Systems and methods for evaluating unfamiliar executables

Patent metadata

Field	Value
Publication number	US-10678917-B1
Application number	US-201715826642-A
Country	US
Kind code	B1
Filing date	Nov 29, 2017
Priority date	Nov 29, 2017
Publication date	Jun 9, 2020
Grant date	Jun 9, 2020

Abstract

The disclosed computer-implemented method for evaluating unfamiliar executables may include (i) identifying, on the computing device, (a) a code object that is generated from source code written in a programming language, that is specified in an intermediate language different from the programming language, and that can be compiled into an executable file by a just-in-time compiler on the computing device and (b) an executable file that lacks an assigned reputation in a reputation system that distinguishes benign and malicious files, (ii) determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device, (iii) retrieving, from the reputation system, a reputation for the code object, and (iv) performing a security action on the executable file that is based on the reputation of the code object. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for evaluating unfamiliar executables, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying, on the computing device:
a code object that is generated from source code written in a programming language, that is specified in an intermediate language different from the programming language, and that can be compiled into an executable file by a just-in-time compiler on the computing device; and
an executable file that lacks an assigned reputation in a reputation system that distinguishes benign and malicious files;

associating the executable file with the code object based on determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device; and
in response to associating the executable file with the code object:
retrieving, from the reputation system, a reputation for the code object; and
performing a security action on the executable file that is based on the reputation of the code object rather than the assigned reputation of the executable file due to the executable file lacking the assigned reputation in the reputation system.

2. The computer-implemented method of claim 1 , wherein performing the security action comprises allowing the executable file to execute based on determining, based on the reputation of the code object, the code object is benign.

3. The computer-implemented method of claim 1 , wherein performing the security action comprises preventing the executable file from executing based on determining, based on the reputation of the code object, that the code object is malicious.

4. The computer-implemented method of claim 1 , further comprising:
identifying an additional executable file that has an additional assigned reputation in the reputation system; and
performing an additional security action on the additional executable file based on the additional assigned reputation of the additional executable file in the reputation system.

5. The computer-implemented method of claim 1 , wherein:
identifying the executable file comprises determining that the executable file is a singleton that has not been previously identified on any computing system connected to the reputation system; and
performing the security action on the executable file that is based on the reputation of the code object rather than the assigned reputation of the executable file due to the executable file is in response to determining that the executable file is the singleton.

6. The computer-implemented method of claim 1 , wherein:
identifying the executable file comprises quarantining the executable file; and
performing the security action on the executable file comprises removing the executable file from quarantine.

7. The computer-implemented method of claim 1 , further comprising:
identifying an additional executable file that was produced by an additional code object;
monitoring behavior of the additional executable file; and
assigning a reputation to the additional code object in the reputation system based on the behavior of the additional executable file.

8. The computer-implemented method of claim 1 , wherein determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device comprises:
configuring the just-in-time compiler to store output to a specified file system layer; and
monitoring the specified file system layer to which the just-in-time compiler stores the output.

9. The computer-implemented method of claim 1 , wherein determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device comprises hooking the just-in-time compiler.

10. The computer-implemented method of claim 1 , wherein determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device comprises determining that just-in-time compiler produced the executable file within a predetermined time of the just-in-time compiler reading the code object.

11. The computer-implemented method of claim 1 , wherein the intermediate language comprises bytecode.

12. A system for evaluating unfamiliar executables, the system comprising:
an identification module, stored in memory, that identifies, on a computing device:
a code object that is generated from source code written in a programming language, that is specified in an intermediate language different from the programming language, and that can be compiled into an executable file by a just-in-time compiler on the computing device; and
an executable file that lacks an assigned reputation in a reputation system that distinguishes benign and malicious files;

a determination module, stored in memory, that associates the executable file with the code object based on determining that the executable file was produced by the just-in-time compiler compiling the code object on the computing device;
a retrieving module, stored in memory, that retrieves, from the reputation system and in response to associating the executable file with the code object, a reputation for the code object;
a security module, stored in memory, that performs a security action on the executable file that is based on the reputation of the code object rather than the assigned reputation of the executable file due to the executable file lacking the assigned reputation in the reputation system; and
at least one physical processor configured to execute the identification module, the determination module, the retrieving module, and the security module.

13. The system of claim 12 , wherein the security module performs the security action by allowing the executable file to execute based on determining, based on the reputation of the code object, the code object is benign.

14. The system of claim 12 , wherein the security module performs the security action by preventing the executable file from executing based on determining, based on the reputation of the code object, that the code object is malicious.

15. The system of claim 12 , wherein:
the identification module further identifies an additional executable file that has an additional assigned reputation in the reputation system; and
the security module further performs an additional security action on the additional executable file based on the additional assigned reputation of the additional executable file in the reputation system.

16. The system of claim 12 , wherein:
the identification module identifies the executable file by determining that the executable file is a singleton that has not been previously identified on any computing system connected to the reputation system; and
the security module performs the security action on the executable file that is based on the reputation of the code object rather than the assigned reputation of the executable file due to the executable file in response to determining that the executable file is the singleton.

17. The system of claim 12 , wherein:
the identification module quarantines the executable file; and
the security module performs the security action on the executable file by removing the executable file from quarantine.

18. The system of claim 12 , wherein the identification module further:
identifies an additional executable file that was produced by an additional code object;
monitors behavior of the additional executable file; and
assigns a reputation to the add

Assignees

• Symantec Corp
• Nortonlifelock Inc

Inventors

• Witten Brian T
• Gates Christopher

Classifications

• G06F21/565 Primary

  by checking file integrity · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/51

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title