RU2430411C1 - System and method of detecting malware - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: system employs a data processing apparatus designed to process programs found by a program search tool, and connected to an analyst workstation, which includes: apparatus for checking whether programs found by the search tool belong to a black or white list of programs; apparatus for emulating program code not associated with the black or white list; apparatus for tracking events occurring when executing a program during emulation; and an analyst workstation capable of emulating the program code, processing data, furnishing information, receive physiological reactions of the analyst and classify information.

EFFECT: detection of malware which cannot be classified by existing standard technologies.

15 cl, 5 dwg

Description

Technical field

The invention relates to computer systems, and more particularly to malware detection systems by analyzing the events of an executable program.

State of the art

Computer malware, such as viruses, computer worms, and trojans, is currently one of the most important computer security issues. It has been estimated that tens of billions of dollars in annual financial loss to businesses from malware. To counter the growing number of malware, a large number of anti-virus technologies have been developed. Most detection technologies consist in analyzing program code and comparing its parts to a set of parts of known malicious code contained in anti-virus databases. If a similarity between the program code and the malicious fragment is found, the program code is marked as malicious.

Another well-known malware detection approach is heuristic analysis of program code. Heuristic analysis is a technology based on the analysis of the behavior of a program emulated in a secure computer environment, for example, in a virtual operating system. The behavior of the emulated program is analyzed for frequently encountered malicious actions, such as duplication, overwriting and attempts to hide the presence of suspicious or potentially dangerous files. If such malicious actions are present, then the program is marked as malicious.

However, these technologies may not work or lead to incorrect results if the malicious part of the program code is not present in the anti-virus databases or the code contains hidden and non-obvious malicious behavior. In these cases, the hidden code can be sent to the analyst to review and decide on the harmfulness of the program. The process of viewing by the analyst gives accurate results, but it takes time and is not effective from this point of view.

Analysis of the prior art allows us to conclude about the inefficiency and, in some cases, the impossibility of using previous technologies, the disadvantages of which are solved by the present invention, namely, a malware detection system.

Disclosure of invention

The present invention is intended to detect malicious software, in particular malicious programs that are not classifiable due to the disadvantages of existing methods for detecting malicious software.

The technical result of the present invention is to identify malicious software that is not amenable to classification by standard known technologies.

The malware detection system comprises a software search tool, a data processing tool for the programs found, and an analytics workstation associated with the data processing tool. A malware detection system comprises: a software search tool for searching for programs on the Internet associated with a data processing tool; data processing tool designed to process the programs found by the program search tool and associated with the analytics workstation, including: a repository of malware and legitimate software data containing black lists, white lists, examples of program behavior, examples of malicious and legitimately used programs designed to system calibration; means for verifying that the programs found by the search tool belong to the black or white list of programs; means for emulating code of programs not related to the black or white list; means for tracking events that are called during program execution during emulation; a means of classifying events monitored during emulation into malicious and non-malicious; a means of collecting information about events that are not amenable to classification; and an analytics workstation associated with the data processing means, including: means for isolating the analyst from external audio and video irritants; analytics workstation calibration device, which forms the analyst’s calibration profile based on examples of malicious and legally used programs stored in the data warehouse; an output device for providing a list of non-categorized events and additional information about these events to the analyst; an input device consisting of at least one sensor; and an analyzer designed to detect malware taking into account data parameters received by the input device and data of the analyst’s calibration profile.

In a particular embodiment of the system, isolation means refers to a video device mounted on the analyst’s head and headphones.

In a particular embodiment of the system, the video device may be video glasses or a video helmet.

In a particular embodiment of the system, the input device may include: a button device sensitive to finger movements; pressure sensor sensitive to finger movements; video camera tracking analyst’s eye movements; an audio sensor for detecting and analyzing voice commands; electric sensor for tracking bio signals of the analyst.

In a particular embodiment of the system, additional information about events includes: the frequency of occurrence of non-classification events during program emulation and the frequency of occurrence of non-classification events in a known malicious program.

In a particular embodiment of the system, the list of non-classifiable events does not include duplicate events.

In a private embodiment of the system, the analyst’s calibration profile contains tables of correspondence between the parameters of the input device and malicious or legitimate software.

A method for detecting malicious software consists of: generating an analyst’s calibration profile based on examples of known malicious and legally used programs; search for new programs on the Internet; comparing the programs found with the black and white list of programs; emulation of program code execution; tracking program execution events; classifying events as malicious or non-malicious; collecting information on events that are not amenable to classification; providing a list of unclassifiable events to the analyst through the video device; transformations of the analyst’s psychological reactions to the information provided to him; and determining malicious events from a list of non-categorized events based on the received data of the analyst’s psychological reactions.

In a particular embodiment of the method, event tracking includes at least one or more software system calls and one or more system responses to the call.

