RU101233U1 - SYSTEM OF RESTRICTION OF RIGHTS OF ACCESS TO RESOURCES BASED ON THE CALCULATION OF DANGER RATING - Google Patents

Abstract

 1. A system for restricting access rights to resources, which includes: a processor that executes a file process running in memory from executable files; memory, which contains the processes of files executable on the processor, and from which the means of protection and restriction of access rights to resources reads information about the processes; means for storing risk factors that correspond to certain access and weight groups, while means for storing risk factors are associated with means for storing multiple weights and means of protecting and restricting access rights to resources, while means for storing risk factors are designed to store risk factors that are used when calculating a process hazard rating; means for storing a plurality of scales, which is intended for storing a plurality of scales affixed according to the respective risk factors; means for storing data about access groups, which is designed to determine access to certain resources of a computer system, wherein means for storing access groups is associated with means for storing risk factors and means for storing restrictions for access groups; means for storing data on restrictions for access groups to resources of a computer system to which certain access groups correspond, wherein means for storing data on restrictions for access groups is intended to determine access restrictions to resources of a computer system; a means of protecting and restricting access rights to resources designed to initialize a hazard rating for processes in a computer system based on risk analysis by comparing attributes

Description

Technical field

The utility model relates to antivirus technologies, in particular, systems for restricting access rights to system resources based on calculation of process hazard rating.

State of the art

Currently, the spread of malicious software (hereinafter referred to as software) is increasing, as well as the damage that this software is causing to computer systems. Existing systems for protecting personal computers, as well as computers in the corporate network, are based on the detection of known threats. However, new threats appear more and more often, and methods for recognizing unknown threats become necessary. With the growth of communication networks such as the Internet, there is an increasing need for data exchange, including the increasing use of mail messages. Therefore, infecting computers through data transfer through communication channels or file sharing is an important task that should be addressed. Infections can take many forms, but they come mostly in the form of computer viruses, trojans, and other forms of malicious code.

Recent events related to email attacks have had major consequences for both Internet Service Providers (ISPs) and many companies. Therefore, it is necessary to improve malware detection strategies.

On the one hand, signature detection is used to detect malware. Signature detection systems use code patterns that were obtained from known malware, and suspected objects are scanned for patterns in the code. One of the drawbacks of signature detection systems is that only known malicious programs can be detected in this way. All malicious programs that were not previously identified as malicious, as well as malware created after updating the signature databases, will not be recognized by this system.

On the other hand, there is a technology for checking the integrity of information. Information integrity verification systems use the code of already known trusted (clean) programs, and an instance of pure program code is created on their basis. This instance is stored along with information about the program file, such as the program title and file length, the date and time the copy was created. At certain intervals, the program is compared with a stored instance located in the computer database to identify the fact of program modification.

Information integrity verification systems usually create long lists of modified files after updates to the operating system when many software updates are installed. The main disadvantage of integrity systems is that the system responds to any changes in the program, although these changes may not be harmful. It is also difficult for the user to decide whether this or that change is an attack on a computer system.

Checksum monitoring systems detect malware by generating a cyclic redundancy code (CRC) value for each program file. Modifications to the program file will be detected if the CRC value changes. Checksum monitoring systems along with the use of integrity systems improve the stability of the overall system. However, checksum monitoring systems have the same drawbacks as integrity verification systems, associated with a large number of false warnings at the slightest changes to the program.

One of the goals of the presented utility model is to analyze files for the presence of a virus. To do this, the file is emulated in order to determine its behavior, which in the case of the presented utility model is realized when calculating the dynamic rating. Also, parameters such as the size and file name are analyzed, which is implemented in the presented utility model when calculating the static rating. On the basis of the results obtained, a verdict is issued that the file is infected with a virus or that the file is not infected.

Such use of emulation is disclosed in patent application US 2004/0255165, which describes a method for detecting malicious files that executes instructions of a suspected file on an emulator. A similar technology is described in US Pat. No. 5,756,030, which describes the emulation mode for pre-fetching executable instructions and sets flags if these instructions change after being added to the sample. US 5,826,013 describes an emulation mode for detecting polymorphic viruses, and US 2002/0073323 discloses a file emulation system attempting to access computer system resources.

