Detection and mitigation of fileless security threats

Patent metadata

Field	Value
Publication number	US-11204998-B2
Application number	US-201816056828-A
Country	US
Kind code	B2
Filing date	Aug 7, 2018
Priority date	Aug 7, 2018
Publication date	Dec 21, 2021
Grant date	Dec 21, 2021

Abstract

There is disclosed in one example a computing apparatus, including: a hardware platform; and a storage medium having stored thereon executable instructions to provide an inference engine configured to: receive a new suspicious fragment object from a protected device; add the new suspicious fragment object to a rolling map configured to provide a temporal snapshot of suspicious fragment objects over a time span; determine a connection between the new suspicious fragment object and an existing suspicious fragment object within the rolling map; apply the connection to a connection map; and operate a map classifier to determine that the connection map represents a probable computer security threat.

First claim

What is claimed is:

1. A computing apparatus, comprising:
a hardware platform; and
a storage medium having stored thereon executable instructions to provide a threat detection engine configured to:
identify two or more suspicious fragment objects, wherein at least two of the two or more identified suspicious fragment objects are each located in a different location of a device, wherein the different locations include two or more of a windows management instrumentation (WMI) entry, a registry hive, an environment variable, a link, a shortcut, a macro, a scheduled task, and a cookie;
store the two or more identified suspicious fragments objects;
add the two or more stored identified suspicious fragments objects to a rolling map to provide a temporal snapshot of suspicious fragment objects over a time span;
determine a connection between the two or more stored identified suspicious fragments objects within the rolling map by analyzing data in each of the two or more stored identified suspicious fragment objects and metadata associated with each of the two or more stored identified suspicious fragment objects to determine previous and possible future connections;
determine if the two or more stored identified suspicious fragment objects represent a probable computer security threat;
predict a fragment object to occur on the device at an additional location different than the locations of the two or more identified suspicious fragment objects; and
provide a message to the device to search for the predicted fragment object at the additional location.

2. The computing apparatus of claim 1 , wherein the time span is one hour.

3. The computing apparatus of claim 1 , wherein determining that the two or more stored identified suspicious fragment objects represent the probable computer security threat comprises linking the two or more stored identified suspicious fragment objects based on data in each of the two or more stored identified suspicious fragment objects and metadata associated with each of the two or more stored identified suspicious fragment objects.

4. The computing apparatus of claim 1 , wherein determining the connection includes identifying a verified connection between the two or more stored identified suspicious fragment objects.

5. One or more tangible, non-transitory computer-readable storage mediums having stored thereon executable instructions to provide an inference engine configured to:
receive, over a network connection, a new suspicious fragment object from a client device;
add the new suspicious fragment object to a rolling map to provide a snapshot of suspicious fragment objects over a time span;
identify a probable connection between the new suspicious fragment object and an existing suspicious fragment object within the rolling map by analyzing data in each of the new suspicious fragment object and the existing suspicious fragment object and metadata associated with each of the new suspicious fragment object and the existing suspicious fragment object to determine previous and possible future connections;
determine that the identified probable connection between the new suspicious fragment object and the existing suspicious fragment object represents a probable computer security threat, wherein the new suspicious fragment object and the existing suspicious fragment object are each located in a different location of the client device, wherein the different locations include two or more of a windows management instrumentation (WMI) entry, a registry hive, an environment variable, a link, a shortcut, a macro, a scheduled task, and a cookie;
predict a fragment object to occur on the device at an additional location different than the locations of the new suspicious fragment object and existing suspicious fragment object; and
provide a message to the client device to search for the predicted fragment object at the additional location.

6. The one or more tangible, non-transitory computer-readable mediums of claim 5 , wherein the time span is one hour.

7. The one or more tangible, non-transitory computer-readable mediums of claim 5 , wherein determining that the identified probable connection between the new suspicious fragment object and the existing suspicious fragment object represents the probable computer security threat comprises linking the new suspicious fragment object and the existing suspicious fragment object based on data in each of the new suspicious fragment object and the existing suspicious fragment object and metadata associated with each of the new suspicious fragment object and the existing suspicious fragment object.

8. The one or more tangible, non-transitory computer-readable mediums of claim 5 , wherein determining that the identified probable connection between the new suspicious fragment object and the existing suspicious fragment object represents the probable computer security threat comprises identifying a verified connection between the new suspicious fragment object and the existing suspicious fragment object.

9. A computer-implemented method of securing a device against a living-off-the-land attack, comprising:
receiving a new suspicious fragment object from a client device;
adding the new suspicious fragment object to a rolling map to provide a snapshot of suspicious fragment objects over a time span;
identifying a probable connection between the new suspicious fragment object and an existing suspicious fragment object within the rolling map by analyzing data in each of the new suspicious fragment object and the existing suspicious fragment object and metadata associated with each of the new suspicious fragment object and the existing suspicious fragment object to determine previous and possible future connections;
determining that the probable connection between the new suspicious fragment object and the existing suspicious fragment object represents a probable computer security threat, wherein the new suspicious fragment object and the existing suspicious fragment object are each located in a different location of the client device, wherein the different locations include two or more of a windows management instrumentation (WMI) entry, a registry hive, an environment variable, a link, a shortcut, a macro, a scheduled task, and a cookie;
predicting a fragment object to occur on the client device at an additional location different than the locations of the new suspicious fragment object and the existing suspicious fragment object; and
providing a message to the client device to instruct the client device to search for the predicted fragment object at the additional location.

10. The method of claim 9 , wherein the time span is one hour.

11. The method of claim 9 , wherein determining that the identified probable connection between the new suspicious fragment object and the existing suspicious fragment object represents the probable computer security threat comprises linking the new suspicious fragment object and the existing suspicious fragment object based on data in each of the new suspicious fragment object and the existing suspicious fragment object and metadata associated with each of the new suspicious fragment object and the existing suspicious fragment object.

12. The computing apparatus of claim 1 , further comprising:
based on the two or more identified suspicious fragments objects, determine one or more fragment objects that are part of the probable computer security threat but have not been identified as being located on the device; and
search the device for the determined two or more identified suspicious fragment objects.

13. The computing apparatus of claim 1 , further comprising

Assignees

• Mcafee Llc

Inventors

• Lancioni German
• Cochin Cedric
• Mehta Kunal

Classifications

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06F21/563

  by source code analysis · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/565 Primary

  by checking file integrity · CPC title