Techniques for detecting a security vulnerability

Patent metadata

Field	Value
Publication number	US-9639693-B2
Application number	US-201313931426-A
Country	US
Kind code	B2
Filing date	Jun 28, 2013
Priority date	Jun 28, 2013
Publication date	May 2, 2017
Grant date	May 2, 2017

Abstract

Techniques for detecting security vulnerabilities are disclosed. In one particular embodiment, the techniques may be realized as a method for detecting security vulnerabilities including assigning a reputation to an application, distributing the reputation to a client, receiving monitored system behavior from the client related to the client executing the application, determining whether to change the reputation of the application based on the monitored system behavior, distributing the changed reputation to the client, receiving further monitored system behavior from the client, and determining whether to generate a rule for the application based on the monitored system behavior received from the client.

First claim

The invention claimed is:

1. A method for detecting a security vulnerability comprising:
determining, at a backend system, an initial reputation of a new application, wherein the new application is a new version of a first application that was previously installed on a plurality of clients, and wherein the initial reputation is based on a reputation of the previous version of the first application, an analysis of a developer of the new version of the first application, and behavior of the new version of the first application during installation on a plurality of clients, wherein the behavior of the new version of the first application during installation on the plurality of clients is analyzed using heuristics;
distributing the initial reputation from the backend system to the plurality of clients via a network;
receiving, at the backend system, monitored system behavior from one of the plurality of clients related to the one of the plurality of clients executing the new application, wherein the monitored system behavior includes detailed information regarding the system behavior of the one of the plurality of clients, applications being executed on the one of the plurality of clients, the new application being executed on the one of the plurality of clients, and an indication of whether the new application is exhibiting malicious behavior,

and wherein the one of the plurality of clients executes the new application based on a security enforcement for the new application determined in accordance with the initial reputation of the new application and a behavior of the new application subsequent to installation;
determining, at the backend system, whether to change the initial reputation of the new application based on the monitored system behavior;
distributing a changed initial reputation to the plurality of clients based on the determination;
receiving further monitored system behavior based on the changed initial reputation from the one of the plurality of clients; and
determining an action to be performed based on the further monitored system behavior received from the one of the plurality of clients, wherein the action to be performed comprises changing a reputation of a second application different from the first application and the new application.

2. The method of claim 1 , wherein determining the reputation for the new application comprises assigning the reputation, and wherein the reputation indicates whether the new application is one of trusted, neutral, suspicious, and malicious.

3. The method of claim 1 , wherein the analysis comprises determining whether the new application is from a known entity, and wherein the monitored system behavior is analyzed using heuristics.

4. The method of claim 3 , wherein determining the reputation of the new application comprises assigning the new reputation, the reputation being assigned based on the known entity.

5. The method of claim 1 , wherein the new application is executed on the plurality of clients based on the received reputation.

6. The method of claim 1 , wherein the reputation of the new application is changed when the monitored system behavior indicates that the new application is exhibiting suspicious behavior.

7. The method of claim 5 , wherein the reputation of the new application is changed based on monitored system behavior received from the plurality of clients executing the new application.

8. The method of claim 1 , wherein the one of the plurality of clients terminates the new application when the behavior of the new application subsequent to installation is a known malicious activity.

9. The method of claim 1 , wherein the action to be performed comprises generating a rule for the new application, and wherein the rule for the new application indicates that the new application is to be quarantined when the further monitored system behavior indicates that the new application is malicious, prevented from accessing certain client resources, executed on a virtual client when the further monitored system behavior indicates that the new application is suspicious, and permitted full access to client resources when the further monitored system behavior indicates that the new application is trusted.

10. The method of claim 9 , further comprising:
transmitting the generated rule for the new application to the client.

11. At least one non-transitory processor readable storage medium storing a computer program of instructions configured to be readable by at least one processor for instructing the at least one processor to execute a computer process for performing the method as recited in claim 1 .

12. A method for detecting a security vulnerability comprising:
receiving an initial reputation of a new application from a backend system, wherein the new application is a new version of a first application that was previously installed on a plurality of clients, and wherein the initial reputation is based on a reputation of the previous version of the first application, an analysis of a developer of the new version of the first application, and behavior of the new version of the first application during installation on a plurality of clients, wherein the behavior of the new version of the first application during installation on the plurality of clients is analyzed using heuristics;
determining a security enforcement for the new application based on the initial reputation of the new application and behavior of the new application subsequent to installation;
executing the new application based on the initial reputation and the determined security enforcement;
monitoring system behavior while executing the new application, wherein the monitored system behavior includes detailed information regarding the system behavior of the one of the plurality of clients, applications being executed on the one of the plurality of clients, the new application being executed on the one of the plurality of clients, and an indication of whether the new application is exhibiting malicious behavior;
reporting the monitored system behavior to the backend system, wherein the backend system determines an action to be performed based on the monitored system behavior, and wherein the action to be performed comprises changing a reputation of a second application different from the first application and the new application;
determining whether a changed reputation for the new application has been received from the backend system;
monitoring the system behavior based on the changed reputation; and
transmitting the monitored system behavior based on the changed reputation to the backend system.

13. The method of claim 12 , wherein determining the reputation for the new application comprises assigning the reputation.

14. The method of claim 12 , wherein monitoring the system behavior comprises at least one of monitoring for unauthorized system resource access, unauthorized writing to a system operating system, termination of a security application, and unauthorized network activity.

15. The method of claim 12 , wherein the system behavior is monitored for known suspicious and malicious behavior based on heuristics.

16. The method of claim 12 , wherein the system behavior is monitored at a first frequency when the assigned reputation indicates that the new application is trusted and the system behavior is monitored at a second frequency higher than the first frequency when the changed reputation indicates that the new application is less than trusted.

17. The method of claim 12 , wherein, when suspicious system behavior is detected, execution

Assignees

• Symantec Corp

Inventors

• Rivera Shireen
• Ashley Peter

Classifications

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/51 Primary

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title