However, these solutions do not allow you to dynamically change the hazard rating and track the process during its execution, and if malicious actions are detected, change the hazard rating.

An analysis of the prior art and the possibilities that arise when combining them in one system allows you to get a new result, namely to limit access rights to system resources based on the calculation of the hazard rating of processes.

Utility Model Disclosure

The technical result of this utility model is to restrict access rights to system resources based on the calculation of a static and dynamic process hazard rating.

In an embodiment of the present utility model, a system is provided for restricting access rights to resources, which includes: a processor executing a file process running in memory from executable files; memory, which contains the processes of files executed on the processor, and from which the means of protection and restriction of access rights to resources reads information about the processes; means for storing risk factors that correspond to certain access and weight groups, while means for storing risk factors are associated with means for storing multiple weights and means of protecting and restricting access rights to resources, while means for storing risk factors are designed to store risk factors that are used when calculating a process hazard rating; means for storing a plurality of scales, which is intended for storing a plurality of scales affixed according to the respective risk factors; means for storing data about access groups, which is designed to determine access to certain resources of a computer system, wherein means for storing access groups is associated with means for storing risk factors and means for storing restrictions for access groups; means for storing data on restrictions for access groups to resources of a computer system to which certain access groups correspond, wherein means for storing data on restrictions for access groups is intended to determine access restrictions to resources of a computer system; a means of protecting and restricting access rights to resources designed to initialize a hazard rating for processes in a computer system based on risk analysis by comparing the attributes of the executable file from which the process was launched in the computer system with factors and corresponding risk weights for compiling a statistical rating; at the same time, the means of protecting and restricting access rights to resources continues to monitor processes for detecting suspicious actions and updating the process danger rating in relation to a specific access group if it tries to perform an action that relates to the corresponding risk factors to compile a dynamic rating; wherein the means of protecting and restricting access rights to resources blocks the access of the process to those resources of the computer system that are on the set of restrictions of a certain access group to resources of the computer system that are associated with access groups;

In one of the private implementations, a means of protecting and restricting access rights to resources detects an attempt to run an executable file.

In one of the private embodiments, the means of protecting and restricting access rights to resources is intended to transmit information about the executable files being launched to the risk factor storage means.

In one of the private embodiments, the means of protecting and restricting access rights to resources is intended to update the hazard rating if the process tries to conduct suspicious actions.

In yet another private embodiment, the means of protecting and restricting access rights to resources is intended to alert the user if the updated hazard rating reaches the first threshold.

In yet another private embodiment, a means of protecting and restricting access rights to resources is intended to block the process from accessing computer system resources if the updated hazard rating reaches a second threshold.

In one of the private embodiments, the means of protecting and restricting access rights to resources is intended to carry out treatment of the process, and if successful, allows its further implementation.

In one of the private embodiments, the means of protecting and restricting access rights to resources is intended to delete a file if the damaged file is independent, namely, an executable file that is not important for the operation of the system.

In one of the private embodiments, the means of protecting and restricting access rights to resources is intended to quarantine the file if the damaged file is independent, namely, an executable file that is not important for the operation of the system.

In one of the private embodiments, the means of protecting and restricting access rights to resources is intended to disinfect a file if the damaged file is independent, namely, an executable file that is not important for the system to operate.

In one particular embodiment, the static hazard rating is based on the statistical properties of the file, such as the file name, file size, file location, file structure, digital signature, file compression settings, and whether the file was downloaded from a CD-ROM or from a network The Internet.

In one particular embodiment, the dynamic hazard rating is based on the results of the emulation process.

In one of the private embodiments, the antivirus application is a means of protecting and restricting access rights to resources.

In one of the private embodiments, the suspicious action is at least one of the following actions: whether the process is trying to write to the memory of other processes; whether the process is trying to access protected archive files; whether the process is trying to start the service with a name that matches the name of the system process; Whether the process is trying to start the service with a name that matches the name of the anti-virus process; whether the process is trying to hijack or remove a system service; Whether the process is trying to hijack or remove the anti-virus service; whether the process is trying to change data in the registry; whether the process is trying to scan network resources; whether the process is trying to add a network resource; whether the process is trying to request system privileges; whether the process is trying to access the system core; as well as the properties of system calls made by a process.

