Automated software safeness categorization with installation lineage and hybrid information sources

Patent metadata

Field	Value
Publication number	US-10929539-B2
Application number	US-201816040086-A
Country	US
Kind code	B2
Filing date	Jul 19, 2018
Priority date	Aug 11, 2017
Publication date	Feb 23, 2021
Grant date	Feb 23, 2021

Abstract

Systems and methods are disclosed for enhancing cybersecurity in a computer system by detecting safeness levels of executables. An installation lineage of an executable is identified in which entities forming the installation lineage include at least an installer of the monitored executable, and a network address from which the executable is retrieved. Each entity of the entities forming the installation lineage is individually analyzed using at least one safeness analysis. Results of the at least one safeness analysis of each entity are inherited by other entities in the lineage of the executable. A backtrace result for the executable is determined based on the inherited safeness evaluation of the executable. A total safeness of the executable, based on at least the backtrace result, is evaluated against a set of thresholds to detect a safeness level of the executable. The safeness level of the executable is output on a display screen.

First claim

What is claimed is:

1. A computer-implemented method for enhancing cybersecurity in a computer environment by detecting a safeness level of an executable, comprising:
identifying an installation lineage of any type of executable, entities forming the installation lineage including at least an installer of the executable, and a network address from which the executable is retrieved;
analyzing, individually, each entity of the entities forming the installation lineage using at least one safeness analysis, results of the at least one safeness analysis of each entity being inherited by other entities in the lineage of the executable;
determining a backtrace result for the executable based on an inherited safeness evaluation of the executable, the backtrace result being determined by collecting and analyzing reputations of dependent binaries of the executable, and the executable inheriting the reputations of the dependent binaries;
evaluating a total safeness of the executable against a set of thresholds to detect a safeness level of the executable, the total safeness based on at least the backtrace result and a weighted backtrace score determined using a generated dependency importance factor; and
outputting, on a display screen, the safeness level of the executable.

2. The computer-implemented method as recited in claim 1 , further comprising analyzing the executable using the at least one safeness analysis based on gathered program information relating to the executable.

3. The computer-implemented method as recited in claim 2 , wherein evaluating the total safeness of the executable is based on the backtrace result and respective results of the at least one safeness analysis, the safeness level being selected from at least one of: safe, unsafe and unknown.

4. The computer-implemented method as recited in claim 1 , wherein the at least one safeness analysis comprises comparing a behavior of the executable against predefined lists of suspicious process behavior, file behavior and network behavior.

5. The computer-implemented method as recited in claim 1 , wherein the at least one safeness analysis comprises:
generating an executable signature by a hash function based on the executable; and
evaluating the executable signature by accessing a database of executable signatures.

6. The computer-implemented method as recited in claim 1 , wherein the at least one safeness analysis comprises verifying a developer signature of the executable, the developer signature being generated by a developer of the executable, verifying the developer signature includes accessing a database of developer signatures.

7. The computer-implemented method as recited in claim 1 , wherein the at least one safeness analysis comprises conducting one or more anti-virus scans of the executable, each anti-virus scan being conducted by a different anti-virus program.

8. The computer-implemented method as recited in claim 1 , wherein the at least one safeness analysis comprises searching known safe software repositories to determine if the executable is hosted thereon.

9. The computer-implemented method as recited in claim 1 , further comprising:
inputting, on a user interface, feedback regarding the safeness level of the executable and storing the feedback in association with the executable;
adjusting the safeness level of the executable based on the feedback; and
referring to the feedback associated with the executable during future evaluation of the total safeness of the executable.

10. A system for enhancing cybersecurity in a computer system by detecting a safeness level of an executable, comprising:
a storage device configured to store program code and program information relating to any type of executable;
a processor operatively coupled to the storage device and configured to detect a safeness level of the executable by executing program code, stored on the storage device, to:
identify an installation lineage of an executable, entities forming the installation lineage including at least an installer of the executable, and a network address from which the executable is retrieved;
analyze, individually, each entity of the entities forming the installation lineage using at least one safeness analysis, results of the at least one safeness analysis of each entity being inherited by other entities in the lineage of the executable;
determine a backtrace result for the executable based on an inherited safeness evaluation of the executable, the backtrace result being determined by collecting and analyzing reputations of dependent binaries of the executable, and the executable inheriting the reputations of the dependent binaries; and
evaluate a total safeness of the executable against a set of thresholds to detect a safeness level of the executable, the total safeness based on at least the backtrace result and a weighted backtrace score determined using a generated dependency importance factor; and

a display screen having a graphical user interface implemented by the processor and displayed on the display screen, the graphical user interface configured to present the safeness level of the executable, and accept feedback overriding the safeness level of the executable.

11. The system as recited in claim 10 , wherein the processor further executes program code to:
analyze the executable using the at least one safeness analysis based on gathered program information relating to the executable.

12. The system as recited in claim 11 , wherein the processor evaluates the total safeness of the executable based on the backtrace result and respective results of the at least one safeness analysis, the processor selecting the safeness level from at least one of: safe, unsafe and unknown.

13. The system as recited in claim 10 , wherein the processor further executes program code to compare a behavior of the executable against predefined lists of suspicious process behavior, file behavior and network behavior.

14. The system as recited in claim 10 , wherein the processor further executes program code to:
generate an executable signature by a hash function based on the executable; and
evaluate the executable signature by accessing a database of executable signatures.

15. The system as recited in claim 10 , wherein the processor further executes program code to verify a developer signature of the executable, the developer signature being generated by a developer of the executable, the developer signature being verified by at least accessing a database of developer signatures.

16. The system as recited in claim 10 , wherein the processor further executes program code to conduct one or more anti-virus scans of the executable, each anti-virus scan being conducted by a different anti-virus program.

17. The system as recited in claim 10 , wherein the processor further executes program code to:
receive, on a user interface, feedback regarding the safeness level of the executable and store the feedback in association with the executable;
adjust the safeness level of the executable based on the feedback; and
refer to the feedback associated with the executable during future evaluation of the total safeness score of the executable.

18. A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method for enhancing cybersecurity of the computer by detecting a safeness level of an executable, comprising:
identifying an installation lineage o

Assignees

• Nec Lab America Inc
• Nec Corp

Inventors

• Rhee Jungwhan
• Wu Zhenyu
• Korts-Parn Lauri
• Jee Kangkook
• Li Zhichun
• Setayeshfar Omid

Classifications

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title