Method of malware detection and system thereof

Patent metadata

Field	Value
Publication number	US-10664596-B2
Application number	US-201715623669-A
Country	US
Kind code	B2
Filing date	Jun 15, 2017
Priority date	Aug 11, 2014
Publication date	May 26, 2020
Grant date	May 26, 2020

Abstract

There is provided a system and a computer-implemented method of detecting malware in real time in a live environment. The method comprises: monitoring one or more operations of at least one program concurrently running in the live environment, building at least one stateful model in accordance with the one or more operations, analyzing the at least one stateful model to identify one or more behaviors, and determining the presence of malware based on the identified one or more behaviors.

First claim

The invention claimed is:

1. A computer-implemented method of detecting malware in real-time in an operating system of an environment, the method comprising:
monitoring, by a computer system, a sequence of linked operations performed by a program running in the operating system;
generating, by the computer system, an event data characterizing each monitored operation, wherein the event data comprises, for each monitored operation, at least an operation type and a source of the operation;
building, by the computer system, a stateful model in accordance with the event data, wherein the stateful model comprises a data structure representing a real-time updated system state resulting from the sequence of linked operations, and wherein the building the stateful model comprises:
retrieving one or more objects associated with the event data, each of the one or more objects representing an entity involved in one of the monitored operations, the retrieved one or more objects comprising at least one object for each monitored operation that represents the source of the operation;
determining one or more relationships among the one or more objects in accordance with the event data, the determined relationships comprising at least the type of each monitored operation and one or more interconnections between the objects of one monitored operation and the objects of another monitored operation;
inferring an event context comprising the one or more objects and the determined relationships thereof; and
generating a stateful model comprising the event context if the monitored operation is a first monitored operation or otherwise updating an existing stateful model based at least in part on the event context, thereby building an updated stateful model representing a hierarchical structure comprising one or more entities involved in the sequence of linked operations and interconnections between the one or more entities resulting from the linked operations;

analyzing, by the computer system, the updated stateful model in accordance with one or more predefined behavioral logics that are indicative of specific behavioral patterns;
identifying, by the computer system, from the updated stateful model, one or more kernel related operations as operations of interest, wherein the one or more kernel related operations comprise one or more operations performed in a kernel space of the operating system;
monitoring, by the computer system, the operations of interest by registering one or more kernel filter drivers for the one or more kernel related operations via one or more callback functions using an Out-of-Band monitoring module; and
determining, by the computer system, part or all of the program to be malicious based at least in part on the monitored operations of interest, wherein determining part or all of the program to be malicious comprises:
determining a presence of at least one behavior upon any of the predefined behavioral logics being met, the at least one behavior related to a sequence of events of the stateful model;
determining a behavior score for the at least one behavior;
assigning a weight factor to each behavior score associated with the at least one behavior, wherein the behavior score indicates the likelihood of the presence of malware based on the at least one behavior;
searching if there is a previous stateful model score associated with the existing stateful model;
if not, determining a sum of respective weighted behavioral scores assigned for each of the at least one behavior as the stateful model score associated with the stateful models;
otherwise increasing the previous stateful model score with the sum, giving rise to the stateful model score; and
comparing the stateful model score with a predefined threshold and determining the presence of malware if the stateful model score passes the predefined threshold,

wherein the computer system comprises a computer processor and an electronic storage medium.

2. The computer-implemented method of claim 1 , wherein each of the specific behavioral patterns represents one or more entities having specific interconnections therein resulted from a specific sequence of operations performed thereupon, and wherein the analyzing the updated stateful model comprises matching the hierarchical structure represented in the updated stateful model with the one or more predefined behavior logics.

3. The computer-implemented method of claim 1 , wherein the determining the one or more relationships further comprises: for each object, generating one or more parameters characterizing said object, the one or more parameters indicative of objects related thereto and determined relationships between the object and the related objects, thereby giving rise to an event context comprising the one or more objects each associated with one or more parameters.

4. The computer-implemented method of claim 1 , wherein each of the one or more objects comprises at least one of a process object, file object, network object, registry object, or windows object.

5. The computer-implemented method of claim 1 , wherein the one or more predefined behavioral logics comprises determining a behavior of self-execution when a target of an execution event comprises one or more of an originating process of the execution event, a child process of the originating process, or a parent process of the originating process.

6. The computer-implemented method of claim 1 , wherein the one or more predefined behavioral logics comprises determining a behavior of self-deletion when a source file of a targeting process of a deletion event comprises one or more of a source file of an originating process of the deletion event or a source file of a parent process of the originating process.

7. The computer-implemented method of claim 1 , wherein the one or more predefined behavioral logics comprises determining a behavior of code injection when associated operations of memory write, memory execution permission, and/or code execution are included in the stateful model.

8. The computer-implemented method of claim 1 , wherein the stateful model comprises a program-level stateful model that represents entities and interconnections thereof involved in the sequence of linked operations related to the program.

9. The computer-implemented method of claim 1 , wherein the stateful model comprises a system-level stateful model that represents entities and interconnections thereof involved in operations related to a plurality of programs that run concurrently in the environment, the system-level stateful model comprising one or more program-level stateful models each representing entities and interconnections thereof involved in the sequence of linked operations related to the given program.

10. The computer-implemented method of claim 1 , wherein the sequence of linked operations comprises one or more in-process operations and/or kernel related operations, wherein the kernel related operations comprise one or more of file system operations, process and memory operations, registry operations, or network operations.

11. The computer-implemented method of claim 1 , further comprising remediating, by the computer system, the part or all of the program determined to be malicious.

12. The computer-implemented method of claim 11 , wherein the remediating further comprises terminating at least one object of the stateful model related to the part or all of the program determined to be malicious.

13. The computer-implemented method of claim 11 , wherein the remediating further comprises removing at least one object of the stateful model related to the part or all of the program determined to be

Assignees

• Sentinel Labs Israel Ltd

Inventors

• Weingarten Tomer
• Cohen Almog
• Shamir Udi
• Motil Kirill

Classifications

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title