Systems and methods for identifying malware

Patent metadata

Field	Value
Publication number	US-9519780-B1
Application number	US-201414570393-A
Country	US
Kind code	B1
Filing date	Dec 15, 2014
Priority date	Dec 15, 2014
Publication date	Dec 13, 2016
Grant date	Dec 13, 2016

Abstract

A computer-implemented method for identifying malware may include (1) determining, for multiple commands within bytecode associated with a malware program, whether each command constitutes an invocation command, (2) filtering, based on the determination, invocation commands from the bytecode, (3) adding, for each invocation command filtered from the bytecode, an opcode, a format code, and a function prototype to a collection of opcodes, format codes, and function prototypes, (4) generating a digital fingerprint of the collection including the opcode, the format code, and the function prototype for each invocation command filtered from the bytecode, and (5) performing, by a computer security system, a remedial action to protect a user in response to detecting the presence of a variant of the malware program by determining that the digital fingerprint matches a candidate instance of bytecode under evaluation. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for identifying malware, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
determining, for multiple commands within bytecode associated with a malware program, whether each command constitutes an invocation command;
filtering, based on the determination, invocation commands from the bytecode;
adding, for each invocation command filtered from the bytecode, a concatenation comprising an opcode, a format code, and a function prototype to a collection of concatenations comprising opcodes, format codes, and function prototypes;
generating at least two digital fingerprints based on the collection of the concatenations comprising the opcode, the format code, and the function prototype for each invocation command filtered from the bytecode, the at least two digital fingerprints comprising at least two of:
a digital fingerprint of the collection after executing an ordering algorithm on the collection;
a digital fingerprint of the collection without executing the ordering algorithm;
a digital fingerprint of a prefix of the collection; and
a digital fingerprint of a suffix of the collection; and

performing, by a computer security system, a remedial action to protect a user in response to detecting the presence of a variant of the malware program by determining that a candidate instance of bytecode under evaluation matches at least one of the at least two generated digital fingerprints.

2. The method of claim 1 , wherein filtering, based on the determination, invocation commands from the bytecode comprises excluding, through the filtering, at least one non-invocation command based on a determination that the non-invocation command does not constitute an invocation command.

3. The method of claim 2 , wherein filtering, based on the determination, invocation commands from the bytecode comprises excluding, through the filtering, a plurality of non-invocation commands based on a determination that each non-invocation command in the plurality does not constitute an invocation command.

4. The method of claim 3 , wherein filtering, based on the determination, invocation commands from the bytecode comprises excluding, through the filtering, each non-invocation command in the bytecode associated with the malware program based on a determination that each non-invocation command in the bytecode does not constitute an invocation command.

5. The method of claim 1 , wherein the opcode identifies a type of the invocation command.

6. The method of claim 1 , wherein the function prototype identifies at least one of:
a number and type of parameters passed to a function through the invocation command; and
a number and type of return values returned by the function after invoking its execution through the invocation command.

7. The method of claim 1 , wherein the format code specifies information that describes the format of the invocation command.

8. The method of claim 7 , wherein the format code specifies:
an argument word count for the invocation command; and
information describing registers used by the invocation command.

9. The method of claim 1 , further comprising:
adding a function prototype for the bytecode associated with the malware program to the collection prior to generating the at least two digital fingerprints,
wherein generating the at least two digital fingerprints is performed based on the collection that includes the added function prototype for the bytecode in addition to the opcode, the format code, and the function prototype for each invocation command within the bytecode.

10. The method of claim 1 , wherein the at least two digital fingerprints include the digital fingerprint of the collection after executing the ordering algorithm on the collection.

11. The method of claim 1 , wherein the at least two digital fingerprints include the digital fingerprint of the suffix of the collection.

12. The method of claim 11 , wherein the at least two digital fingerprints include the digital fingerprint of the prefix of the collection.

13. The method of claim 11 , wherein the bytecode comprises SMALI code.

14. The method of claim 1 , wherein at least one of the digital fingerprints comprises a cryptographic hash of the collection comprising the opcode, the format code, and the function prototype for each invocation command filtered from the bytecode.

15. A system for identifying malware, the system comprising:
a determination module, stored in memory, that determines, for multiple commands within bytecode associated with a malware program, whether each command constitutes an invocation command;
a filtration module, stored in memory, that filters, based on the determination, invocation commands from the bytecode;
an addition module, stored in memory, that adds, for each invocation command filtered from the bytecode, a concatenation comprising an opcode, a format code, and a function prototype to a collection of concatenations comprising opcodes, format codes, and function prototypes;
a generation module, stored in memory, that generates at least two digital fingerprints based on the collection of the concatenations comprising the opcode, the format code, and the function prototype for each invocation command filtered from the bytecode, the at least two digital fingerprints comprising at least two of:
a digital fingerprint of the collection after executing an ordering algorithm on the collection;
a digital fingerprint of the collection without executing the ordering algorithm;
a digital fingerprint of a prefix of the collection; and
a digital fingerprint of a suffix of the collection;

a performance module, stored in memory, that performs a remedial action to protect a user in response to detecting the presence of a variant of the malware program by determining that a candidate instance of bytecode under evaluation matches at least one of the at least two generated digital fingerprints; and
at least one physical processor configured to execute the determination module, the filtration module, the addition module, the generation module, and the performance module.

16. The system of claim 15 , wherein the filtration module filters, based on the determination, invocation commands from the bytecode at least in part by excluding, through the filtering, at least one non-invocation command based on a determination that the non-invocation command does not constitute an invocation command.

17. The system of claim 16 , wherein the filtration module filters, based on the determination, invocation commands from the bytecode at least in part by excluding, through the filtering, a plurality of non-invocation commands based on a determination that each non-invocation command in the plurality does not constitute an invocation command.

18. The system of claim 17 , wherein the filtration module filters, based on the determination, invocation commands from the bytecode at least in part by excluding, through the filtering, each non-invocation command in the bytecode associated with the malware program based on a determination that each non-invocation command in the bytecode does not constitute an invocation command.

19. The system of claim 15 , wherein the opcode identifies a type of the invocation command.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device t

Assignees

• Symantec Corp

Inventors

• Dong Jiang

Classifications

• G06F21/564 Primary

  by virus signature recognition · CPC title

• G06F2221/033

  Test or assess software · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title