Method and system for automatic detection and analysis of malware

Patent metadata

Field	Value
Publication number	US-9245114-B2
Application number	US-201113219208-A
Country	US
Kind code	B2
Filing date	Aug 26, 2011
Priority date	Aug 26, 2010
Publication date	Jan 26, 2016
Grant date	Jan 26, 2016

Abstract

A method of detecting malicious software (malware) includes receiving a file and storing a memory baseline for a system. The method also includes copying the file to the system, executing the file on the system, terminating operation of the system, and storing a post-execution memory map. The method further includes analyzing the memory baseline and the post-execution memory map and determining that the file includes malware.

First claim

What is claimed is:

1. A method of detecting malicious software, the method comprising:
storing, by an analysis system, a memory baseline for a first system, the memory baseline including information stored in volatile memory of the first system and non-volatile memory of the first system;
providing, by the analysis system, a file to the first system;
executing, by the analysis system, the file on the first system using an operating system of the first system after the storing the memory baseline;
terminating, by the analysis system, operation of the operating system of the first system after executing the file;
storing, by the analysis system, a post-execution memory map of the first system while operation of the operating system of the first system is terminated, the post-execution memory map including information stored in the volatile memory of the first system and the non-volatile memory of the first system after the executing the file;
analyzing, by the analysis system, the memory baseline and the post-execution memory map, wherein analyzing comprises:
determining the presence of one or more processes that changed from the memory baseline to the post-execution memory map,
determining timestamps associated with the one or more processes, and
identifying behaviors that indicate attempts to conceal a rootkit during the operation of the operating system;

determining that the file comprises malicious software based on the analyzing;
determining a timeline of activities performed by the malicious software based on the timestamps; and
providing a report of the malicious software including a list of the one or more processes that changed and the timeline.

2. The method of claim 1 , further comprising receiving the file through a webpage.

3. The method of claim 1 , further comprising receiving one or more preferences related to the file.

4. The method of claim 3 , wherein the receiving the one or more preferences comprises receiving at least one of a time to run, a reboot indicator, an operating system, or a privilege level.

5. The method of claim 1 , wherein the memory baseline is used for multiple analysis processes.

6. The method of claim 1 , further comprising executing another file after executing the file on the first system.

7. The method of claim 1 , wherein determining the presence of one or more processes that changed comprises determining that the file added a new process.

8. The method of claim 1 , wherein determining the presence of one or more processes that changed comprises determining that the file deleted a process.

9. The method of claim 1 further comprising generating the report.

10. The method of claim 1 , wherein the file includes a signature associated with malicious operation.

11. The method of claim 1 further comprising associating with the file, in a tree structure, files caused to be loaded to the system by executing the file.

12. The method of claim 1 , wherein the behaviors that indicate attempts to conceal the rootkit comprise:
attempts to hide kernel drivers;
attempts to inject code or unlink dynamic link libraries (DLLs);
attempts to hide network sockets and connections;
attempts to hide suspicious data in process memory;
attempts to install hook in user or kernel mode memory;
attempts to modify the Interrupt Descriptor Table (IDT), System Service Dispatch Table (SSDT), and driver I/O request packet (IRP) entries;
attempts to hide threads;
attempts to register malicious notification routines; and
attempts to install promiscuous mode packet sniffers.

13. A system of detecting malicious software, the system comprising:
one or more computer systems; and
a storage device, wherein the storage device contains instructions that when executed by the one or more computer systems perform a method comprising:
storing, by an analysis system, a memory baseline for an execution system, the memory baseline including information stored in volatile memory of the execution system and non-volatile memory of the execution system;
executing, after the storing the memory baseline, a file on the execution system using an operating system of the execution system;
terminating operation of the operating system of the execution system after executing the file on the execution system;
storing, by the analysis system, a post-execution memory map of the execution system while the operation of the operating system of the execution system is terminated, the post-execution memory map including information stored in the volatile memory of the execution system and the non-volatile memory of the execution system after the executing the file;
analyzing, by the analysis system, the memory baseline and the post-execution memory map, wherein analyzing comprises:
determining the presence of one or more processes that changed from the memory baseline to the post-execution memory map,
determining timestamps associated with the one or more processes, and
identifying behaviors that indicate attempts to conceal a rootkit during the operation of the operating system;

determining that the file comprises malicious software based on the analyzing;
determining a timeline of activities performed by the malicious software based on the timestamps; and
providing a report of the malicious software including a list of the one or more processes that changed and the timeline.

14. The system of claim 13 wherein the method further comprises receiving the file through a webpage.

15. The system of claim 13 wherein the method further comprises receiving one or more preferences related to the file, wherein the one or more preferences include at least one of: a time to run, a reboot indicator, an operating system, or a privilege level.

16. The system of claim 13 wherein the memory baseline is used for multiple analysis processes.

17. The system of claim 13 wherein the execution system comprises at least one of a virtual system or a physical system.

18. The system of claim 13 wherein the method further comprises executing another file after executing the file on the execution system.

19. The system of claim 13 wherein determining the presence of one or more processes that changed comprises determining that the file added a new process.

20. The system of claim 13 wherein determining the presence of one or more processes that changed comprises determining that the file deleted a process.

21. The system of claim 13 wherein the method further comprises generating the report.

22. The system of claim 13 wherein terminating operation of the execution system comprises powering down the execution system.

23. The system of claim 13 wherein the file includes a signature associated with malicious operation.

24. The system of claim 13 wherein the method further comprises associating with the file, in a tree structure, files caused to be loaded to the execution system by executing the file.

25. A method of detecting malicious software, the method comprising:
storing, by a second system, a memory baseline for a first system, the memory baseline including information stored in volatile memory of the first system and non-volatile memory of the first system;
executing, after the storing the memory baseline, a file on the first system using an operating system of the first system;
storing, by the analysis system, a post-execution memory map of the first system, the post-execution memory map including informa

Assignees

• Thomas Ralph
• Ligh Michael
• Verisign Inc

Inventors

• Thomas Ralph
• Ligh Michael

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F21/55 Primary

  Detecting local intrusion or implementing counter-measures · CPC title

• G06F2221/2115

  Third party · CPC title

• G06F2221/2119

  Authenticating web pages, e.g. with suspicious links · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title