Detonate targeted malware using environment context information

Patent metadata

Field	Value
Publication number	US-10885191-B1
Application number	US-201816018340-A
Country	US
Kind code	B1
Filing date	Jun 26, 2018
Priority date	Jun 26, 2018
Publication date	Jan 5, 2021
Grant date	Jan 5, 2021

Abstract

In one embodiment, a computer-implemented method for using customer context to detonate malware may be performed by one or more computing devices, each comprising one or more processors. The method may include receiving an artefact associated with a first device being targeted by malware, simulating in a controlled environment attributes of the first device based at least in part on the artefact, executing the malware in the controlled environment while the attributes of the first device are being simulated, and performing a security action with respect to the malware based at least in part on the execution of the malware in the controlled environment.

First claim

What is claimed is:

1. A computer-implemented method for using environment context information to detonate malware, the method being performed by one or more computing devices, each comprising one or more processors, the method comprising:
receiving, by the one or more computing devices, an artefact associated with a first device being targeted by malware, the malware comprising a first portion and a second portion;
simulating in a controlled environment, by the one or more computing devices, attributes of the first device based at least in part on the artefact;
receiving a first portion of the malware at a first point in time;
executing the first portion of the malware in the controlled environment while the attributes of the first device are being simulated;
at a second point in time subsequent to the first point in time, receiving a second portion of the malware;
executing the second portion of the malware in the controlled environment while the attributes of the first device are being simulated; and
performing a security action with respect to the malware based at least in part on the execution of the first portion or the second portion of the malware in the controlled environment.

2. The method of claim 1 , further comprising:
monitoring the first device; and
determining that the first device is being targeted by the malware based at least in part on the monitoring.

3. The method of claim 2 , further comprising:
identifying the malware based at least in part on the monitoring.

4. The method of claim 1 , wherein simulating the attributes of the first device further comprises:
acquiring the malware from the first device or in route to the first device.

5. The method of claim 1 , wherein simulating the attributes of the first device further comprises:
staging the artefacts within the controlled environment.

6. The method of claim 1 , wherein the one or more computing devices include a server running the controlled environment remotely from the first device.

7. The method of claim 1 , wherein performing the security action further comprises:
identifying one or more attributes of the malware based at least in part on the malware being induced to execute by simulating the attributes of the first device.

8. The method of claim 7 , wherein performing the security action further comprises:
creating one or more signatures of the malware based at least in part on identifying the one or more attributes of the malware.

9. The method of claim 6 , wherein performing the security action further comprises:
using the one or more signatures to identify the malware on a second device different from the first device.

10. The method of claim 1 , wherein the artefact is received in a system snapshot captured by a software agent running on the first device.

11. The method of claim 1 , wherein the artefact comprises environment context information of the first device.

12. The method of claim 1 , wherein the artefact includes at least one of an operating system manufacturer, basic input output system (BIOS) manufacturer, BIOS version, system name of the first device, system manufacturer, a user name associated with the first device, storage drive manufacturer, storage drive size, storage drive type, processor manufacturer, processor speed, processor cache entry, main memory manufacturer, main memory size, registry entry, web browser cookie, one or more files of a file system used by the first device, one or more directories of the file system, metadata of the file system, geographic location information of the first device, time zone information of the first device, mouse manufacturer, mouse movement data, keyboard manufacturer, a language associated with the keyboard, keyboard entry data, computer screen attribute, or any combinations thereof.

13. A computing device configured for using customer context to detonate malware, comprising:
a processor;
memory in electronic communication with the processor, wherein the memory stores computer executable instructions that when executed by the processor cause the processor to perform the steps of:
receiving, by the one or more computing devices, an artefact associated with a first device being targeted by malware, the malware comprising a first portion and a second portion;
simulating in a controlled environment, by the one or more computing devices, attributes of the first device based at least in part on the artefact;
receiving a first portion of the malware at a first point in time;
executing the first portion of the malware in the controlled environment while the attributes of the first device are being simulated;
at a second point in time subsequent to the first point in time, receiving a second portion of the malware;
executing the second portion of the malware in the controlled environment while the attributes of the first device are being simulated; and
performing a security action with respect to the malware based at least in part on the execution of the first portion or the second portion of the malware in the controlled environment.

14. The computing device of claim 13 , wherein the instructions executed by the processor case the processor to perform the steps of:
monitoring the first device; and
determining that the first device is being targeted by the malware based at least in part on the monitoring.

15. The computing device of claim 14 , wherein the instructions executed by the processor case the processor to perform the step of:
identifying the malware based at least in part on the monitoring.

16. The computing device of claim 13 , wherein the instructions executed by the processor case the processor to perform the step of:
acquiring the malware from the first device or in route to the first device.

17. The computing device of claim 13 , wherein the instructions executed by the processor case the processor to perform the steps of:
staging the artefacts within the controlled environment.

18. The computing device of claim 13 , wherein the instructions executed by the processor case the processor to perform the steps of:
identifying one or more attributes of the malware based at least in part on the malware being induced to execute by simulating the attributes of the first device.

19. The computing device of claim 13 , wherein the instructions executed by the processor case the processor to perform the step of:
creating one or more signatures of the malware based at least in part on identifying the one or more attributes of the malware.

20. A computer-program product for using customer context to detonate malware, the computer-program product comprising a non-transitory computer-readable medium storing instructions thereon, the instructions being executable by a processor to:
receiving, by the one or more computing devices, an artefact associated with a first device being targeted by malware, the malware comprising a first portion and a second portion;
simulating in a controlled environment, by the one or more computing devices, attributes of the first device based at least in part on the artefact;
receiving a first portion of the malware at a first point in time;
executing the first portion of the malware in the controlled environment while the attributes of the first device are being simulated;
at a second point in time subsequent to the first point in time, receiving a second portion of the malware;
executing the second portion of the malware in the controlled environment while the attributes of the first device are bein

Assignees

• Ca Inc

Inventors

• Gupta Prashant

Classifications

• G06F21/568 Primary

  eliminating virus, restoring damaged files · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title