Systems and methods for dynamic cloud-based malware behavior analysis

Patent metadata

Field	Value
Publication number	US-9609015-B2
Application number	US-201514796422-A
Country	US
Kind code	B2
Filing date	Jul 10, 2015
Priority date	May 28, 2008
Publication date	Mar 28, 2017
Grant date	Mar 28, 2017

Abstract

A cloud-based method, a behavioral analysis system, and a cloud-based security system can include a plurality of nodes communicatively coupled to one or more users, wherein the plurality of nodes each perform inline monitoring for one of the one or more users for security comprising malware detection and preclusion; and a behavioral analysis system communicatively coupled to the plurality of nodes, wherein the behavioral analysis system performs offline analysis for any suspicious content from the one or more users which is flagged by the plurality of nodes; wherein the plurality of nodes each comprise a set of known malware signatures for the inline monitoring that is periodically updated by the behavioral analysis system based on the offline analysis for the suspicious content.

First claim

What is claimed is:

1. A zero day/zero hour malware detection method implemented by a processor in a behavior analysis system, the malware detection method comprising:
receiving unknown content at a server in the behavior analysis system from a distributed security system based on inline monitoring of a plurality of users with the distributed security system which is a cloud-based system;
performing malware detection through the server by:
securely storing the unknown content in a Secure Storage Engine (SSE);
performing a static analysis of the unknown content to determine properties of the unknown content using a set of tools based on a type of file of the unknown content and securely storing static results in the SSE, wherein the set of tools comprise checking third party services to match the unknown content to known viruses detected by various anti-virus engines, using a Perl Compatible Regular Expressions (PCRE) engine to check the unknown content for known signatures, identifying code signing certificates to form a whitelist of known benign content using Portable Executable (PE)/Common Object File Format (COFF) specifications, and evaluating destinations of any communications from the dynamic analysis;
sending the unknown content to a behavior analysis controller which is connected to a sandbox which performs a dynamic analysis based on scheduling by the behavior analysis controller, wherein the sandbox is a virtual machine where the unknown content is executed in a controller manner where the sandbox is controlled by the behavior analysis controller to perform the dynamic analysis;
receiving dynamic results from the dynamic analysis and storing the dynamic results in the SSE;
determining if the unknown content is malware based on a combination of the static results and the dynamic results; and

subsequent to the malware detection, updating the distributed security system with a malware signature of the unknown content if the unknown content is malware.

2. The malware detection method of claim 1 , wherein the sandbox utilizes an operating system based on a type of file of the unknown content.

3. The malware detection method of claim 1 , wherein the dynamic analysis determines file system changes and network activity caused by execution of the unknown content.

4. The malware detection method of claim 1 , wherein the distributed security system is configured to monitor traffic using Hypertext Transfer Protocol (HTTP) and non-HTTP protocols from the plurality of users, and wherein the distributed security system is external from the plurality of users.

5. The malware detection method of claim 1 , wherein the distributed security system is configured to update all nodes with the malware signature of the unknown content subsequent to the updating.

6. The malware detection method of claim 1 , wherein, subsequent to receiving the unknown content and prior to sending the unknown content to the sandbox, the method further comprising:
queuing the unknown content and scheduling the dynamic analysis based on priority of the unknown content with known viruses getting lower priority.

7. The malware detection method of claim 1 , wherein the SSE comprises an activity ledger recording events associated with the unknown content in the behavior analysis system, and wherein the activity ledger is utilized in the malware detection.

8. The malware detection method of claim 1 , wherein the behavior analysis controller performs the dynamic analysis through steps of
sending the unknown content to the sandbox based on a specific operating system type;
evaluating file system changes, network activity, and pertinent results to derive the dynamic results; and
cleaning up temporary files generated by the unknown content.

9. A zero day/zero hour malware detection system, comprising:
a network interface;
a processor communicatively coupled to the network interface; and
memory storing instructions that, when executed, cause the processor to
receive unknown content from a distributed security system via the network interface based on inline monitoring of a plurality of users with the distributed security system which is a cloud-based system;
perform malware detection on the unknown content through instructions that, when executed, cause the processor to:
securely store the unknown content in a Secure Storage Engine (SSE);
perform a static analysis of the unknown content to determine properties of the unknown content using a set of tools based on a type of file of the unknown content and securely store static results in the SSE, wherein the set of tools comprise checking third party services to match the unknown content to known viruses detected by various anti-virus engines, using a Perl Compatible Regular Expressions (PCRE) engine to check the unknown content for known signatures, identifying code signing certificates to form a whitelist of known benign content using Portable Executable (PE)/Common Object File Format (COFF) specifications, and evaluating destinations of any communications from the dynamic analysis;
send the unknown content to a behavior analysis controller which is connected to a which performs a dynamic analysis based on scheduling by the behavior analysis controller, wherein the sandbox is a virtual machine where the unknown content is executed in a controller manner where the sandbox is controlled by the behavior analysis controller to perform the dynamic analysis;
receive dynamic results from the dynamic analysis and store the dynamic results in the SSE;
determine if the unknown content is malware based on a combination of the static results and the dynamic results from the dynamic analysis and a static analysis; and

subsequent to the malware detection, update the distributed security system via the network interface with a malware signature of the unknown content if the unknown content is malware.

10. The malware detection system of claim 9 , wherein the sandbox utilizes an operating system based on a type of file of the unknown content.

11. The malware detection system of claim 9 , wherein the dynamic analysis determines file system changes and network activity caused by execution of the unknown content.

12. The malware detection system of claim 9 , wherein the distributed security system is configured to monitor traffic using Hypertext Transfer Protocol (HTTP) and non-HTTP protocols from the plurality of users, and wherein the distributed security system is external from the plurality of users.

13. The malware detection system of claim 9 , wherein the distributed security system is configured to update all nodes with the malware signature of the unknown content subsequent to the updating.

14. The malware detection system of claim 9 , wherein, subsequent to receipt of the unknown content and prior the unknown content being sent to the sandbox, the memory storing instructions that, when executed, further cause the processor to
queue the unknown content and scheduling the dynamic analysis based on priority of the unknown content with known viruses getting lower priority.

15. A distributed security system, comprising:
a plurality of nodes inline monitoring traffic associated with a plurality of users and which are geographical distributed to monitor the users independent of their location; and
a malware detection server comprising a network interface, a processor communicatively coupled to the network interface, and memory storing instructions that, when executed, causes the processor to
receive unknown content from a node of the plurality of nodes via the network interface based on the monitoring

Assignees

• Natarajan Sriram
• Paul Narinder
• Sobrier Julien
• Thamilarasu Karthikeyan
• Bayar Balakrishna
• Sutton Michael Andrew William
• Zscaler Inc

Inventors

• Natarajan Sriram
• Paul Narinder
• Sobrier Julien
• Thamilarasu Karthikeyan
• Bayar Balakrishna
• Sutton Michael Andrew William

Classifications

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/0218

  Distributed architectures, e.g. distributed firewalls · CPC title