Method of malware detection and system thereof

Patent metadata

Field	Value
Publication number	US-12026257-B2
Application number	US-202318179711-A
Country	US
Kind code	B2
Filing date	Mar 7, 2023
Priority date	Aug 11, 2014
Publication date	Jul 2, 2024
Grant date	Jul 2, 2024

Abstract

There is provided a system and a computer-implemented method of detecting malware in real time in a live environment. The method comprises: monitoring one or more operations of at least one program concurrently running in the live environment, building at least one stateful model in accordance with the one or more operations, analyzing the at least one stateful model to identify one or more behaviors, and determining the presence of malware based on the identified one or more behaviors.

First claim

The invention claimed is:

1. A computer-implemented method of performing a behavior-based analysis of an execution of a program in an operating system, the method comprising:
monitoring, by a computer system, by registering one or more kernel filter drivers for kernel space operations via one or more call back functions using an out-of-band monitoring module, one or more operations performed by the execution of the program running in the operating system in a live environment, wherein the monitoring comprises tracking user space operations and the kernel space operations;
generating, by the computer system, an event data for each of the one or more monitored operations;
normalizing the event data into a logical data structure such that attributes of the event data can accessed and analyzed;
building, by the computer system, at least one stateful model of the execution of the program based on the normalized event data, the at least one stateful model comprising a hierarchal structure of the one or more monitored operations performed by the execution of the program in the live environment, the one or more monitored operations linked by an event context, wherein the hierarchal structure comprises:
the event context comprising:
one or more objects derived from the one or more monitored operations;
one or more fields generated for each of the one or more objects, the one or more fields storing one or more parameters characterizing a respective object of the one or more objects and an associate to the respective object; and
one or more relationships identified among the one or more objects; and

attributes characterizing the one or more objects and the one or more relationships among the one or more objects, wherein the attributes comprise at least a type of the one or more monitored operations and a source of the one or more events;

analyzing, by the computer system, the event context to identify one or more behaviors of the execution of the program related to the one or more events; and
applying a score to the stateful model based on the one or more identified behaviors, wherein applying the score to the stateful model comprises:
determining a weighted behavior score for each of the one or more identified behaviors, wherein the weighted behavior score indicates a likelihood of the presence of malware based on the one or more identified behaviors;
determining the score by computing a sum of the weighted behavior scores for each of the one or more identified behaviors; and

comparing the one or more identified behaviors and the score to one or more pre-existing behaviors and a pre-existing score of a pre-existing stateful model.

2. The computer-implemented method of claim 1 , further comprising updating, in real time, the at least one stateful model in response to one or more new events.

3. The computer-implemented method of claim 1 , further comprising outputting, via an output device of the computer system, a representation of the one or more identified behaviors of the execution of the program.

4. The computer-implemented method of claim 1 , further comprising storing the one or more identified behaviors of the execution of the program in a behavioral profile database.

5. The computer-implemented method of claim 1 , wherein the computer system comprises a cloud-based computer system.

6. The computer-implemented method of claim 1 , wherein the computer system comprises one or more functional components distributed over more than one computer.

7. The computer-implemented method of claim 1 , wherein the live environment comprises one or more programs, including the program, operating concurrently and interactively for their intended uses.

8. The computer-implemented method of claim 1 , further comprising aggregating the one or more identified behaviors.

9. The computer-implemented method of claim 1 , wherein the one or more behaviors comprise a representation of a behavior pattern of the execution of the program.

10. The computer-implemented method of claim 1 , further comprising analyzing the one or more behaviors to determine if the execution of the program comprises malware.

11. A system for performing a behavior-based analysis of an execution of a program in an operating system, the system comprising:
one or more computer readable storage devices configured to store a plurality of computer executable instructions; and
one or more hardware computer processors in communication with the one or more computer readable storage devices and configured to execute the plurality of computer executable instructions in order to cause the system to:
monitor, by registering one or more kernel filter drivers for kernel space operations via one or more call back functions using an out-of-band monitoring module, one or more operations performed by the execution of the program running in the operating system in a live environment, wherein monitoring comprises tracking user space operations and the kernel space operations;
generate an event data for each of the one or more operations of interest, wherein the event data characterizes one or more events of the one or more monitored operations;
normalize the event data into a logical data structure such that attributes of the event data can accessed and analyzed;
build at least one stateful model of the execution of the program based on the normalized event data, the at least one stateful model comprising a hierarchal structure of the one or more monitored operations by the execution of the program in the live environment, the one or more monitored operations linked by an event context, wherein the at least one stateful model comprises:
the event context comprising:
one or more objects derived from the one or more monitored operations;
one or more fields generated for each of the one or more objects, the one or more fields storing one or more parameters characterizing a respective object of the one or more objects and an associate to the respective object; and
one or more relationships identified among the one or more objects; and

attributes characterizing the one or more objects and the one or more relationships among the one or more objects, wherein the attributes comprise at least a type of the one or more monitored operations and a source of the one or more events;

analyze the event context to identify one or more behaviors of the execution of the program related to the one or more events; and
apply a score to the stateful model based on the one or more identified behaviors, wherein applying the score to the stateful model comprises:
determining a weighted behavior score for each of the one or more identified behaviors, wherein the weighted behavior score indicates a likelihood of the presence of malware based on the one or more identified behaviors; and
determining the score by computing a sum of the weighted behavior scores for each of the one or more identified behaviors; and

compare the one or more identified behaviors and the score to one or more pre-existing behaviors and a pre-existing score of a pre-existing stateful model.

12. The system of claim 11 , wherein the system is further caused to update, in real time, the at least one stateful model in response to one or more new events.

13. The system of claim 11 , wherein the system is further caused to output, via an output device of the system, a representation of the one of more behaviors of the execution of the program.

14. The system of claim 11 , wherein the system is further caused to store the one or more behaviors of the execution of the program in a behavioral profile database.

15. The sy

Assignees

• Sentinel Labs Israel Ltd

Inventors

• Weingarten Tomer
• Cohen Almog
• Shamir Udi
• Motil Kirill

Classifications

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title