Systems and methods for reevaluating apparently benign behavior on computing devices

Patent metadata

Field	Value
Publication number	US-8955138-B1
Application number	US-201313939600-A
Country	US
Kind code	B1
Filing date	Jul 11, 2013
Priority date	Jul 11, 2013
Publication date	Feb 10, 2015
Grant date	Feb 10, 2015

Abstract

A computer-implemented method for reevaluating apparently benign behavior on computing devices may include (1) receiving a plurality of reports from a plurality of computing systems that indicate that an attack that targeted each of the systems reached a specific stage on each system, (2) identifying behavioral data that includes, for each computing system within the plurality, a plurality of activities that the computing system observed before the attack reached the specific stage on the computing system, wherein the plurality of activities are of a type of activity that is relevant to detecting a prior stage of the attack, (3) analyzing the behavioral data to correlate the attack with at least one activity observed before the attack reached the specific stage, and (4) determining that the activity is suspect based at least in part on correlating the attack with the activity. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for reevaluating apparently benign behavior on computing devices, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
receiving a plurality of reports from a plurality of computing systems that indicate that an attack that targeted each of the plurality of computing systems reached a specific stage on each of the plurality of computing systems;
identifying behavioral data that comprises, for each computing system within the plurality of computing systems, a plurality of activities that the computing system observed before the attack reached the specific stage on the computing system, wherein the plurality of activities are of a type of activity that is relevant to detecting a prior stage of the attack that precedes the specific stage of the attack;
analyzing the behavioral data to correlate the attack with at least one activity observed before the attack reached the specific stage on at least one of the plurality of computing systems;
determining that the activity is suspect based at least in part on correlating the attack with the activity.

2. The computer-implemented method of claim 1 , wherein a security system on at least one targeted computing system within the plurality of computing systems observed the activity but failed to detect the attack at the prior stage and an additional security system on the targeted computing system detected the attack at the specific stage.

3. The computer-implemented method of claim 1 , wherein the plurality of activities comprises activities previously determined to be benign.

4. The computer-implemented method of claim 1 , wherein the specific stage of the attack comprises the attack causing network activity.

5. The computer-implemented method of claim 4 , wherein the prior stage of the attack comprises the attack injecting a known legitimate process with a malicious process.

6. The computer-implemented method of claim 4 , wherein the prior stage of the attack comprises the attack downloading a malicious file.

7. The computer-implemented method of claim 4 , wherein the prior stage of the attack comprises a browser exploit.

8. The computer-implemented method of claim 4 , wherein the prior stage of the attack comprises a client system accessing a malicious Internet resource.

9. The computer-implemented method of claim 1 , wherein the specific stage of the attack comprises the attack injecting a known legitimate process with a malicious process.

10. The computer-implemented method of claim 9 , wherein the prior stage of the attack comprises the attack downloading a malicious file that includes the malicious process.

11. The computer-implemented method of claim 1 , wherein the specific stage of the attack comprises the attack downloading a malicious file.

12. The computer-implemented method of claim 11 , wherein the prior stage of the attack comprises a browser exploit.

13. The computer-implemented method of claim 1 , wherein the specific stage of the attack comprises a browser exploit.

14. The computer-implemented method of claim 13 , wherein the prior stage of the attack comprises a client system accessing a malicious Internet resource.

15. The computer-implemented method of claim 1 , further comprising creating, based on the activity, a signature that is useable by a security system to detect the attack at the prior stage.

16. The computer-implemented method of claim 1 , further comprising sending information that can be used to recognize the prior stage of the attack to at least one of the plurality of computing systems.

17. The computer-implemented method of claim 1 , wherein analyzing the behavioral data further comprises filtering out known legitimate activity that is not connected to the attack from the plurality of activities.

18. The computer-implemented method of claim 1 , wherein identifying the plurality of activities comprises identifying, for each computing system within the plurality of computing systems, activities that occurred on the computing system within a predetermined time span before the attack was detected on the computing system.

19. A system for reevaluating apparently benign behavior on computing devices, the system comprising:
a receiving module that receives a plurality of reports from a plurality of computing systems that indicate that an attack that targeted each of the plurality of computing systems reached a specific stage on each of the plurality of computing systems;
an identification module that identifies behavioral data that comprises, for each computing system within the plurality of computing systems, a plurality of activities that the computing system observed before the attack reached the specific stage on the computing system, wherein the plurality of activities are of a type of activity that is relevant to detecting a prior stage of the attack that precedes the specific stage of the attack;
an analysis module that analyzes the behavioral data to correlate the attack with at least one activity observed before the attack reached the specific stage on at least one of the plurality of computing systems;
a determination module that determines that the activity is suspect based at least in part on correlating the attack with the activity;
at least one processor configured to execute the receiving module, the identification module, the analysis module, and the determination module.

20. A non-transitory computer-readable-storage medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
receive a plurality of reports from a plurality of computing systems that indicate that an attack that targeted each of the plurality of computing systems reached a specific stage on each of the plurality of computing systems;
identify behavioral data that comprises, for each computing system within the plurality of computing systems, a plurality of activities that the computing system observed before the attack reached the specific stage on the computing system, wherein the plurality of activities are of a type of activity that is relevant to detecting a prior stage of the attack that precedes the specific stage of the attack;
analyze the behavioral data to correlate the attack with at least one activity observed before the attack reached the specific stage on at least one of the plurality of computing systems;
determine that the activity is suspect based at least in part on correlating the attack with the activity.

Assignees

• Symantec Corp

Inventors

• Mahadik Atif
• Mehta Shreyans

Classifications

• G06F21/55 Primary

  Detecting local intrusion or implementing counter-measures · CPC title