In a particular embodiment of the method, the classification of events consists in comparing the events obtained as a result of emulating a program code with event samples associated with malicious programs.

In a particular embodiment of the method, information about events that cannot be classified includes: the frequency of occurrence of events that cannot be classified during the program emulation; and the incidence of unclassifiable events in a known malware.

In a particular embodiment of the method, the list of non-categorized events does not include duplicate events.

In a particular embodiment of the method, the video device may be video glasses or a video helmet.

In a particular embodiment of the method, psychological reactions are recognized by: a push-button device sensitive to finger movements; pressure sensor sensitive to finger movements; analyst eye tracking video camera; an audio sensor for detecting and analyzing voice commands; An electric sensor for tracking biosignals analyst.

A machine-readable medium for controlling access to a storage device on which a computer program is stored, during which the following steps are performed on a computer: search for new programs on the Internet; emulation of program code execution; tracking of program execution events; classification of events; collection of information about events that are not amenable to classification; Providing a list of non-categorizable analytics events through the video device tracking the analyst’s psychological reactions to the information provided to him; and determining malicious events from a list of non-categorizable events based on the received data of the analyst’s psychological reactions.

Brief Description of the Drawings

Additional objectives, features and advantages of the present invention will be apparent from reading the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

Figure 1 shows an example architecture of a malware detection system.

Figure 2 shows an example of another approach for implementing the malware detection system architecture.

Figure 3 shows an example of a system interface presented to an analyst.

Figa and B show the operation of the system for detecting malicious software.

Description of Embodiments

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than the specific details provided to assist the specialist in the field of technology in a comprehensive understanding of the invention, and the present invention is defined only in the scope of the attached claims.

Figure 1 shows an example architecture of a malware detection system. System 100 includes data processing means 105 capable of emulating, analyzing, and classifying various computer objects. The system further includes a data warehouse 110 connected to the data processing means 105. The data warehouse contains information about known malicious software, such as viruses, trojans, computer worms, and other unwanted and harmful software. System 100 further includes one or more analyst workstations 115 connected to data processing means 105. Using workstations, analysts, such as viral analysts, are capable of analyzing classifiable events that occur during program execution. Workstations 115 are tuned to optimize the performance of analysts in examining non-categorized events and presenting the results to a data processing tool 105.

The data processor 105 may consist of one or more servers. A system may have one or more processors 125, such as an Intel Quad-Core ^® or AMD ™ Turon 64, and run one or more operating systems 135, such as Windows ^® , Unix ^® , Mac ^® OS, and other types of operating systems. The tool 105 may have one or more hard disk drives, flash memory, random access memory or other types of storage devices 130 for storing the operating system, data and various software resources necessary for the operation of data processing means 105. The system may also have a network an interface 140, such as Ethernet, for access to the Internet or other local or widespread networks, as well as various serial and parallel input and output ports 145 for of the connections of peripherals. Also, the data processing means 105 may include additional hardware or software components.

The data processor 105 may be configured to run the malware detection application 150. As shown in FIG. 2, the malware detection application 150 may use the search tools 205, the emulation tool 210, the event detector 215, and the event analyzer 220. The emulation tool 210 may include a system emulator 225 and a software emulator 230. The malware detection application 150 can be run on one or several application servers.

In a particular example of a system implementation, a malware detection application may include search tools 205, such as Google ^® , Yahoo ^® , Yandex ^®, or its own search engine. The search tool is designed to find new applications, programs and other types of software on the Internet and other networks, for further analysis of malicious code. As one of the options for implementing the system, all found programs can be compared with programs from the white list of programs 160 stored in the data warehouse 110. The white list 160 contains a list of software that has been previously verified and classified without malicious code or legitimate. If the program cannot be found in the white list, it is passed to emulator 210 for analysis for malicious software. Another approach is to compare all new objects with the black list of programs 165, also listed in the data warehouse 110. The black list contains a list of previously classified malicious objects. Analysis and classification of an object is not performed if the object is blacklisted.

The malware detection application 150 may include an emulation tool 210 capable of emulating objects in order to detect malicious behavior of an object under investigation. To this end, emulator 210 includes a system emulator and software emulator 230. The system emulator is designed to emulate one or more components of a computer system in an isolated protected computer environment of the data processing means 105. For example, part of the system memory 130 can be used to create such an isolated protected environment for emulation of the execution of objects. System emulator 225 may emulate several components of a computer system, including a central processor 235, emulated BIOS 240 and an operating system 245, which may also include emulated application programming interfaces 250, such as Win32 or, for example, emulated file system 255, system registry 260, scheduler streams 265 and other necessary system components. System emulator 225 is capable of accepting various system settings depending on the requirements of program 270 emulated by software emulator 230.