In one of the private embodiments, the resources for access groups may include the following computer system resources: access to a local network; Internet access file access; access to the registry; actions with passwords; Actions requiring system privileges and actions that require operating system kernel privileges.

Brief Description of the Drawings

Additional objectives, features and advantages of the present utility model will be apparent from reading the following description of the implementation of the utility model with reference to the accompanying drawings, in which:

Figure 1 shows an exemplary embodiment of a method for calculating a hazard rating for processes.

Figure 2 shows an example implementation of a block diagram of a system for calculating a hazard rating for processes.

Figure 3 shows an exemplary embodiment of communication between processes and groups.

4 shows an exemplary embodiment of communication between groups and resources of a computer system.

Description of Embodiments of a Utility Model

Next, exemplary embodiments of the present utility model will be described with reference to the accompanying drawings. The objects and features of the present utility model, as well as the methods for achieving these objects and features, will become apparent by reference to exemplary embodiments. However, the present utility model is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The entity defined in the description is nothing more than the specific details provided to assist a person skilled in the art in an exhaustive understanding of the utility model, and the present utility model is determined only in the scope of the attached formula.

The present utility model is used in general-purpose computers, for example, ordinary computers or servers. Such computers contain a processor, system memory, and a system bus that connects various system components, including system memory, to the processor. A system bus can be one of several types of bus structure, including a memory bus or memory controller, a peripheral bus, and a local bus using any bus architecture. System memory includes read-only memory (ROM) and random access memory (RAM).

The basic input / output system (BIOS), which contains the main programs that help transfer information between items on the computer, such as during startup, is stored in ROM. The computer may further comprise a hard disk drive for reading or writing to a hard disk, a magnetic disk drive for reading from or writing to a removable magnetic disk, and an optical disk drive for reading from or writing to a removable optical disk such as a CD-ROM DVD-ROM or other optical media.

The hard disk drive, the magnetic disk drive and the optical disk drive are also connected to the system bus via the hard disk drive interface, the magnetic disk drive interface and the optical disk drive interface, respectively. Storage devices and related computer-readable media provide non-volatile storage of computer-readable instructions, data structures, program modules and other computer data.

The computer may also contain magnetic cassettes, flash memory cards, digital video discs, Bernoulli cartridges, random access memory (RAM), read-only memory (ROM) and other types of memory.

A number of software modules may be stored on a hard disk, magnetic disk, optical disk, ROM or RAM, including an operating system (for example, Windows ™ 2000). A computer also includes a file system associated with or included in an operating system, such as a Windows NT ™ File System (NTFS), one or more application programs, other program modules, and program data. The user can enter commands and information into the computer using input / output devices such as a keyboard and pointing device (mouse).

Other input devices may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These and other I / O devices are connected to the processor via the serial port interface, which is connected to the system bus. It should be noted that these I / O devices can connect to other interfaces, such as a parallel port or universal serial port (USB). A monitor or other type of display device also connects to the system bus via an interface, such as a video adapter. In addition, the computer may include other peripheral output devices, such as speakers and printers.

A computer using the claimed systems operates in a network environment using logical connections with one or more remote computers. The remote computer (or computers) can be other computers, servers, routers, network PCs, a peer device, or another common network node. This computer can be connected to a local area network (LAN) or to a wide area network (WAN), to a network in offices, the Internet or an Intranet.

When the computer is used in a LAN network environment, the computer connects to the local network through a network interface or adapter. When used in a WAN network environment, a computer typically includes a modem or other means to establish communications over a wide area network such as the Internet. The modem, which can be internal or external, connects to the system bus via the serial port interface.

This utility model describes a system and method for calculating a static and dynamic process hazard rating.

