Systems and methods for protecting against malware code injections in trusted processes by a multi-target injector

Patent metadata

Field	Value
Publication number	US-11494491-B2
Application number	US-202016812615-A
Country	US
Kind code	B2
Filing date	Mar 9, 2020
Priority date	Mar 16, 2018
Publication date	Nov 8, 2022
Grant date	Nov 8, 2022

Abstract

Disclosed are systems and methods for detecting multiple malicious processes. The described techniques identify a first process and a second process launched on a computing device. The techniques receive from the first process a first execution stack indicating at least one first control point used to monitor at least one thread associated with the first process, and receive from the second process a second execution stack indicating at least one second control point used to monitor at least one thread associated with the second process. The techniques determine that both the first process and the second process are malicious using a machine learning classifier on the at least one first control point and the at least one second control point. In response, the techniques generate an indication that an execution of the first process and the second process is malicious.

First claim

What is claimed is:

1. A method for detecting multiple malicious processes, the method comprising:
identifying a first process and a second process launched on a computing device;
receiving from the first process a first execution stack indicating at least one first control point used to monitor at least one thread associated with the first process;
receiving from the second process a second execution stack indicating at least one second control point used to monitor at least one thread associated with the second process;
determining that both the first process and the second process are malicious using a machine learning classifier on the at least one first control point and the at least one second control point, wherein the machine learning classifier is configured to evaluate maliciousness for a plurality of processes together based on control points of each process, wherein the first process and the second process are identified as non-malicious when scanned individually; and
generating an indication that an execution of the first process and the second process is malicious.

2. The method of claim 1 , further comprising:
determining an identifier of an injecting party associated with thread creation in the first process and the second process, wherein the generated indication comprises the identifier of the injecting party.

3. The method of claim 1 , wherein the machine learning classifier is trained using a dataset that maps control point states of the plurality of processes to a plurality of multi-target injecting identities.

4. The method of claim 1 , wherein identifying the first process and the second process launched on the computing device further comprises:
detecting one of a modification, creation, and deletion of a thread on the computing device; and
determining that the first process and the second process are associated with the one of the modification, creation, and deletion of the thread.

5. The method of claim 1 , wherein the at least one first control point and the least one second control point are associated with events comprising at least one of: create a file, clean up a file, close a file, duplicate a handle, rename a file, delete a file, and create a thread.

6. The method of claim 1 , wherein the at least one first control point and the least one second control point are associated with a system call to create a remote thread that runs in a virtual address space of a second process.

7. The method of claim 6 , wherein the second process comprises a shared-service process configured to import third-party processes to be embedded in the second process as separate threads.

8. The method of claim 1 , further comprising:
performing a remedial action comprising restoration of a file modified by at least one of the first process and the second process and termination of the first process and the second process.

9. A system for detecting multiple malicious processes, the system comprising:
a hardware processor configured to:
identify a first process and a second process launched on a computing device;
receive from the first process a first execution stack indicating at least one first control point used to monitor at least one thread associated with the first process;
receive from the second process a second execution stack indicating at least one second control point used to monitor at least one thread associated with the second process;
determine that both the first process and the second process are malicious using a machine learning classifier on the at least one first control point and the at least one second control point, wherein the machine learning classifier is configured to evaluate maliciousness for a plurality of processes together based on control points of each process, wherein the first process and the second process are identified as non-malicious when scanned individually; and
generate an indication that an execution of the first process and the second process is malicious.

10. The system of claim 9 , wherein the hardware processor is further configured to:
determine an identifier of an injecting party associated with thread creation in the first process and the second process, wherein the generated indication comprises the identifier of the injecting party.

11. The system of claim 9 , wherein the hardware processor is further configured to train the machine learning classifier using a dataset that maps control point states of the plurality of processes to a plurality of multi-target injecting identities.

12. The system of claim 9 , wherein the hardware processor is further configured to identify the first process and the second process launched on the computing device by:
detecting one of a modification, creation, and deletion of a thread on the computing device; and
determining that the first process and the second process are associated with the one of the modification, creation, and deletion of the thread.

13. The system of claim 9 , wherein the at least one first control point and the least one second control point are associated with events comprising at least one of: create a file, clean up a file, close a file, duplicate a handle, rename a file, delete a file, and create a thread.

14. The system of claim 9 , wherein the at least one first control point and the least one second control point are associated with a system call to create a remote thread that runs in a virtual address space of a second process.

15. The system of claim 14 , wherein the second process comprises a shared-service process configured to import third-party processes to be embedded in the second process as separate threads.

16. The system of claim 9 , wherein the hardware processor is further configured to:
performing a remedial action comprising restoration of a file modified by at least one of the first process and the second process and termination of the first process and the second process.

17. A non-transitory computer readable medium storing thereon computer executable instructions for detecting multiple malicious processes, including instructions for:
identifying a first process and a second process launched on a computing device;
receiving from the first process a first execution stack indicating at least one first control point used to monitor at least one thread associated with the first process;
receiving from the second process a second execution stack indicating at least one second control point used to monitor at least one thread associated with the second process;
determining that both the first process and the second process are malicious using a machine learning classifier on the at least one first control point and the at least one second control point, wherein the machine learning classifier is configured to evaluate maliciousness for a plurality of processes together based on control points of each process, wherein the first process and the second process are identified as non-malicious when scanned individually; and
generating an indication that an execution of the first process and the second process is malicious.

18. The non-transitory computer readable medium of claim 17 , further comprising instructions for:
determining an identifier of an injecting party associated with thread creation in the first process and the second process, wherein the generated indication comprises the identifier of the injecting party.

19. The non-transitory computer readable medium of claim 17 , wherein the machine learning classifier is trained using a dataset that maps control point states

Assignees

• Acronis Int Gmbh

Inventors

• Strogov Vladimir
• Beloussov Serguei
• Dodz Aliaksei
• Cherniakovskii Valerii
• Stupak Anatoly
• Ulasen Sergey
• Grebennikov Nikolay
• Levchenko Vyacheslav
• Protasov Stanislav

Classifications

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06N20/20

  Ensemble learning · CPC title