Methods, media, and systems for detecting attack on a digital processing device

Patent metadata

Field	Value
Publication number	US-9576127-B2
Application number	US-201414336649-A
Country	US
Kind code	B2
Filing date	Jul 21, 2014
Priority date	Sep 18, 2006
Publication date	Feb 21, 2017
Grant date	Feb 21, 2017

Abstract

Methods, media, and systems for detecting attack are provided. In some embodiments, the methods include: comparing at least part of a document to a static detection model; determining whether attacking code is included in the document based on the comparison of the document to the static detection model; executing at least part of the document; determining whether attacking code is included in the document based on the execution of the at least part of the document; and if attacking code is determined to be included in the document based on at least one of the comparison of the document to the static detection model and the execution of the at least part of the document, reporting the presence of an attack. In some embodiments, the methods include: selecting a data segment in at least one portion of an electronic document; determining whether the arbitrarily selected data segment can be altered without causing the electronic document to result in an error when processed by a corresponding program; in response to determining that the arbitrarily selected data segment can be altered, arbitrarily altering the data segment in the at least one portion of the electronic document to produce an altered electronic document; and determining whether the corresponding program produces an error state when the altered electronic document is processed by the corresponding program.

First claim

What is claimed is:

1. A method for detecting an attack on an application, comprising:
performing, using a digital processing device, a static analysis by comparing at least part of a document to a first detection model;
determining, using the digital processing device, whether attacking code is included in the document based on the comparison of the document to the first detection model;
executing, using the digital processing device, at least part of the document;
determining, using the digital processing device, whether attacking code is included in the document based on the execution of the at least part of the document by performing a dynamic analysis that includes comparing behavior observed by execution of the document to a second detection model; and
if attacking code is determined to be included in the document based on at least one of the comparison of the document to the first detection model and the execution of the at least part of the document, reporting the presence of an attack.

2. The method of claim 1 , further comprising:
updating the first detection model if attacking code is determined to be present based on the execution of the at least part of the document.

3. The method of claim 1 , wherein the determining whether attacking code is included in the document based on the execution of the at least part of the document comprises:
comparing behavior observed by the execution of the document to behavior observed by execution of at least one of known attacking documents and known benign documents.

4. A method for detecting an attack on an application, comprising:
performing, using a digital processing device, a static analysis by comparing at least part of a document to a first detection model;
determining, using the digital processing device, whether attacking code is included in the document based on the comparison of the document to the first detection model;
executing, using the digital processing device, at least part of the document;
determining, using the digital processing device, whether attacking code is included in the document based on the execution of the at least part of the document by comparing behavior observed by execution of the document to a second detection model, wherein at least part of the second detection model is created by:
executing at least one known malicious document in a first environment;
executing the at least one known malicious document in a second environment;
comparing behavior observed by execution in the first environment to behavior observed by execution in the second environment to determine any differences in behavior; and
adding at least one difference in behavior to the second detection model, wherein the document is executed in at least one of the first environment and second environment; and

if attacking code is determined to be included in the document based on at least one of the comparison of the document to the first detection model and the execution of the at least part of the document, reporting the presence of an attack.

5. The method of claim 1 , further comprising:
parsing the document into sections and wherein the comparing the at least part of the document to the first detection model comprises:
selecting at least one the sections; and
comparing the at least one selected section to the first detection model.

6. The method of claim 1 , wherein the document is a word processing document, wherein the execution comprises opening the document in word processing software, wherein the document is embedded with at least one of an image, a table, and injected code, and wherein the document is executed in a protected environment.

7. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting an attack on an application, the method comprising:
performing a static analysis by comparing at least part of a document to a s first detection model;
determining whether attacking code is included in the document based on the comparison of the document to the first detection model;
executing at least part of the document;
determining whether attacking code is included in the document based on the execution of the at least part of the document by performing a dynamic analysis that includes comparing behavior observed by execution of the document to a second detection model; and
if attacking code is determined to be included in the document based on at least one of the comparison of the document to the first detection model and the execution of the at least part of the document, reporting the presence of an attack.

8. The computer-readable medium of claim 7 , the method further comprising:
updating the first detection model if attacking code is determined to be present based on the execution of the at least part of the document.

9. The computer-readable medium of claim 7 , wherein the determining whether attacking code is included in the document based on the execution of the at least part of the document comprises:
comparing behavior observed by the execution of the document to behavior observed by execution of at least one of known attacking documents and known benign documents.

10. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting an attack on an application, the method comprising:
performing a static analysis by comparing at least part of a document to a first detection model;
determining whether attacking code is included in the document based on the comparison of the document to the first detection model;
executing at least part of the document;
determining whether attacking code is included in the document based on the execution of the at least part of the document by comparing behavior observed by execution of the document to a second detection model, wherein at least part of the second detection model is created by:
executing at least one known malicious document in a first environment;
executing the at least one known malicious document in a second environment;
comparing behavior observed by execution in the first environment to behavior observed by execution in the second environment to determine any differences in behavior; and
adding at least one difference in behavior to the second detection model, wherein the document is executed in at least one of the first environment and second environment; and

if attacking code is determined to be included in the document based on at least one of the comparison of the document to the first detection model and the execution of the at least part of the document, reporting the presence of an attack.

11. The computer-readable medium of claim 7 , the method further comprising:
parsing the document into sections and wherein the comparing the at least part of the document to the first detection model comprises:
selecting at least one the sections; and
comparing the at least one selected section to the first detection model.

12. The computer-readable medium of claim 7 , wherein the document is a word processing document, wherein the execution comprises opening the document in word processing software, wherein the document is embedded with at least one of an image, a table, and injected code, and wherein the document is executed in a protected environment.

13. A system for detecting attack, comprising:
an interface in communication with a network;
a memory; and
a processor in communication with the memory and the interface, wherein the processor:
performs a static an

Assignees

• Univ Columbia

Inventors

• Stolfo Salvatore J
• Li Wei-Jen
• Keromytis Angelos D
• Androulaki Elli

Classifications

• G06F21/562

  Static detection · CPC title

• G06F21/56 Primary

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F21/50 Primary

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title