In one embodiment, the system and method uses a risk analysis of a process based on a hazard rating R. Hazard rating R changes from “safe” to “dangerous” and is calculated as a percentage from 0 to 100. Accordingly, 0% is the safest rating level, and 100% is the most dangerous rating level. To simplify the understanding of the "danger" of the process, 3 hazard levels can be introduced: 0 - green, the process is not dangerous; 1, 2 - yellow, moderately dangerous; 3 - red, the process is dangerous. Accordingly, in percentage terms, the following assumption can be introduced: from 0 to 25% - safe, from 25 to 75 - moderately dangerous, more than 75% - dangerous. It should also be noted that this information will be subject to change. For example, the upper bar of a safe process can decrease (i.e., a safe process should have no more than 10%), as well as the lower one, at a dangerous level (it is quite possible that it will be enough to overcome a barrier of 60-70% in order to count the process dangerous).

The hazard rating R is a number, however, it can be divided into two components: dynamic and static. Before starting a file, a special analyzer will analyze the following parameters: file name, file size, file location, compression parameters, file sources (whether the file was downloaded from a CD-ROM or from the Internet). These criteria determine the static rating of file S.

After that, the emulator starts. A study of the results of the file emulation takes place and each of the behavioral events is compared with a set of assessment criteria and receives an individual hazard assessment. The final grade is the sum of the ratings of all transactions. A search is also made in the executable file and its memory (obtained at the emulation stage) for the characteristic signatures inherent in certain classes of malware. This constitutes a dynamic rating of D.

The final rating is calculated based on the dynamic and static ratings.

R = R (D, S)

A running process is assigned a rating of R.

Moreover, the rating may change if the process commits some inappropriate actions.

The following is a detailed discussion of the factors for assessing a hazard rating.

One of the factors may be the source of the file, which can affect the rating of the process as follows. A file received on a computer from a CD-ROM drive is probably less likely to be infected than a file downloaded from the Internet. For files downloaded from the Internet, the link from which the download occurred is of great importance. The risk factor increases if the file is packed, because malware often packs in order to circumvent signature methods for detecting viruses. The file location is also taken into account, as some executables install their copies in specific directories, and especially in frequently used directories.

Another factor for calculating a hazard rating is file size. More dangerous will be taken into account a small file that is launched for the first time than a large file that is constantly launched on a computer. Most malicious files range in size from hundreds of bytes to several megabytes. The size of the malicious file should not be too large, as in this case, it becomes more difficult to distribute it. Mailing with large infected files cannot be sent to many computers, while mailing with small files is possible in large numbers. For example, the Trojan bootloader can be written in the Assembler programming language and have a size of 1.5-2 kb, and it can also be written in the Delphi programming language using VCL - which is already 200-600 kb. Very rarely are useful applications no larger than 15-20 kb in size, i.e. a file up to 50 kb in size can be considered suspicious.

The “Archive” and “Read-only” attributes on files are quite common, however, the presence of the “Hidden” and “System” attributes on the executable file is a signal that the file is suspicious. This factor will add, for example, 5% to the hazard rating.

The hazard rating also increases if the process writes something to the memory of other processes, creates remote threads, and manipulates the thread context of another application.

Another risk factor may be the fact that the executable may be an installer. In other words, a small file begins at some point to download another executable file from the Internet server. It is also important to consider how the file was created, namely, which process created the file, whether the file was downloaded from the Internet (and in this case, the link from which the file was downloaded is also important). It is also important to know in which directory the file was created (for example, a temporary folder of files from the Internet adds great importance to the hazard rating).

One of the factors is the fact that the file is digitally signed, because unsigned files are more likely to be malicious.

Among the factors influencing the hazard rating are one process writing to the memory of other processes, or trying to change system services. If the process copies itself somewhere, then 70% is added to the hazard rating. If the process creates executable files in the WINDOWS, SYSTEM32, DRIVERS folders, then this is the most dangerous level and 100% of the hazard rating is added. Creating alternative ADS file streams in executable files and folders sets the most dangerous level (100% danger to the hazard rating). Creation of specific files like autorun.inf, runtime.sys, etc. It is also the reason for the rating increase to 100% as well as the removal or modification of system files, access to files storing passwords and other confidential information. Access to devices like /.//С, \\. \\ PHYSICALDRIVE0, etc., as well as access to C: \ WINDOWS \ system32 \ drivers \ etc \ hosts, C: \ boot.ini increases the hazard rating to 100 % Removing any files outside the program folder or the TEMP folder, as well as searching for EXE, DLL, SYS files in system folders by mask, sets the average danger rating to “suspicious”.

