Managed software remediation

Patent metadata

Field	Value
Publication number	US-2016205115-A1
Application number	US-201314913722-A
Country	US
Kind code	A1
Filing date	Dec 21, 2013
Priority date	Sep 27, 2013
Publication date	Jul 14, 2016
Grant date	—

Abstract

According to one example, a system and method are disclosed for malware and grayware remediation. For example, the system is operable to identify applications that have some legitimate behavior but that also exhibit some undesirable behavior. A remediation engine is provided to detect malware behavior in otherwise useful applications, and allow the useful parts of the application to run while blocking the malware behavior. In an example method of “healing,” this may involve modifying the application binary to remove undesirable behavior. In an example method of “personalization,” this may involve inserting control hooks through the operating system to prevent certain subroutines from taking effect.

First claim

1 . A client device comprising:
a processor; a network interface; and a memory having stored thereon an application binary and executable instructions operable to:
receive remediation data for the application binary; and
personalize the application binary by inserting operating system hooks to selectively enforce access permissions to system services, wherein selectively enforcing is based on the remediation data.

2 . The client device of claim 1 , wherein the system services are selected from the group consisting of geographic location, e-mail, short messaging service, telephony, contacts, internet access, camera, touchscreen, microphone, and speakers.

3 . The client device of claim 1 , wherein the remediation data comprises personalization rules.

4 . The client device of claim 3 , wherein the personalization rules comprise structured data identifying one or more malware behaviors in the application binary, and a remedial action for each malware behavior identified.

5 . The client device of claim 3 , wherein the personalization rules comprise a malware reputation for the application binary.

6 . The client device of claim 1 , wherein the instructions are further operable to selectively enforce access permissions based on a user configuration.

7 . The client device of claim 6 , wherein the user configuration comprises instructions operable to provide interactive user input.

8 . A remediation server comprising:
a processor; a network interface; and a memory having stored thereon executable instructions operable to: receive an application binary; create an application logic model of the application binary; and create personalization rules for the application binary based on the application logic model.

9 . The remediation server of claim 8 , wherein the executable instructions are further operable to:
disassemble the application binary; detect malware behavior in the application binary; and heal the application binary by inserting or removing instructions to ameliorate the malware behavior and recompile the application binary.

10 . The remediation server of claim 8 , wherein creating personalization rules comprises receiving application programming interface (API) intelligence from a platform API intelligence database.

11 . The remediation server of claim 8 , wherein creating personalization rules comprises receiving threat intelligence from a global threat intelligence database.

12 . The remediation server of claim 8 , wherein creating personalization rules comprises performing heuristic analysis on the application binary.

13 . The remediation server of claim 8 , wherein the application logic model comprises structured text configured to contain text objects representing application programming interface (API) elements.

14 . At least one computer-readable storage medium having stored thereon executable instructions operable to remedy an application binary, including instructions operable to:
receive a reputation for the application binary; if the reputation is malware, selectively install the application binary based on a user configuration input; and personalize the application by running the application concurrently with a personalization engine.

15 . The computer-readable storage medium of claim 14 , wherein the instructions are further operable to:
if the reputation is malware, provide the application binary to a remediation server; and receive a healed application binary from the remediation server.

16 . The computer-readable storage medium of claim 15 , wherein the instructions are further operable to inhibit installation of the application binary until after receiving the healed application binary from the remediation server.

17 . The computer-readable storage medium of claim 14 , wherein instructions operable to selectively install the application binary based on a user configuration input are further operable to:
provide an interactive user interface element requesting confirmation to install the application binary; and install the application binary only if a positive response is received to the interactive user interface element.

18 . The computer-readable storage medium of claim 17 , wherein the instructions operable to provide an interactive user interface element are further operable to provide therewith an actionable, human-readable description of behaviors of the application binary.

19 . The computer-readable storage medium of claim 14 , wherein the instructions operable to personalize the application by running the application concurrently with a personalization engine are further operable to receive input from a user interface element to selectively provide access to system services.

20 . The computer-readable storage medium of claim 19 , wherein the system services are selected from the group consisting of geographic location, e-mail, short messaging service, telephony, contacts, internet access, camera, touchscreen, microphone, and speakers.

21 . The computer-readable storage medium of claim 14 , wherein the software instructions are further operable to provide a remediation engine.

22 . The computer-readable storage medium of claim 21 , wherein the software instructions operable to provide the remediation engine are further operable to:
disassemble the application binary; detect malware behavior in the application binary; and heal the application binary by inserting or removing instructions to ameliorate the malware behavior and recompile the application binary.

23 . The computer-readable storage medium of claim 22 , wherein the software instructions operable to provide the remediation engine are further operable to:
create an application logic model of the application binary; and create personalization rules for the application binary based on the application logic model.

24 . The computer-readable storage medium of claim 14 , wherein the software instructions are further operable to provide closed-loop analysis with a global threat intelligence service.

25 . A method of remedying an application binary comprising:
receiving remediation data for the application binary; and personalizing the application binary by inserting operating system hooks to selectively enforce access permissions to system services, wherein selectively enforcing is based on the remediation data.

26 . The method of claim 25 , further comprising:
disassembling the application binary; detecting malware behavior in the application binary; and healing the application binary by inserting or removing instructions to ameliorate the malware behavior and recompile the application binary.

Assignees

• Kulkarni Dattatraya
• Nalluri Srikanth
• Sinha Raja
• Krishnapur Venkatasubrahmanyam
• Mcafee Inc

Inventors

• Kulkarni Dattatraya
• Nalluri Srikanth
• Sinha Raja
• Krishnapur Venkatasubrahmanyam

Classifications

• G06F21/568 Primary

  eliminating virus, restoring damaged files · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04W12/08

  Access security · CPC title

• H04W12/12

  Detection or prevention of fraud · CPC title