Methods, media, and systems for detecting attack on a digital processing device

Patent metadata

Field	Value
Publication number	US-2019311113-A1
Application number	US-201816215976-A
Country	US
Kind code	A1
Filing date	Dec 11, 2018
Priority date	Sep 18, 2006
Publication date	Oct 10, 2019
Grant date	—

Abstract

Methods, media, and systems for detecting attack are provided. In some embodiments, the methods include: comparing at least part of a document to a static detection model; determining whether attacking code is included in the document based on the comparison of the document to the static detection model; executing at least part of the document; determining whether attacking code is included in the document based on the execution of the at least part of the document; and if attacking code is determined to be included in the document based on at least one of the comparison of the document to the static detection model and the execution of the at least part of the document, reporting the presence of an attack. In some embodiments, the methods include: selecting a data segment in at least one portion of an electronic document; determining whether the arbitrarily selected data segment can be altered without causing the electronic document to result in an error when processed by a corresponding program; in response to determining that the arbitrarily selected data segment can be altered, arbitrarily altering the data segment in the at least one portion of the electronic document to produce an altered electronic document; and determining whether the corresponding program produces an error state when the altered electronic document is processed by the corresponding program.

First claim

1 . (canceled)

2 . A method for detecting an attack on an application, comprising:
performing, using a digital processing device, a static analysis by comparing at least part of a document to a first detection model; determining, using the digital processing device, whether attacking code is included in the document based on the comparison of the document to the first detection model; performing, using the digital processing device, a dynamic analysis by comparing behavior observed by execution of the document to a second detection model; determining, using the digital processing device, whether the attacking code is included in the document based on the comparison of the behavior observed by the execution of the document to the second detection model; and reporting, using the digital processing device, the presence of an attack based on the static analysis and the dynamic analysis.

3 . The method of claim 2 , further comprising updating the first detection model if attacking code is determined to be present based on the execution of the at least part of the document.

4 . The method of claim 2 , wherein the determining whether attacking code is included in the document based on the execution of the at least part of the document comprises comparing the behavior observed by the execution of the document to behavior observed by execution of at least one of known attacking documents and known benign documents.

5 . The method of claim 2 , wherein at least part of the second detection model is created by:
executing at least one known malicious document in a first environment; executing the at least one known malicious document in a second environment; comparing the behavior observed by execution in the first environment to the behavior observed by execution in the second environment to determine any differences in behavior; and adding at least one difference in behavior to the second detection model, wherein the document is executed in at least one of the first environment and second environment.

6 . The method of claim 2 , further comprising parsing the document into sections and wherein the comparing the at least part of the document to the first detection model by selecting at least one the sections and comparing the at least one selected section to the first detection model.

7 . The method of claim 2 , wherein the document is a word processing document, wherein the execution comprises opening the document in a word processing application, wherein the document is embedded with at least one of an image, a table, and injected code, and wherein the document is executed in a protected environment.

8 . A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting an attack on an application, the method comprising:
performing a static analysis by comparing at least part of a document to a first detection model; determining whether attacking code is included in the document based on the comparison of the document to the first detection model; performing a dynamic analysis by comparing behavior observed by execution of the document to a second detection model; determining whether the attacking code is included in the document based on the comparison of the behavior observed by the execution of the document to the second detection model; and reporting the presence of an attack based on the static analysis and the dynamic analysis.

9 . The non-transitory computer-readable medium of claim 8 , wherein the method further comprises updating the first detection model if attacking code is determined to be present based on the execution of the at least part of the document.

10 . The non-transitory computer-readable medium of claim 8 , wherein the determining whether attacking code is included in the document based on the execution of the at least part of the document comprises comparing the behavior observed by the execution of the document to behavior observed by execution of at least one of known attacking documents and known benign documents.

11 . The non-transitory computer-readable medium of claim 8 , wherein at least part of the second detection model is created by:
executing at least one known malicious document in a first environment; executing the at least one known malicious document in a second environment; comparing the behavior observed by execution in the first environment to the behavior observed by execution in the second environment to determine any differences in behavior; and adding at least one difference in behavior to the second detection model, wherein the document is executed in at least one of the first environment and second environment.

12 . The non-transitory computer-readable medium of claim 8 , wherein the method further comprises parsing the document into sections and wherein the comparing the at least part of the document to the first detection model by selecting at least one the sections and comparing the at least one selected section to the first detection model.

13 . The non-transitory computer-readable medium of claim 8 , wherein the document is a word processing document, wherein the execution comprises opening the document in a word processing application, wherein the document is embedded with at least one of an image, a table, and injected code, and wherein the document is executed in a protected environment.

14 . A system for detecting attack, the system comprising:
a memory; and a processor in communication with the memory, wherein the processor is configured to:
perform a static analysis by comparing at least part of a document to a first detection model;
determine whether attacking code is included in the document based on the comparison of the document to the first detection model;
perform a dynamic analysis by comparing behavior observed by execution of the document to a second detection model;
determine whether the attacking code is included in the document based on the comparison of the behavior observed by the execution of the document to the second detection model; and
report the presence of an attack based on the static analysis and the dynamic analysis.

15 . The system of claim 14 , wherein the processor is further configured to update the first detection model if attacking code is determined to be present based on the execution of the at least part of the document.

16 . The system of claim 14 , wherein the determining whether attacking code is included in the document based on the execution of the at least part of the document comprises comparing the behavior observed by the execution of the document to behavior observed by execution of at least one of known attacking documents and known benign documents.

17 . The system of claim 14 , wherein at least part of the second detection model is created by:
executing at least one known malicious document in a first environment; executing the at least one known malicious document in a second environment; comparing the behavior observed by execution in the first environment to the behavior observed by execution in the second environment to determine any differences in behavior; and adding at least one difference in behavior to the second detection model, wherein the document is executed in at least one of the first environment and second environment.

18 . The system of claim 14 , wherein the processor is further configured to parse the document into sections and wherein the comparing the at least part of the document to

Assignees

• Univ Columbia

Inventors

• Stolfo Salvatore J
• Li Wei-Jen
• Keromytis Angelos D
• Androulaki Elli

Classifications

• G06F21/562

  Static detection · CPC title

• G06F21/50 Primary

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title