Registering your driver or service is also “suspicious”. Removing or manipulating antivirus or firewall services increases the rating to the most dangerous (for example, ChangeServiceConfig (BITS) or DeleteService ('McShield'), OpenService (0 × 1c, "avpcc")). The rating is increased to 100% if the process has access to keys that store passwords or settings (for example, Soft-ware \ Ghisler \ Total Commander, Software \ CoffeeCup Software \ Internet \ Profiles, Software \ Mail.Ru \ Agent \ mra_logins, SOFTWARE \ RIT \ The Bat !, SOFT-WARE \ Far \ Plugins \ FTP \ Hosts), or the process works with startup keys. Creating keys in the service registration section makes the rating moderately dangerous, and deleting existing ones makes it especially dangerous (for example, deleting a key like \ Registry \ Machine \ SYSTEM \ ControlSet001 \ Services \ SymEvent or \ Registry \ Machine \ SYSTEM \ ControlSet001 \ Services \ SYMTDI).

Having received a total rating, the system limits those processes whose rating is too high (i.e., they are potentially dangerous). To limit the use of resources, the HIPS method is used (Host Intrusion Prevention System - an intrusion prevention system that combines the functionality of proactive protection and a firewall that controls access permissions for a file, registry, system rights, etc.). Those. for hazardous processes, you can prohibit the use of network and Internet access, limit the use of memory, etc.

HIPS can be used with virtualization, if, for example, a process wants to create a file in the system folder, then in fact it is not allowed to do this, but at the same time, this process returns a positive value. In this case, you can find more complex malware.

During operation, the process may require resources (for example, access to the network) that can be requested from the user in order for him to allow this himself (to allow the program to download the update, etc.)

There are some groups of rules by which a hazard rating is calculated, which are divided into the following categories:

- Services and drivers

- Processes

- Registry

- file operations

- The Internet

- Network and local area network

- Secure Store

- Privileges and debugging

- Rootkits, removing hooks, anti-rootkit protection

Each rule has its own parameters, such as an identifier, an API function, conditions for arguments (which specify a range of values for a particular danger level in percentage terms), a percentage estimate of the number of operations (1, 2-3, more than 3 operations) , a decision on the ability to recognize the process as malicious based on this rule.

Examples of rules are given below.

Rule "Downloading a malware driver through the low-level API ntdll.dll":

Rule ID: 84

API function: Driver loading (NtLoadDriver)

Condition for argument 1: Contains an entry in the <Services / Malware Driver> group

Condition for argument 2: *

Condition for arguments 3..N: *

Assessment: single operation - 100%, 2-3 operations - 100%,> 3 operations - 100%

Based on this rule, you can recognize the process as malicious: Yes

The rule "Downloading the driver through the low-level API ntdll.dll":

Rule ID: 83

API function: Driver loading (NtLoadDriver)

Condition for argument 1: *

Condition for argument 2: *

Condition for arguments 3..N: *

Assessment: single operation - 40%, 2-3 operations - 50%,> 3 operations - 60%

Based on this rule, you can recognize the process as malicious: No

Rule "Opening the antivirus service":

Rule ID: 13

API function: Opening a service (OpenService)

Condition for argument 1: *

Condition for argument 2: Contains an entry in the <Antivirus Services> group

Condition for arguments 3..N: *

Assessment: single operation - 20%, 2-3 operations - 30%,> 3 operations - 40%

Based on this rule, you can recognize the process as malicious: No

Rule “Creating a malware service (service name)”:

Rule ID: 15

API function: Create a service / driver (CreateService)

Condition for argument 1: *

Condition for argument 2: Contains an entry in the <Services / Malware Driver> group

Condition for arguments 3..N: *

Assessment: single operation - 100%, 2-3 operations - 100%,> 3 operations - 100%

Based on this rule, you can recognize the process as malicious: Yes

Rule "Removing a system service":

