Filing date	Jan 21, 2016
Priority date	Aug 26, 2010
Publication date	Jan 7, 2020
Grant date	Jan 7, 2020

Abstract

A method of detecting malicious software (malware) includes receiving a file and storing a memory baseline for a system. The method also includes copying the file to the system, executing the file on the system, terminating operation of the system, and storing a post-execution memory map. The method further includes analyzing the memory baseline and the post-execution memory map and determining that the file includes malware.

First claim

What is claimed is:

1. A method of detecting malicious software, the method comprising:
storing, by an analysis system, a memory baseline for a first system, the memory baseline including information stored in a memory of the first system;
executing, by the analysis system, a file on the first system using an operating system of the first system after the storing the memory baseline;
storing, by the analysis system, a post-execution memory map of the first system, the post-execution memory map including information stored in the memory of the first system after the executing the file;
analyzing, by the analysis system, the memory baseline and the post-execution memory map, wherein analyzing comprises:
determining a presence of one or more processes that changed from the memory baseline to the post-execution memory map by:
comparing one or more EPROCESS data items included in the memory baseline to one or more EPROCESS data items included in the post-execution memory map via an analysis of a first set of timestamps associated with the one or more EPROCESS data items included in the memory baseline and a second set of timestamps associated with the one or more EPROCESS data items included in the post-execution memory map, and
identifying behaviors that indicate attempts to conceal a rootkit during operation of the operating system;

determining, by the analysis system, that the file comprises malicious software based on the analyzing;
determining, by the analysis system, a timeline of activities performed by the malicious software based on a third set of timestamps associated with the one or more processes; and
reporting, by the analysis system, the malicious software including a list of the one or more processes that changed and the timeline.

2. The method of claim 1 , wherein the reporting comprises transmitting a list identifying the one or more processes that changed and the timeline.

3. The method of claim 1 , further comprising receiving one or more preferences related to the file, wherein the receiving the one or more preferences comprises receiving at least one of a time to run, a reboot indicator, an operating system, and a privilege level.

4. The method of claim 1 , wherein the memory baseline is used for multiple analysis processes.

5. The method of claim 1 , wherein determining the presence of one or more processes that changed comprises determining that the file added a new process.

6. The method of claim 1 , wherein determining the presence of one or more processes that changed comprises determining that the file deleted a process.

7. The method of claim 1 , wherein the file includes a signature associated with malicious software.

8. The method of claim 1 further comprising associating with the file, in a tree structure, files caused to be loaded to the first system by executing the file.

9. The method of claim 1 , wherein the behaviors that indicate attempts to conceal the rootkit comprise:
attempts to hide kernel drivers;
attempts to inject code or unlink dynamic link libraries (DLLs);
attempts to hide network sockets and connections;
attempts to hide suspicious data in process memory;
attempts to install hook in user or kernel mode memory;
attempts to modify Interrupt Descriptor Table (IDT), System Service Dispatch Table (SSDT), and driver I/O request packet (IRP) entries;
attempts to hide threads;
attempts to register malicious notification routines; and
attempts to install promiscuous mode packet sniffers.

10. A system of detecting malicious software, the system comprising:
a processor; and
a storage device, wherein the storage device contains instructions that, when executed by the processor, causes the system to perform operations comprising:
storing a memory baseline for a first system, the memory baseline including information stored in a memory of the first system;
executing a file on the first system using an operating system of the first system after the storing the memory baseline;
storing a post-execution memory map of the first system, the post-execution memory map including information stored in the memory of the first system after the executing the file;
analyzing the memory baseline and the post-execution memory map, wherein analyzing comprises:
determining a presence of one or more processes that changed from the memory baseline to the post-execution memory map by:
comparing one or more EPROCESS data items included in the memory baseline to one or more EPROCESS data items included in the post-execution memory map via an analysis of a first set of timestamps associated with the one or more EPROCESS data items included in the memory baseline and a second set of timestamps associated with the one or more EPROCESS data items included in the post-execution memory map, and
identifying behaviors that indicate attempts to conceal a rootkit during operation of the operating system;

determining that the file comprises malicious software based on the analyzing;
determining a timeline of activities performed by the malicious software based on a third set of timestamps associated with the one or more processes; and
reporting the malicious software including a list of the one or more processes that changed and the timeline.

11. The system of claim 10 , wherein the reporting comprises transmitting a list identifying the one or more processes that changed and the timeline.

12. The system of claim 10 , wherein the operations further comprise receiving one or more preferences related to the file, wherein the one or more preferences include at least one of: a time to run, a reboot indicator, an operating system, and a privilege level.

13. The system of claim 10 , wherein the memory baseline is used for multiple analysis processes.

14. The system of claim 10 , wherein determining the presence of one or more processes that changed comprises determining that the file added a new process.

15. The system of claim 10 , wherein determining the presence of one or more processes that changed comprises determining that the file deleted a process.

16. The system of claim 10 , wherein the file includes a signature associated with malicious software.

17. The system of claim 10 , wherein the operations further comprise associating with the file, in a tree structure, files caused to be loaded to the first system by executing the file.

18. The system of claim 10 , wherein the behaviors that indicate attempts to conceal the rootkit comprise:
attempts to hide kernel drivers; attempts to inject code or unlink dynamic link libraries (DLLs);
attempts to hide network sockets and connections; attempts to hide suspicious data in process memory;
attempts to install hook in user or kernel mode memory; attempts to modify Interrupt Descriptor Table (IDT), System Service Dispatch Table (SSDT), and driver I/O request packet (IRP) entries;
attempts to hide threads;
attempts to register malicious notification routines; and
attempts to install promiscuous mode packet sniffers.

19. One or more non-transitory computer-readable media storing program instructions that, when executed by one or more processing units, cause the one or more processing units to detect malicious software by performing the steps of:
storing, by an analysis system, a memory baseline for a first system, the memory baseline including information stored in a memory of the first system;
executing, by the analysis system, a file on the first system using an operating system of the first system after the storing the memory baseline;
s

Assignees

• Verisign Inc

Inventors

• Thomas Ralph
• Ligh Bruce Michael

Classifications

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F2221/2101

  Auditing as a secondary aspect · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• G06F2221/2115

  Third party · CPC title

• G06F3/0643

  Management of files · CPC title