Systems and methods for categorizing virtual-machine-aware applications for further analysis

Patent metadata

Field	Value
Publication number	US-9703956-B1
Application number	US-201514732809-A
Country	US
Kind code	B1
Filing date	Jun 8, 2015
Priority date	Jun 8, 2015
Publication date	Jul 11, 2017
Grant date	Jul 11, 2017

Abstract

The disclosed computer-implemented method for categorizing virtual-machine-aware applications for further analysis may include (1) identifying a plurality of virtual-machine-aware applications, where each of the plurality of virtual-machine-aware applications exhibits different behavior when the virtual-machine-aware application detects that the virtual-machine-aware application is executing in a physical computing environment rather than in a virtual computing environment, (2) identifying a plurality of non-virtual-machine-aware applications that do not exhibit different behavior when executed in the physical computing environment rather than in the virtual computing environment, (3) determining at least one characteristic that differentiates the virtual-machine-aware applications from the non-virtual-machine-aware applications, (4) analyzing an uncategorized application to determine whether the uncategorized application includes the characteristic, and (5) preventing the uncategorized application from evading complete analysis by sending the uncategorized application to the physical computing environment for further analysis. Various other methods, systems, and computer-readable media are also disclosed.

First claim

What is claimed is:

1. A computer-implemented method for categorizing virtual-machine-aware applications for further analysis, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
categorizing a plurality of virtual-machine-aware applications by determining that each of the plurality of virtual-machine-aware applications exhibits at least one behavior when the virtual-machine-aware application detects that the virtual-machine-aware application is executing in a physical computing environment that the virtual-machine-aware application does not exhibit in a virtual computing environment, wherein each virtual-machine-aware application is designed to detect whether the virtual-machine-aware application is executing in the physical computing environment or in the virtual computing environment in order to avoid being detected by a malware detection system operating within the virtual computing environment;
categorizing a plurality of non-virtual-machine-aware applications by determining that the non-virtual-machine-aware-applications do not exhibit different behavior when executed in the physical computing environment rather than in the virtual computing environment;
determining, at least in part by using telemetry data gathered from at least one end user computing system to compare the virtual-machine-aware applications with the non-virtual-machine-aware applications, at least one characteristic that differentiates the virtual-machine-aware applications from the non-virtual-machine-aware applications;
analyzing an uncategorized application to determine whether the uncategorized application comprises the characteristic that differentiates the virtual-machine-aware applications from the non-virtual-machine-aware applications;
in response to determining that the uncategorized application comprises the characteristic that differentiates the virtual-machine-aware applications from the non-virtual-machine-aware applications, preventing the uncategorized application from evading complete analysis by sending the uncategorized application to the physical computing environment for further analysis to identify malicious behaviors performed on the physical computing environment by the uncategorized application that indicate the uncategorized application comprises malware;
analyzing an additional uncategorized application to determine that the additional uncategorized application does not comprise the characteristic; and
in response to determining that the additional uncategorized application does not comprise the characteristic, preventing an expenditure of physical computing resources by sending the additional uncategorized application to the virtual computing environment rather than the physical computing environment for further analysis to identify malicious behaviors performed on the virtual computing environment by the uncategorized application that indicate the uncategorized application comprises malware.

2. The computer-implemented method of claim 1 , wherein determining the at least one characteristic that differentiates the virtual-machine-aware applications from the non-virtual-machine-aware applications comprises at least one of:
performing a static analysis of code of the virtual-machine-aware applications to identify the characteristic;
performing a dynamic analysis of behavior of the virtual-machine-aware applications to identify the characteristic;
contrasting an analysis of the virtual-machine-aware applications with an analysis of the non-virtual-machine-aware applications to identify the characteristic; and
receiving input from an application analyst that identifies the characteristic.

3. The computer-implemented method of claim 1 , wherein analyzing the uncategorized application comprises performing a static analysis of code of the uncategorized application.

4. The computer-implemented method of claim 1 , wherein analyzing the uncategorized application comprises analyzing behavior of the uncategorized application in the virtual computing environment.

5. The computer-implemented method of claim 1 , wherein sending the uncategorized application to the physical computing environment comprises
preventing an expenditure of virtual computing resources by sending the uncategorized application to the physical computing environment rather than the virtual computing environment for the further analysis.

6. The computer-implemented method of claim 1 , wherein categorizing the plurality of virtual-machine-aware applications comprises:
executing a plurality of applications in the virtual computing environment;
executing the plurality of applications in the physical computing environment; and
classifying any of the plurality of applications that behave differently in the physical computing environment than in the virtual computing environment as one of the plurality of virtual-machine-aware applications.

7. A system for categorizing virtual-machine-aware applications for further analysis, the system comprising:
a categorization module, stored in memory, that categorizes:
a plurality of virtual-machine-aware applications by determining that each of the plurality of virtual-machine-aware applications exhibits at least one behavior when the virtual-machine-aware application detects that the virtual-machine-aware application is executing in a physical computing environment that the virtual-machine-aware application does not exhibit in a virtual computing environment, wherein each virtual-machine-aware application is designed to detect whether the virtual-machine-aware application is executing in the physical computing environment or in the virtual computing environment in order to avoid being detected by a malware detection system operating within the virtual computing environment;
a plurality of non-virtual-machine-aware applications by determining that the non-virtual-machine-aware-applications do not exhibit different behavior when executed in the physical computing environment rather than in the virtual computing environment;

a determination module, stored in memory, that determines, at least in part by using telemetry data gathered from at least one end user computing system to compare the plurality of virtual-machine-aware applications to the plurality of non-virtual-machine-aware applications, at least one characteristic that differentiates the virtual-machine-aware applications from the non-virtual-machine-aware applications;
an analysis module, stored in memory, that analyzes:
an uncategorized application to determine whether the uncategorized application comprises the characteristic that differentiates the virtual-machine-aware applications from the non-virtual-machine-aware applications; and
an additional uncategorized application to determine that the additional uncategorized application does not comprise the characteristic; a prevention module, stored in memory, that:
in response to determining that the uncategorized application comprises the characteristic that differentiates the virtual-machine-aware applications from the non-virtual-machine-aware applications, prevents the uncategorized application from evading complete analysis by sending the uncategorized application to the physical computing environment for further analysis to identify malicious behaviors performed on the physical computing environment by the uncategorized application that indicate the uncategorized application comprises malware; and
in response to determining that the additional uncategorized application does not comprise the characteristic, prevents an expenditure of physical computing resources by sending the additional uncategorized application to the virtual computing environment rather than the physical computin

Assignees

• Symantec Corp

Inventors

• Watson Andrew
• Wawda Abubakar

Classifications

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/563

  by source code analysis · CPC title

• G06F21/562 Primary

  Static detection · CPC title