Rule ID: 2

API function: Removing a service / driver (DeleteService)

Condition for argument 1: Contains an entry in the <System Services> group

Condition for argument 2: *

Condition for arguments 3..N: *

Assessment: single operation - 100%, 2-3 operations - 100%,> 3 operations - 100%

Based on this rule, you can recognize the process as malicious: No

Rule "Removing the antivirus service":

Rule ID: 1

API function: Removing a service / driver (DeleteService)

Condition for argument 1: Contains an entry in the <Antivirus Services> group

Condition for argument 2: *

Condition for arguments 3..N: *

Assessment: single operation - 100%, 2-3 operations - 100%,> 3 operations - 100%

Based on this rule, you can recognize the process as malicious: Yes

Rule "Manipulation with autorun.inf (creation)":

Rule ID: 44

API function: Create / open a file (CreateFile)

Condition for argument 1: Contains the entry "autorun.inf"

Condition for argument 2: *

Condition for arguments 3..N: *

Assessment: single operation - 100%, 2-3 operations - 100%,> 3 operations - 100%

Based on this rule, you can recognize the process as malicious: Yes

The rule "Manipulation with autorun.inf (removal)":

Rule ID: 43

API function: Delete file (DeleteFile)

Condition for argument 1: Contains the entry "autorun.inf"

Condition for argument 2: *

Condition for arguments 3..N: *

Assessment: single operation - 70%, 2-3 operations - 80%,> 3 operations - 100%

Based on this rule, you can recognize the process as malicious: No

There are groups of processes and services, divided into the following categories: antivirus processes, antivirus services, windows and interface elements of antiviruses, system services, system processes, services / malware drivers, file names of services and malware drivers, registry keys that belong to antiviruses, important system keys, keys of services and drivers, names for direct access to the disk, full names of critical system objects, files with settings and passwords, names in the system storage used by malicious programs frames, as well as registry keys responsible for autostart, used to store passwords and software settings, used to identify the software and search for its location.

Figure 1 shows a block diagram of a method for creating a hazard rating for processes. As shown in step 102 of FIG. 1, file execution is first called. At step 104, a risk analysis is performed using various factors (for example, link-based risk analysis, file size analysis, etc.). At step 106, the process starts. At step 108, the system analyzes the risk of the running process running, matching the process with a rating of S. Even if the initial rating of S is very low (for example, from 0 to 25%), then the rating may change if the process performs suspicious actions. For example, when a process is copied somewhere or when a process creates executable files in the WINDOWS, SYSTEM32, DRIVERS folders, the danger rating immediately increases to 75-100%. Other actions that can cause a rating increase may be the recording of one process in the memory of another process. The rating also increases if a process tries to access password-protected files, or tries to start a service whose name matches the name of a system process, or tries to start a service with the name of an antivirus process. Attempts by the process to scan network resources, add network resources, request system privileges or gain access to the system core can also increase the rating.

At step 110, the system continues to monitor the process for malicious behavior. If the system still detects suspicious behavior in step 112, then it automatically updates the process rating R in step 116.

At step 118, if the hazard rating of the process R is greater than 50%, then the process is considered “suspicious” or “predominantly dangerous”. In this case, the system warns the user at step 120 and continues the process at step 114 if the user has not taken action to stop this process.

If the hazard rating R is greater than 75% in step 112, then the process is considered “dangerous”, which proves that the process is malicious. In this case, at step 124, the execution of the process is blocked and then ends at step 126. At step 128, the user is notified of the problem. The system may try to cure the process in step 130, and if it does, then the system allows the process to continue in step 114. The process can be cured, for example, if the damaged section of code is downloaded again from the Internet and replaced or the file is restored from the trusted copy, and then restart the process.

After the process stops in step 128, the system may begin to repair the damaged file. If the damaged file is a component of the system or is a useful file (for example, Microsoft Word or Microsoft Excel may be useful files) in step 132, then the system may try to repair the file in step 134, in the same way as the treatment of the process was described, and the file will be executed continued at step 114. However, if the damaged file is an independent executable file, then the system, after an unsuccessful attempt to disinfect, quarantines or deletes the file at step 136 and continues to monitor the processes for malicious activity at step 110.

