Deactivating evasive malware

Patent metadata

Field	Value
Publication number	US-11144642-B2
Application number	US-201916694185-A
Country	US
Kind code	B2
Filing date	Nov 25, 2019
Priority date	Oct 6, 2017
Publication date	Oct 12, 2021
Grant date	Oct 12, 2021

Abstract

A computer-implemented method, a computer program product, and a computer system. The computer system installs and configures a virtual imitating resource in the computer system, wherein the virtual imitating resource imitates a set of resources in the computer system. Installing and configuring the virtual imitating resource includes modifying respective values of an installed version of the virtual imitating resource for an environment of the computer system, determining whether the virtual imitating resource is a static imitating resource or a dynamic imitating resource, and comparing a call graph of the evasive malware with patterns of dynamic imitating resources on a database. The computer system returns a response from an appropriate element of the virtual imitating resource, in response to a call from the evasive malware to a real computing resource, return, by the computer system.

First claim

What is claimed is:

1. A computer-implemented method for protecting a host from evasive malware, the computer-implemented method comprising:
installing and configuring, by a computer system, a virtual imitating resource in the computer system, the virtual imitating resource imitating a set of resources in the computer system, wherein installing and configuring the virtual imitating resource includes modifying respective values of an installed version of the virtual imitating resource for an environment of the computer system, wherein installing and configuring the virtual imitating resource further includes determining whether the virtual imitating resource is a static imitating resource or a dynamic imitating resource, wherein installing and configuring the virtual imitating resource further includes, in response to determining that the virtual imitating resource is the dynamic imitating resource, comparing a call graph of the evasive malware with patterns of dynamic imitating resources on a database;
in response to a call from the evasive malware to a real computing resource, returning, by the computer system, a response from an appropriate element of the virtual imitating resource.

2. The computer-implemented method of claim 1 , further comprising:
installing, by the computer system, the virtual imitating resource in an application layer of the computer system to imitate a real application resource in the application layer.

3. The computer-implemented method of claim 1 , further comprising:
installing, by the computer system, the virtual imitating resource in an operating system layer of the computer system to imitate a real operating system resource in the operating system layer.

4. The computer-implemented method of claim 1 , further comprising:
installing, by the computer system, the virtual imitating resource in a hardware layer of the computer system to imitate a real hardware resource in the hardware layer.

5. The computer-implemented method of claim 1 , wherein the virtual imitating resource is generated by a server, based on public reports of malware analysis, wherein the virtual imitating resource is stored by the server in a database storing imitating resources.

6. The computer-implemented method of claim 5 , wherein the virtual imitating resource is retrieved by the computer system from the database storing imitating resources.

7. The computer-implemented method of claim 1 , wherein the virtual imitating resource is one of static resources whose values are deterministic, wherein the static resources are at least one of processes and files.

8. A computer program product for protecting a host from evasive malware, the computer program product comprising one or more computer-readable tangible storage devices and program instructions stored on at least one of the one or more computer-readable tangible storage devices, the program instructions executable to:
install and configure, by a computer system, a virtual imitating resource in the computer system, the virtual imitating resource imitating a set of resources in the computer system, wherein installing and configuring the virtual imitating resource includes modifying respective values of an installed version of the virtual imitating resource for an environment of the computer system, wherein installing and configuring the virtual imitating resource further includes determining whether the virtual imitating resource is a static imitating resource or a dynamic imitating resource, wherein installing and configuring the virtual imitating resource further includes, in response to determining that the virtual imitating resource is the dynamic imitating resource, comparing a call graph of the evasive malware with patterns of dynamic imitating resources on a database;
in response to a call from the evasive malware to a real computing resource, return, by the computer system, a response from an appropriate element of the virtual imitating resource.

9. The computer program product of claim 8 , further comprising the program instructions executable to:
install, by the computer system, the virtual imitating resource in an application layer of the computer system to imitate a real application resource in the application layer.

10. The computer program product of claim 8 , further comprising the program instructions executable to:
install, by the computer system, the virtual imitating resource in an operating system layer of the computer system to imitate a real operating system resource in the operating system layer.

11. The computer program product of claim 8 , further comprising the program instructions executable to:
install, by the computer system, the virtual imitating resource in a hardware layer of the computer system to imitate a real hardware resource in the hardware layer.

12. The computer program product of claim 8 , wherein the virtual imitating resource is generated by a server, based on public reports of malware analysis, wherein the virtual imitating resource is stored by the server in a database storing imitating resources.

13. The computer program product of claim 12 , wherein the virtual imitating resource is retrieved by the computer system from the database storing imitating resources.

14. The computer program product of claim 8 , wherein the virtual imitating resource is one of static resources whose values are deterministic, wherein the static resources are at least one of processes and files.

15. A computer system for deactivating evasive malware, the computer system comprising:
one or more processors, one or more computer readable tangible storage devices, and program instructions stored on at least one of the one or more computer readable tangible storage devices for execution by at least one of the one or more processors, the program instructions executable to:

install and configure, by the computer system, a virtual imitating resource in the computer system, the virtual imitating resource imitating a set of resources in the computer system, wherein installing and configuring the virtual imitating resource includes modifying respective values of an installed version of the virtual imitating resource for an environment of the computer system, wherein installing and configuring the virtual imitating resource further includes determining whether the virtual imitating resource is a static imitating resource or a dynamic imitating resource, wherein installing and configuring the virtual imitating resource further includes, in response to determining that the virtual imitating resource is the dynamic imitating resource, comparing a call graph of the evasive malware with patterns of dynamic imitating resources on a database;
in response to a call from the evasive malware to a real computing resource, return, by the computer system, a response from an appropriate element of the virtual imitating resource.

16. The computer system of claim 15 , further comprising the program instructions executable to:
install, by the computer system, the virtual imitating resource in an application layer of the computer system to imitate a real application resource in the application layer.

17. The computer system of claim 15 , further comprising the program instructions executable to:
install, by the computer system, the virtual imitating resource in an operating system layer of the computer system to imitate a real operating system resource in the operating system layer.

18. The computer system of claim 15 , further comprising the program instructions executable to:
install, by the compu

Assignees

• IBM

Inventors

• Gu Zhongshu
• Huang Heqing
• Jang Jiyong
• Kirat Dhilung Hang
• Shu Xiaokui
• Stoecklin Marc P
• Zhang Jialong

Classifications

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title

• G06F16/22

  Indexing; Data structures therefor; Storage structures · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title