Detecting malicious use of computer resources by tasks running on a computer system

Patent metadata

Field	Value
Publication number	US-9251345-B2
Application number	US-201414547359-A
Country	US
Kind code	B2
Filing date	Nov 19, 2014
Priority date	Oct 29, 2008
Publication date	Feb 2, 2016
Grant date	Feb 2, 2016

Abstract

A method, apparatus, and computer program product for identifying malware is disclosed. The method identifies processes in a running process list on a host computer system. The method identifies ports assigned to the processes in the running process list on the host computer system. The method determines whether any one of ports that is currently in use in the host computer system is not assigned to any of the processes in the running process list. The method then makes a record that a hidden, running process is present as a characteristic of an attack in response to a determination that one of the ports is currently in use but is not assigned to any of the processes in the running process list in the host computer system.

First claim

What is claimed is:

1. A method for identifying malware, the method comprising:
identifying, by a host computer system, processes in a running process list on the host computer system and ports currently in use in the host computer system to form a first configuration;
identifying, by a remote computer system, processes in the running process list on the host computer system and ports currently in use in the host computer system to form a second configuration;
determining, by a management computer system, whether a discrepancy exists between the first configuration and the second configuration; and
responsive to a determination that the discrepancy exists between the first configuration and the second configuration, making a record, by the management computer system, that a hidden, running process is present as a characteristic of an attack in the host computer system.

2. The method of claim 1 , further comprising:
responsive to an absence of the determination that the discrepancy exists between the first configuration and the second configuration, making a record, by the management computer system, that the attack is absent in the host computer system.

3. The method of claim 1 , wherein identifying, by the host computer system, ports currently in use in the host computer system comprises:
identifying, by the host computer system, a group of open ports on the host computer system, wherein the group of open ports includes the ports assigned to the processes in the running process list and the ports currently in use but not assigned to any of the processes in the running process list in the host computer system.

4. The method of claim 3 , wherein the one of the ports currently in use but not assigned to any of the processes in the running process list in the host computer system use is a first use of the port by a group of tasks running in the host computer system and further comprising:
retrieving, by the management computer system a first configuration for the host computer system;
identifying, by the management computer system, a second use of a corresponding port by a corresponding group of tasks running on a set of host computer systems having a second configuration that matches the first configuration for the host computer system, wherein the corresponding port corresponds to the port and the corresponding group of tasks running on the set of host computer systems correspond to the group of tasks running in the host computer system;
determining, by the management computer system, whether a difference in port use is present between the first use of the port and the second use of the corresponding port in the set of host computer systems;
responsive to a determination that the difference in port use is present, determining, by the management computer system, whether the difference in port use by the group of tasks in the host computer system is new based on a history of prior uses for the corresponding port in the set of host computer systems; and
responsive to a determination that the difference in port use is not new, identifying, by the management computer system, that the attack is not present in the host computer system.

5. The method of claim 4 , further comprising:
responsive to the determination that the difference in port use is new, identifying, by the management computer system, a time when the first use occurred and a set of changes having a scheduled time for each change, wherein the set of changes are for the group of tasks and for the a set of networking resources for the port;
determining, by the management computer system, whether the time when the first use occurred corresponds to the scheduled time for at least one of the changes in the set of changes; and
responsive to a determination that the time when the first use occurred corresponds to the scheduled time for at least one of the changes in the set of changes, identifying, by the management computer system, that the attack is not present in the host computer system.

6. The method of claim 4 , further comprising:
responsive to the determination that the difference in port use is new, sending, by the management computer system, a request to a user of the host computer system to indicate whether the difference in port use is the attack.

7. The method of claim 6 , wherein the request to the user of the host computer system to indicate whether the difference in port use is the attack includes an additional random question, wherein an incorrect answer to the additional random question indicates that the difference in port use is the attack.

8. The method of claim 4 , further comprising:
retrieving, by the management computer system, performance information about the first use of the port by the group of tasks running in the host computer system by a first monitoring program configured to monitor port use by the group of tasks running in the host computer system;
retrieving, by the management computer system, performance information generated by a second monitoring program in the remote computer system configured to monitor the first use of the port by the group of tasks running in the host computer system;
comparing, by the management computer system, the performance information generated by the first monitoring program to the performance information generated by the second monitoring program to identify a set of differences between the performance information generated by the first monitoring program and the second monitoring program; and
responsive to the set of differences being present between the performance information generated by the first monitoring program and the second monitoring program, identifying, by the management computer system, that the attack is present in the host computer system.

9. In combination:
a host computer system comprising a host processor unit, a host computer-readable memory, and host program code, wherein the host program code is operable for execution by the host processor unit in the host computer-readable memory to identify processes in a running process list on the host computer system and identify ports currently in use in the host computer system to form a first configuration;
a remote computer system comprising a remote processor unit, a remote computer-readable memory, and remote program code that is operable for execution by the remote processor unit in the remote computer-readable memory to identify, by the remote computer system, processes in the running process list on the host computer system and ports currently in use in the host computer system to form a second configuration;
a management computer system comprising a management processor unit, a management computer-readable memory, and management program code that is operable for execution by the management processor unit in the management computer-readable memory to determine whether a discrepancy exists between the first configuration and the second configuration, and responsive to a determination that the discrepancy exists between the first configuration and the second configuration, making a record, by the management computer system, that a hidden, running process is present as a characteristic of an attack in the host computer system.

10. The computer of claim 9 , wherein the management program code is further configured to be run by the management processor unit to make a record that the attack is absent in the host computer system, responsive to an absence of the determination that the discrepancy exists between the first configuration and the second configuration.

11. The computer of claim 9 , wherein identifying ports currently in use in the host computer system comprises identifying a group of open p

Assignees

• IBM

Inventors

• Freeman Robert G
• Ollmann Gunter D

Classifications

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F2221/2101

  Auditing as a secondary aspect · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F9/44505

  Configuring for program initiating, e.g. using registry, configuration files · CPC title