Shellcode detection

Patent metadata

Field	Value
Publication number	US-9973531-B1
Application number	US-201414311000-A
Country	US
Kind code	B1
Filing date	Jun 20, 2014
Priority date	Jun 6, 2014
Publication date	May 15, 2018
Grant date	May 15, 2018

Abstract

According to one embodiment, a threat detection system is integrated with at least a dynamic analysis engine. The dynamic analysis engine is configured to automatically determine whether one or more objects included in received network traffic contains a heap spray attack. Upon detection of a potential heap spray attack, the dynamic analysis engine may copy potential shellcode within an object included in the received network traffic, insert the copy of the potential shellcode into a second region of allocated memory and analyze the execution of the potential shellcode to determine whether characteristics associated with an exploit are present.

First claim

What is claimed is:

1. A computerized method, comprising:
instantiating an instance of an application within a virtual machine, the application for executing an object;
allocating a first region of memory to the virtual machine for use in execution of the object with the application;
responsive to detecting one or more characteristics of a heap spray attack within a sequence of bytes within the first region of memory, allocating a second region of memory to the virtual machine, wherein the first region of memory is a first virtual heap and the second region of memory is a second virtual heap different than the first virtual heap;
copying the sequence of bytes from the first region of memory to the second region of memory;
beginning execution, by the virtual machine, of the copy of the sequence of bytes stored in the second region of memory; and
monitoring the execution of the copy of the sequence of bytes to detect characteristics of anomalous behavior.

2. The computerized method of claim 1 , wherein the copying of the sequence of bytes comprises
requesting allocation of the second region of memory, and
inserting the copy of the sequence of bytes into the second region of allocated memory.

3. The computerized method of claim 1 , wherein the sequence of bytes is copied and inserted as a binary file.

4. The computerized method of claim 1 , wherein a characteristic of the one or more characteristics of the heap spray attack includes at least one sequence of No Operation (NOP) instructions adjacent to the sequence of bytes at a particular location within the first region of allocated memory.

5. The computerized method of claim 4 , wherein the sequence of bytes includes potential shellcode, the potential shellcode being computer code that includes one or more characteristics indicative of the capability of performing malicious activity.

6. The computerized method of claim 5 , further comprising:
prior to copying the potential shellcode from the first region of allocated memory, determining that the potential shellcode is present in the first region of allocated memory.

7. The computerized method of claim 6 , wherein a first sequence of NOP instructions is determined to be adjacent to a first side of the potential shellcode, the first sequence of NOP instructions being one of the at least one sequence of NOP instructions.

8. The computerized method of claim 7 , wherein a second sequence of NOP instructions is determined to be adjacent to a second side of the potential shellcode, the second sequence of NOP instructions being one of the at least one sequence of NOP instructions.

9. The computerized method of claim 5 , further comprising:
transmitting the copy of the potential shellcode to a module, wherein the module requests the allocation of the second region of memory and inserts the copy of the potential shellcode into the second region of allocated memory, the permissions of the second region of allocated memory are to be set to allow contents of the second region of allocated memory to be read and executed.

10. The computerized method of claim 9 , further comprising:
dynamically configuring a virtual machine with a software image representing a current operating state of a targeted client device, the software image representing content and structure of a storage volume for the targeted client device at a time of configuring the virtual machine, wherein the module is located within the virtual machine.

11. The computerized method of claim 10 , wherein the module begins execution of the copy of the potential shellcode within the virtual machine.

12. The computerized method of claim 5 , further comprising:
prior to beginning execution of the copy of the potential shellcode, disassembling the copy of the potential shellcode to determine the starting instruction of the potential shellcode.

13. The computerized method of claim 5 , wherein the potential shellcode is copied from a Portable Document Format (PDF) file and at least a portion of JavaScript within the PDF file is parsed to reveal a location of the potential shellcode within the first region of allocated memory.

14. The computerized method of claim 13 , wherein one or more images embedded within the PDF file are analyzed to reveal the location of the potential shellcode within the first region of allocated memory.

15. The computerized method of claim 5 , wherein the potential shellcode is copied from a video file and at least a portion of the video file is analyzed to reveal a location of the potential shellcode within the first region of allocated memory.

16. The computerized method of claim 5 , wherein the potential shellcode is copied from a non-executable file and one or more scripts within the file are analyzed to reveal a location of the potential shellcode within the first region of allocated memory.

17. The computerized method of claim 5 , wherein a score is assigned to at least a portion of network traffic from which the potential shellcode was copied, the score signifying a probability that at least the portion of the network traffic is associated with an exploit.

18. The computerized method of claim 5 , further comprising:
generating an alert based the analysis of the execution of the copy of the potential shellcode.

19. The computerized method of claim 1 , wherein prior to detecting the one or more characteristics of the heap spray within the first region of memory, beginning execution of the object using the first region of memory.

20. A system comprising:
one or more processors; and
a storage module communicatively coupled to the one or more processors, the storage module includes logic to:
instantiate an instance of an application within a virtual machine, the application for executing an object;
allocate a first region of memory to the virtual machine for use in execution of the object with the application;
responsive to detecting one or more characteristics of a heap spray attack within a sequence of bytes within the first region of memory, allocate a second region of memory to the virtual machine, wherein the first region of memory is a first virtual heap and the second region of memory is a second virtual heap different than the first virtual heap;
copy the sequence of bytes from the first region of memory to the second region of memory;
begin execution, by the virtual machine, of the copy of the sequence of bytes stored in the second region of memory; and
monitor the execution of the copy of the sequence of bytes to detect one or more characteristics of anomalous behavior.

21. The system of claim 20 , wherein the sequence of bytes includes potential shellcode, the potential shellcode being computer code that includes one or more characteristics indicative of the capability of performing malicious activity.

22. The system of claim 20 , wherein the sequence of bytes is copied and inserted as a binary file.

23. The system of claim 20 , wherein a characteristic of the one or more characteristics of the heap spray attack includes at least one sequence of No Operation (NOP) instructions adjacent to the sequence of bytes at a particular location within the first region of allocated memory.

24. The system of claim 23 , wherein the sequence of bytes includes potential shellcode, the potential shellcode being computer code that includes one or more characteristics indicative of the capability of performing malicious activity.

25. T

Assignees

• Fireeye Inc

Inventors

• Thioux Emmanuel

Classifications

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• H04L63/1466 Primary

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title