Figure 2 shows a system for calculating a hazard rating for processes. The memory 22 contains various processes of a computer system. Each process is characterized by many attributes that are compared with a list of factors 202a and a list of weights 202b in the hazard rating module 202, and after that a certain hazard rating is assigned to the process. In one embodiment, the hazard rating module 202 may be a standalone device that also includes its own processor and memory. In this case, a stack of processes, a list of rules and weights are stored in memory. Also, in one implementation option, the module for calculating the hazard rating additionally includes access groups 202c and a list of access restrictions 202g. In more detail about the restriction of access rights to resources will be discussed in figure 3 and 4.

Updates about the status of processes and changes in weights and rules (for example, after correction by the user) are provided to the device by the anti-virus application 204. In order to ensure stable operation of the common system, it is possible to implement an encrypted connection between the anti-virus application 204 and the hazard rating calculation module 202. The system using antivirus program 204, assigns an initial hazard rating to S process. The control program 212 checks the process for malicious behavior. In one embodiment, the control program can be integrated into the anti-virus program 204. If the control program 212 detects a process that performs suspicious actions, the system updates the hazard rating of the process to R, again comparing the process attributes with the list of factors 202a and the list of weights 202b stored on drive 202. If R is greater than 50%, the system will display a message to user 212 and continue the process on processor 21. If R is greater than 75%, then antivirus program 204 will determine it as dangerous, which will cause There is a greater likelihood of finding malicious behavior (malicious behavior patterns are stored in database 206) in the process under study. The system blocks the detected malicious action and stops and / or blocks the access of the process to computer resources, such as memory, disk, network card, etc. The system, using anti-virus program 204, will try, if possible, to cure the process by downloading clean code via the Internet 208 from server 210 or restore the file from a trusted backup and restart the process. The system will also try to cure the detected malicious file in the same way as the process in order to continue the program. The specialist of the current level of technology should be clear that all percentages given are examples and may vary depending on implementation.

The hazard rating may be increased depending on the properties of the process system calls. For example, a property of a system call may be the number of system calls made by a process. Another example is the name of one of the system services or the name of a registry key. Names of critical system objects, names of system services, names of anti-virus objects, etc. can be grouped, and most system calls can relate to these groups. Similar groups may be stored as access groups 202c. Thus, if a process makes a system call with parameters satisfying these groups, the process rating will increase.

That is, a process can approach a group in which there will be processes that have the same permissions for certain actions. If the process performs an action that is allowed for another group, but not for its group, then this attempt will be blocked and the process will be upgraded. Examples of such actions are access to a local network, access to the Internet, access to files, to the system registry, and actions to obtain privileges of the kernel of the operating system.

As shown in FIG. 3, a rating can be scored within each group. Each group presents that list of factors 202a that affects a particular resource, such as network access or the Internet. Thus, each process, as it works, can gain not one overall rating, but several at once, one for each group. For example, a process can work intensively with files, gaining a high rating for a group specifically with the file system.

Currently, malicious programs often have a distributed structure, having a composition of several parts. For example, many malware downloaders only download the rest of the malware without causing any other harm. At the same time, other parts may have strictly directed functionality that cannot be completely considered harmful.

Figure 4 shows that for each group there are restrictions on access to the resources of another group, which can be saved as data in the list of access restrictions 202g. For example, for a file system group, access to the resources of a network (Internet) group may be restricted, or even completely prohibited, and vice versa. At the same time, the file system group may have limited access to the resources of the registry group, which will allow legal programs to perform their own installation. At the same time, unknown malware will not be able to harm the computer, because in the case of the same bootloaders, they will simply be denied access to the resources of the file system group and they will not be able to write downloaded files to specific folders. The mechanism for restricting access to the resources of another group can be performed using the anti-virus application 204, which also acts as a means of protecting the computer from various threats.

In conclusion, it should be noted that the information provided in the description are only examples that do not limit the scope of the present utility model defined by the formula. The person skilled in the art will understand that there may be other options for implementing this utility model, consistent with the nature and scope of this utility model.

