Advanced persistent threat (APT) detection center

Patent metadata

Field	Value
Publication number	US-9628507-B2
Application number	US-201314042483-A
Country	US
Kind code	B2
Filing date	Sep 30, 2013
Priority date	Sep 30, 2013
Publication date	Apr 18, 2017
Grant date	Apr 18, 2017

Abstract

A computerized method is described in which one or more received objects are analyzed by an advanced persistent threat (APT) detection center to determine if the objects are APTs. The analysis may include the extraction of features describing and characterizing features of the received objects. The extracted features may be compared with features of known APT malware objects and known non-APT malware objects to determine a classification or probability of the received objects being APT malware. Upon determination that the received objects are APT malware, warning messages may be transmitted to a user of associated client devices. Classified objects may also be used to generate analytic data for the prediction and prevention of future APT attacks.

First claim

What is claimed is:

1. A computerized method for discovering and identifying an advanced persistent threat (APT) object corresponding to an object that includes an APT being a type of malware that is directed at a particular target and seeks to surveil, extract or manipulate data to which the particular target would have access, comprising:
receiving an object to be classified by one or more virtual machines of an APT detection center, the APT detection center includes a server and the one or more virtual machines communicatively coupled to the server and configured for processing of the received object;
extracting features of the received object during processing of the received object by the one or more virtual machines, a first extracted feature of the extracted features includes information associated with an action performed during processing of the received object within the one or more virtual machines;
conducting, by the server, a first analysis by comparing the extracted features with features of known APT objects stored in an APT database accessible to the server;
responsive to determining that the extracted features satisfy a prescribed level of correlation with one or more features of known APT objects in the APT database, identifying the received object as an APT object in the APT database; and
responsive to determining that the extracted features fail to satisfy the prescribed level of correlation with the one or more features of the known APT objects in the APT database, conducting a second analysis by the server subsequent to the first analysis, the second analysis includes a comparison of features associated with known non-APT malware to determine whether the received object is known non-APT type malware, the second analysis being different from the first analysis.

2. The computerized method of claim 1 , wherein the conducting of the first analysis comprises correlating the extracted features of the received object with the features of known APT objects and the conducting of the second analysis comprises correlating the extracted features of the received object with features of known malware that differs from the known APT objects.

3. The computerized method of claim 1 , wherein the extracted features of the received object satisfy a prescribed level of correlation when a predefined number of the extracted features match features of one or more known APT objects in the APT database.

4. The computerized method of claim 1 , wherein the received object is a file suspected to contain malware code.

5. The computerized method of claim 4 , wherein the extracted features are extracted before and after the malware code has been activated.

6. The computerized method of claim 1 , wherein the received object includes a dropped object, the dropped object being (i) generated during processing of an object within the one or more virtual machines and (ii) returned to the one or more virtual machines for processing and extracting of the features of the dropped object.

7. The computerized method of claim 1 , further comprising:
normalizing the extracted features of the received object such that each value in the extracted features is converted to a discrete or continuous value.

8. The computerized method of claim 1 , further comprising:
transmitting a warning to a user of a client device that the received object is an APT object in response to determining that the extracted features of the received object satisfy a prescribed level of correlation, wherein the received object is received from a client device operated by the user.

9. The computerized method of claim 8 , wherein the received object is received through an interface displayed on the client device and the warning is presented to the user through the interface.

10. The computerized method of claim 1 , wherein the extracted features include data describing the behavior and characteristics of the received object that is received from a source external to the server.

11. The computerized method of claim 1 , wherein the comparing of the extracted features with the features of the known APT objects in the APT database utilizes statistical and machine learning techniques to determine whether the extracted features of the received object satisfy the prescribed level of correlation to one or more of the known APT objects in the APT database.

12. The computerized method of claim 1 , further comprising:
analyzing the APT database to, based on stored APT objects, determine the severity of the APT object.

13. The computerized method of claim 12 , further comprising
analyzing stored APT objects within the APT database to rank the APT objects according to severity, the ranking of the severity of a first APT object of the stored APT objects is based on one or more of the size of a target and damage caused by the first APT object.

14. The computerized method of claim 13 , furthering comprising:
comparing extracted features of the first APT object with extracted features of a second APT object; and
assigning the severity of the first object to the second object upon determining that the first APT object shares one or more features with the second APT object.

15. The computerized method of claim 12 , wherein the analysis of the APT database comprises:
determining trends for APT attacks based on stored APT objects in the APT database; and
signaling a user of a possible future attack based on the determined trends.

16. The computerized method of claim 15 , wherein the trends are determined relative to one or more of a time period and a target type.

17. The computerized method of claim 1 , further comprising analyzing stored APT objects within the APT database and generating an attacker profile by
comparing extracted features of a first APT object stored in the APT database to extracted features of a second APT object stored in the APT database; and
associating the first APT object and the second APT object with an attacker profile upon determining that multiple APT objects share a predefined number of extracted features.

18. The computerized method of claim 17 , further comprising:
comparing extracted features from a third APT object with one or more of the first APT object and the second APT object
associated with the attacker profile; and
attributing the third APT object to an attacker associated with the attacker profile upon determining that the third APT object shares the predefined number of extracted features with multiple APT objects.

19. The computerized method of claim 1 further comprising analyzing the APT database and identifying an APT campaign that comprises:
detecting a number of APT objects in the APT database that have occurred within a specified time period;
determining whether the number of APT objects detected during the specified time period is above a campaign threshold value; and
signaling that an APT campaign is occurring during the specified time period in response to determining that the number of APT objects during the specified time period is above the campaign threshold value.

20. The computerized method of claim 19 , wherein the detected APT objects are associated with a single attacker.

21. The computerized method of claim 1 , wherein the extracted features include data that exhibit that an associated attacker has prior knowledge about a target of the received object.

22. The computerized method of claim 1 , wherein the extracting features of the received object is performed by a

Assignees

• Fireeye Inc

Inventors

• Haq Thoufique
• Zhai Jinjian
• Pidathala Vinay K

Classifications

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• H04L63/145 Primary

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• H04L63/205

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title