Discovering malicious input files and performing automatic and distributed remediation

Patent metadata

Field	Value
Publication number	US-9436826-B2
Application number	US-201113161950-A
Country	US
Kind code	B2
Filing date	Jun 16, 2011
Priority date	May 16, 2011
Publication date	Sep 6, 2016
Grant date	Sep 6, 2016

Abstract

The subject disclosure is directed towards detecting malware or possible malware in an input file by allowing the input file to be opened, and by monitoring for one or more behaviors corresponding to the open file that likely indicate malware. Only certain executable files and/or file types opened thereby may be monitored, with various collected event data used for antimalware purposes when improper behavior is observed. Example behaviors include writing of a file to storage, generation of network traffic, injection of a process, running of script, and/or writing system registry data. Telemetry data and/or a sample of the file may be sent to an antimalware service, and malware remediation may be performed. Data (e.g., the collected events) may be distributed to other nodes for use in antimalware detection, e.g., to block execution of a similar file.

First claim

What is claimed is:

1. In a computing environment, a method performed at least in part on at least one processor, comprising:
intercepting, by a real time protection component, a file open event by a program corresponding to an input file;
allowing the input file to be opened by the program during normal user operation;
responsive to the input file being opened normally by the program, initiating monitoring of the program for one or more behaviors that indicate possible malware;
recording events initiated by the program corresponding to the input file and a source associated with the input file;
responsive to the program closing the input file, scanning the input file to generate scan results and terminating the monitoring of the program; and
analyzing the recorded events, the source associated with the input file, and the scan results to determine a potential source of an infection, including by identifying the one or more behaviors of the program that indicate possible malware using the analysis.

2. The method of claim 1 wherein said monitoring for the one or more behaviors comprises watching for writing of a file to storage by the program that opened the input file or a process related to the program that opened the input file.

3. The method of claim 1 wherein said monitoring for the one or more behaviors comprises watching for generation of network traffic by the program that opened the input file or a process related to the program that opened the input file.

4. The method of claim 1 wherein said monitoring for the one or more behaviors comprises watching for injection of at least one process by the program that opened the input file or a process related to the program that opened the input file.

5. The method of claim 1 wherein said monitoring for the one or more behaviors comprises watching for running of one or more scripts by the program that opened the input file or a process related to the program that opened the input file.

6. The method of claim 1 wherein said monitoring for the one or more behaviors comprises watching for writing of data to a system registry by the program that opened the input file or a process related to the program that opened the input file.

7. The method of claim 1 further comprising:
distributing information regarding malware corresponding to the input file to at least one other machine comprising a node in a distributed or virtualized computing environment.

8. The method of claim 1 further comprising:
taking action to remediate malware corresponding to the input file.

9. The method of claim 1 further comprising:
taking action to remediate malware corresponding to the input file, including quarantining the input file.

10. The method of claim 1 wherein said monitoring for the one or more behaviors comprises watching for writing of a dropped file to storage by the program that opened the input file or a process related to the program that opened the input file, and further comprising:
taking action to remediate malware corresponding to the input file, including quarantining the dropped file.

11. The method of claim 1 further comprising:
reporting telemetry data based upon malware corresponding to the input file to an antimalware service.

12. The method of claim 1 further comprising:
sending a sample comprising at least part of the input file to an antimalware service.

13. In a computing environment, a system comprising:
a malware protection engine configured to:
collect information corresponding to program behaviors and input files; and
take action directed towards at least one of reporting data corresponding to the collected information or performing remediation with respect to the information; and

a real time protection component communicatively coupled to the malware protection engine and configured to:
intercept a file open event by a program requesting to open an input file;
allow the program to open the input file normally;
responsive to the input file being opened normally by the program, initiate monitoring operations of the program for one or more behaviors indicative of potential malware;
record events initiated by the program that correspond to the input file and a source associated with the input file;
notify the malware protection engine at least based on at least one of detection of the input file opened by the program having a file type associated with malware exploit behavior or detection of the one or more behaviors indicative of the potential malware during the operations by the program; and
responsive to the program closing the input file, terminating the monitoring of the program.

14. The system of claim 13 wherein at least part of the information corresponding to the program behaviors and the input files is distributed to one or more nodes in a distributed or virtualized computing environment.

15. The system of claim 13 wherein the real time protection component is configured to evaluate the program that is opening the file type associated with malware exploit behavior against a predetermined list to determine whether the file type is associated with malware exploit behavior.

16. The system of claim 13 wherein the behavior indicative of potential malware comprises a particular event, a pattern of events, or a deviation from predetermined proper behavior, or any combination of particular event, a pattern of events, or a deviation from predetermined proper behavior.

17. The system of claim 13 further comprising:
an antimalware service, the malware protection engine reporting the collected information to the antimalware service, including sending telemetry data to the antimalware service, or sending at least part of a file to the antimalware service, or both.

18. One or more computer storage devices having computer-executable instructions, which on execution by a computer cause the computer to perform operations, comprising:
intercepting a file open event by a program corresponding to an input file;
allowing the program to open the input file;
responsive to the input file being opened by the program, initiating monitoring of the program during normal user operation for one or more behaviors indicative of possible malware during the processing of the input file by the program;
recording information corresponding to events initiated by the program with respect to the input file and a source of the input file;
detecting a behavior of the program indicative of possible malware;
analyzing the recorded information and the source of the input file to determine a potential source of an infection; and
responsive to the program closing the input file, terminating the monitoring of the program.

19. The one or more computer storage devices of claim 18 wherein analyzing at least some of the events comprises reporting telemetry data, or distributing data including at least some of the events to at least one other node for use in antimalware detection, or both.

20. The one or more computer storage devices of claim 18 wherein analyzing at least some of the events comprises distributing data including at least some of the events to at least one other node for use in antimalware detection, and having further computer-executable instructions comprising:
quarantining the input file based upon the data.

Assignees

• Kapoor Vishal
• Keller Jonathan Mark
• Kumar Ajith
• Marinescu Adrian M
• Seinfeld Marc E
• Thomas Anil Francis
• Jarrett Michael Sean
• Johnson Joseph J
• Faulhaber Joseph L
• Microsoft Technology Licensing Llc

Inventors

• Kapoor Vishal
• Keller Jonathan Mark
• Kumar Ajith
• Marinescu Adrian M
• Seinfeld Marc E
• Thomas Anil Francis
• Jarrett Michael Sean
• Johnson Joseph J
• Faulhaber Joseph L

Classifications

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title