Claims (15)

1. A system for restricting access rights to resources, which includes: a processor that executes a file process running in memory from executable files; memory, which contains the processes of files executable on the processor, and from which the means of protection and restriction of access rights to resources reads information about the processes; means for storing risk factors that correspond to certain access and weight groups, while means for storing risk factors are associated with means for storing multiple weights and means of protecting and restricting access rights to resources, while means for storing risk factors are designed to store risk factors that are used when calculating a process hazard rating; means for storing a plurality of scales, which is intended for storing a plurality of scales affixed according to the respective risk factors; means for storing data about access groups, which is designed to determine access to certain resources of a computer system, wherein means for storing access groups is associated with means for storing risk factors and means for storing restrictions for access groups; means for storing data on restrictions for access groups to resources of a computer system to which certain access groups correspond, wherein means for storing data on restrictions for access groups is intended to determine access restrictions to resources of a computer system; a means of protecting and restricting access rights to resources designed to initialize a hazard rating for processes in a computer system based on risk analysis by comparing the attributes of the executable file from which the process was launched in the computer system with factors and corresponding risk weights for compiling a statistical rating; at the same time, the means of protecting and restricting access rights to resources continues to monitor processes for detecting suspicious actions and updating the process danger rating in relation to a specific access group if it tries to perform an action that relates to the corresponding risk factors to compile a dynamic rating; wherein the means of protecting and restricting access rights to resources blocks the access of the process to those resources of the computer system that are on the set of restrictions of a certain access group to the resources of the computer system that are associated with access groups. 2. The system according to claim 1, in which the means of protection and restriction of access rights to resources detects an attempt to launch an executable file. 3. The system according to claim 1, in which the means of protection and restriction of access rights to resources is intended to transmit information about the executable files that are executed to the storage medium for risk factors. 4. The system according to claim 1, in which the means of protection and restriction of access rights to resources is intended to update the hazard rating if the process tries to conduct suspicious actions. 5. The system according to claim 4, in which the means of protection and restriction of access rights to resources is intended to alert the user if the updated hazard rating reaches the first threshold. 6. The system according to claim 4, in which the means of protection and restriction of access rights to resources is intended to block the access of a process to resources of a computer system if the updated hazard rating reaches a second threshold. 7. The system according to claim 1, in which the means of protection and restriction of access rights to resources is intended for the treatment of the process and, if successful, allows its further implementation. 8. The system according to claim 1, in which the means of protection and restriction of access rights to resources is intended to delete a file if the damaged file is independent, namely, an executable file that is not important for the operation of the system. 9. The system according to claim 1, in which the means of protection and restriction of access rights to resources is intended to quarantine the file if the damaged file is independent, namely, an executable file that is not important for the operation of the system. 10. The system according to claim 1, in which the means of protection and restriction of access rights to resources is intended to treat a file if the damaged file is independent, namely, an executable file that is not important for the operation of the system. 11. The system according to claim 1, in which the static hazard rating is based on the statistical properties of the file, such as file name, file size, file location, file structure, digital signature, file compression settings, and whether the file was downloaded from CD ROM or from the Internet. 12. The system of claim 1, wherein the dynamic hazard rating is based on the results of the emulation process. 13. The system according to claim 1, in which the means of protection and restriction of access rights to resources is an antivirus application. 14. The system according to claim 1, in which the suspicious action is at least one of the following actions: whether the process is trying to write to the memory of other processes; whether the process is trying to access protected archive files; whether the process is trying to start the service with a name that matches the name of the system process; Whether the process is trying to start the service with a name that matches the name of the anti-virus process; whether the process is trying to hijack or remove a system service; Whether the process is trying to hijack or remove the anti-virus service; whether the process is trying to change data in the registry; whether the process is trying to scan network resources; whether the process is trying to add a network resource; whether the process is trying to request system privileges; whether the process is trying to access the system core; as well as the properties of system calls made by a process. 15. The system according to claim 1, in which the resources for access groups can be the following resources of a computer system: access to a local network; Internet access file access; access to the registry; actions with passwords; Actions requiring system privileges and actions that require operating system kernel privileges.