System and method for below-operating system regulation and control of self-modifying code

Patent metadata

Field	Value
Publication number	US-9392016-B2
Application number	US-201414328105-A
Country	US
Kind code	B2
Filing date	Jul 10, 2014
Priority date	Mar 29, 2011
Publication date	Jul 12, 2016
Grant date	Jul 12, 2016

Abstract

A system for securing an electronic device may include a memory, a processor; one or more operating systems residing in the memory for execution by the processor; and a security agent configured to execute on the electronic device at a level below all of the operating systems of the electronic device accessing the memory. The security agent may be further configured to: (i) trap attempted accesses to the memory, wherein each of such attempted accesses may, individually or in the aggregate, indicate the presence of self-modifying malware; (ii) in response to trapping each attempted access to the memory, record information associated with the attempted access in a history; and (iii) in response to a triggering attempted access associated with a particular memory location, analyze information in the history associated with the particular memory location to determine if suspicious behavior has occurred with respect to the particular memory location.

First claim

What is claimed is:

1. An article of manufacture, comprising:
a non-transitory computer readable medium;
computer-executable instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
trap, at a higher priority than all operating systems of the electronic device, an attempted access to a particular memory location in memory of the electronic device, the attempted access indicating a presence of self-modifying malware, the electronic device including one or more operating systems;
record information associated with the attempted access in a history in response to trapping the attempted access to memory;

analyze information in the history associated with the particular memory location to determine suspicious behavior with respect to the particular memory location, wherein analyzing information includes:
identifying suspicious behavior based on information in the history indicating that content at a first memory location was copied to a second location, modified at the second location, and subsequently executed at the second location;
identifying suspicious behavior based on whether information in the history indicates attempted execution of content at a third memory location and a fourth memory location, wherein each of the third and fourth memory locations have a common ancestor at a fifth location; and
identifying suspicious behavior based on whether information in the history indicates content at the particular memory location has ancestors at a plurality of other memory locations;

initiate corrective action in response to determining suspicious behavior respect to the particular memory location;
determine whether the particular memory location has been affected by malware; and
initiate further corrective action in response to determining that the particular memory location has been affected by malware, comprising at least one of:
disallowing execution of content associated with the particular memory location, reversing changes to the content in the history, repairing the content, replacing the content with harmless content, and disabling a process associated with the content.

2. The article of claim 1 , further comprising instructions to initiate corrective action by communicating forensic evidence to a protection server.

3. The article of claim 1 , further comprising instructions to initiate corrective action by comparing content of the particular memory location with known processes to determine whether the particular memory location has been affected by malware.

4. The article of claim 1 , further comprising instructions to, in response to another attempted access of the particular memory location, initiate recording information associated with attempted accesses to the particular memory location in the history.

5. The article of claim 1 , further comprising instructions to identify suspicious behavior based on whether a subsequent attempted access is made of the particular memory location, the subsequent attempted access including an attempt to change permissions associated with the particular memory location.

6. The article of claim 1 , further comprising instructions to:
perform the trapping, recording, and analyzing by a below-operating system security agent;
access the below-operating system security agent with the processor; and
execute additional programs in the memory with the processor.

7. A system for securing an electronic device, comprising:
a memory;
a processor;
one or more operating systems residing in the memory for execution by the processor;
a security agent configured to:
execute on the electronic device at higher priority than all operating systems of the electronic device;
trap an attempted access of a particular memory location in the memory based upon an indication that the attempted access is associated with self-modifying malware;
record information associated with the attempted access in a history;
determine whether suspicious behavior is related to the particular memory location based on information in the history indicating that content was copied between memory locations, that the content was subsequently modified, and that the processor subsequently attempted to execute the content;
determine whether suspicious behavior is related to the particular memory location based on information in the history indicating attempted execution of a plurality of memory locations that each have a common memory location ancestor;
determine whether suspicious behavior is related to the particular memory location based on information in the history indicating content at the particular memory location has ancestors at a plurality of other memory locations;
initiate corrective action in response to determining suspicious behavior related to the particular memory location;
determine whether the particular memory location has been affected by malware; and
initiate further corrective action in response to determining that the particular memory location has been affected by malware, including at least one of:
disallowing execution of content associated with the particular memory location, reversing changes to the content described in the history, repairing the content, replacing the content with harmless content, and disabling a process associated with the content.

8. The system of claim 7 , wherein the security agent is further configured to initiate corrective action by communicating forensic evidence of the suspicious behavior to a protection server communicatively coupled to the processor.

9. The system of claim 7 , wherein the security agent is further configured to initiate corrective action by comparing content of the particular memory location with known processes executing in the processor to determine whether the particular memory location has been affected by malware.

10. The system of claim 7 , wherein the security agent is further configured to:
determine another attempted access of the particular memory location; and
based on a determination of the other attempted access of the particular memory location, initiate recording information associated with attempted accesses to the particular memory location in the history.

11. The system of claim 7 , wherein the security agent is further configured to:
determine a subsequent attempted access of the particular memory location; and
determine whether the subsequent attempted access of the particular memory location includes an attempted access to change permissions associated with the particular memory location; and

determine whether suspicious behavior is related to the particular memory location based on the attempted access to change permissions.

12. The system of claim 7 , wherein:
the security agent includes a below-operating system security agent; and
the processor is configured to execute additional programs at the same priority as the operating systems.

13. An article of manufacture, comprising:
a non-transitory computer readable medium;
computer-executable instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to, at a higher priority than all operating systems of an electronic device:
identify that an attempted access of a particular memory location in memory indicates self-modifying malware;

trap the attempted access;
record information about the attempted access in a history;
determine possible suspicious behavior related to the particular memory location based on infor

Assignees

• Mcafee Inc

Inventors

• Sallam Ahmed Said

Classifications

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F21/52 Primary

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F21/554

  involving event detection and direct action · CPC title