Malicious content analysis using simulated user interaction without user involvement

Patent metadata

Field	Value
Publication number	US-9912698-B1
Application number	US-201514804086-A
Country	US
Kind code	B1
Filing date	Jul 20, 2015
Priority date	Mar 13, 2013
Publication date	Mar 6, 2018
Grant date	Mar 6, 2018

Abstract

Techniques for detecting malicious content using simulated user interactions are described herein. In one embodiment, a monitoring module monitors activities of a malicious content suspect executed within a sandboxed operating environment. In response to detection of a predetermined event triggered by the malicious content suspect requesting a user action on a graphical user interface (GUI) presented by the malicious content suspect, simulating, a user interaction module simulates a user interaction with the GUI without user intervention. An analysis module analyzes activities of the malicious content suspect in response to the simulated user interaction to determine whether the malicious content suspect should be declared as malicious.

First claim

What is claimed is:

1. A computer-implemented method comprising:
detecting an event requesting a user action on a graphical user interface during processing of a malicious content suspect within a virtual machine;
in response to detection of the event requesting the user action on the graphical user interface, simulating a user interaction with a displayable feature of the graphic user interface without user intervention by at least registering with an operating system operating as part of the virtual machine to (i) intercept signaling to one or more graphics user interface (GUI) application programming interfaces (APIs) and (ii) send a command to the operating system to respond to the graphical user interface produced during processing of the malicious content suspect; and
analyzing behaviors of the malicious content suspect in response to the simulated user interaction to determine whether the malicious content suspect should be declared as malicious.

2. The method of claim 1 , wherein the malicious content suspect is an executable that, when executed by a processor implemented within a data processing system, generates the graphic user interface.

3. The method of claim 1 , wherein the event requesting the user action on the graphical user interface is triggered by an application processing the malicious content suspect.

4. The method of claim 1 , wherein the sending of the command that simulates the user interaction that includes activation of a predetermined button presented by a dialog box that would cause execution or storage of an attached file.

5. The method of claim 1 , wherein the detecting an event requesting the user action on the graphical user interface is performed by intercepting a call initiated by the malicious content suspect to an Application Programming Interface (API) of the one or more GUI APIs.

6. The method of claim 1 , wherein the detecting an event requesting the user action on the graphical user interface is performed by registering a hook to an API of the one or more GUI APIs of the operating system.

7. The method of claim 1 , wherein prior to sending the command that is responsive to display of the graphic user interface, the method further comprises (i) building an internal data structure that represents content and layout of the dialog box, (ii) comparing the internal data structure to a library of dialogs stored in the memory, and (iii) upon matching one of the dialogs, obtaining information associated with a matched dialog to dismiss the dialog box.

8. The method of claim 1 , wherein the analyzing of the behaviors of the malicious content suspect is performed by at least analyzing information associated with the behaviors based on a set of rules to determine whether the malicious content suspect is considered to be malicious.

9. The method of claim 1 , wherein the simulating of the user interaction with the displayable feature is conducted without displaying the dialog box.

10. A system, comprising:
a processor; and
a memory coupled to the processor, the memory comprises
a monitoring module that, when executed by the processor, monitors for an event requesting a user action on a graphical user interface during processing of a malicious content suspect within a virtual machine,
a user interaction module that, when executed by the processor and in response to detection of the event requesting the user action on the graphical user interface, simulates a user interaction with a displayable feature of the graphical user interface without user intervention, the user interaction module registers with an operating system deployed within the virtual machine to (i) intercept signaling to one or more application programming interfaces (APIs) that are directed to a graphics user interface (GUI) application and operate in cooperation with the operating system and (ii) send a command to the operating system to respond to the graphical user interface produced during processing of the malicious content suspect, and
an analysis module to analyze behaviors of the malicious content suspect in response to the simulated user interaction to determine whether the malicious content suspect should be declared as malicious.

11. The system of claim 10 , wherein the malicious content suspect is an executable that, when executed by the processor, generates the graphic user interface.

12. The system of claim 10 , wherein the user interaction module is configured to:
detect a display of a message dialog box, and
automatically, without user intervention, send the command representing an activation of a predetermined button of the message dialog box to the operating system to respond to the message dialog box.

13. The system of claim 12 , wherein the predetermined button when activated is to dismiss the message dialog box.

14. The system of claim 10 , wherein the user interaction module is configured to:
detect a dialog box being configured to prompt a user for a confirmation of execution or storage of an attached file, and
automatically, without user intervention, send the command representing an activation of a predetermined button presented by the dialog box that would cause the execution or storage of the attached file.

15. The system of claim 10 , wherein the detection of the event by the monitoring module comprises intercepting a call initiated by the malicious content suspect to the one or more APIs.

16. The system of claim 10 , wherein the monitoring of the event requesting the user action by the monitoring module comprises registering a hook with the operating system to detect the signaling to the one or more APIs operating as a graphical user interface API of the operating system.

17. The system of claim 16 , wherein the detecting of the event by the monitoring module further comprises receiving a notification from the operating system of a communication from the malicious content suspect to the graphical user interface API to display a dialog box.

18. The system of claim 10 , wherein prior to sending the response, the user interaction module, when executed by the processor, further (i) builds an internal data structure that represents content and layout of a dialog box, (ii) compares the internal data structure to a library of dialogs stored in memory, and (iii) upon matching one of the dialogs, obtains information associated with a matched dialog to dismiss the dialog box.

19. The system of claim 10 , wherein the analysis module, when executed by the processor, analyzes the behaviors of the malicious content suspect by at least analyzing information associated with the behaviors based on a set of rules to determine whether the malicious content suspect is considered to be malicious.

20. The system of claim 10 , wherein the simulating of the user interaction with the displayable feature of the graphic user interface, which is operating as a dialog box, is conducted without displaying the dialog box.

21. The system of claim 10 , wherein the user interaction module is configured to:
detect a dialog box being configured to prompt a user for a confirmation of executing or storing an attached file; and
automatically, without user intervention, send the command representing an activation of a prescribed button that is present in the dialog box to the operating system to allow the operating system to store the attached file.

22. The system of claim 10 , wherein the user interaction module is configured to:
detect a dialog box being configured to prompt a user for

Assignees

• Fireeye Inc

Inventors

• Thioux Emmanuel
• Amin Muhammad
• Kindlund Darien
• Pilipenko Alex
• Vincent Michael

Classifications

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title