The emulator 210 may include a software emulator 230 capable of executing one or more programs 270 in an isolated secure environment of the data processing means 105 using a system emulator 225. To organize the emulation of a program 270, a program emulator 230 is capable of loading a program 270 from system memory 130 or from any other a local or remote source to an area of a random access storage device 130 located in an isolated secure computer environment. Before emulation, program emulator 230 may run a scan of program 270 to verify that system emulator 225 has all the necessary resources to conduct program emulation. A software emulator is also capable of unpacking archived programs 270 and performing additional necessary operations. Further, software emulator 230 may read instructions, such as 1 through N, and emulate them using system emulator 225.

In a particular embodiment of the system, system emulator 225 may be configured to emulate one or more executable components of a computer program 270. Various executable components may include both the programs themselves and various copies of programs that may be created during program emulation. Executable components may include routines of program 270 operating in a semi-independent mode from the program, and create some tasks that may vary, but relate to program 270. Executable components may also include connected or disconnected programs, applications, or files that are called by the program during its execution . For example, the program 270 may cause Internet Explorer ^® to connect and download a file from the internet or activate Microsoft Outlook ^® to obtain some information. Executable components may also include dynamically linked libraries (DLLs) used by the program, such as the Windows DLL and others.

There are several approaches for executing program components 270 using emulation tool 210. For example, components can be executed as the main process of program 270, as various child processes from the main process, and as child processes from the child process and so on. A computer process can be defined as a stage in the execution of program 270. A child process, in turn, is a process created by another process. In the case of another example, the executable components of program 270 may be executed in one or more threads, including one or more remote threads. Various executable components of program 270 may be executed alternately and / or in parallel with each other. To enable parallel execution, which typically increases the speed of program emulation, system emulator 225 is able to emulate a multitask computer architecture, including a multitask emulated central processor 235 and a multitask emulated operating system 245, which supports parallel processing of various processes and program execution threads 270.

In a private embodiment, the malware detection application 150 includes an event detector 215, which facilitates the detection of events obtained by emulating the program 270 and its various executable components. Examples of events that can be detected by the event detector 215 are, but are not limited to, the following list: a computer program that creates a copy of itself; a computer program that creates a new file; a new file that copies itself to the system directory; a computer program that creates a new key in the system registry, modifies the registry, and others. It should be noted that the event detector 215 detects not only events with obvious malicious behavior, but also malicious events created by non-malicious programs that do no harm to the data processor 105. After the detected events are sent in real time for further processing to the event analyzer 220.

In a particular embodiment of the system, the event analyzer 220 has the ability to compare the received event data with examples of malware behavior 170 and to classify the emulated program with respect to its harmfulness. An example of the behavior of a malicious program 170 may include one or more events related to a malware group. The event analyzer can resort to event analysis as soon as the event is generated by the emulation tool 210. Also, the analysis can be started only after the emulation of the program is completed. Also, if one or more events is detected, the event analyzer can classify these events as malicious and instruct the emulator to terminate the software emulation. In the event that the created events do not contain malicious behavior-like elements, the event analyzer 220 can classify the event as non-malicious and stop the software emulation. If the event analyzer 220 cannot accurately classify the generated event, it refers to unclassifiable events.

Unclassifiable events can be provided to the analyst for further analysis through workstations 115. The analyst is a person with extensive accumulated expertise in the field of malware detection. The analyst promotes the malware detection application 150 in cases where the application cannot accurately decide whether an object belongs to a group of malicious or, on the contrary, non-malicious objects. Unclassifiable events, in addition to events caused by trust programs, but containing elements of potentially harmful content, may include new types of computer viruses, worms, trojans, spyware and malicious programs with previously unknown behaviors.

To enable analysts to efficiently analyze events that are not amenable to automatic classification, data processor 105 is capable of extracting and converting information related to events. For example, the system is able to remove all duplicate events from the program code and display the number of repetitions of the event during program execution. This helps organize information in a more readable format, such as a list of all events that are not amenable to automatic classification, together with information about each event, such as various function arguments and more. The system can also display the current program code that triggers the events in question. There are also many ways of formatting and presenting information about events to an analyst, for example, information can be visualized using various font, size, and color of letters when outputting information to an analyst workstation 115.

The data processing tool is able to provide the analyst with a variety of information regarding events that cannot be classified. Such information may include, but is not limited to, a list of examples of malware behavior 170 that have the most similar behavior to the described events, information about classes of functions, objects, or programs associated with an unclassifiable event. The data processing tool can also provide various statistical information about non-classification events, such as the frequency of occurrence of non-classification events in the program code, in known malicious software, including the type of program, and / or in legitimate software, including the type of program.

Figure 3 shows an exemplary system interface with the display of information about not classifiable events. The information provided may include one or more unclassifiable events 310, such as API function calls invoked by an emulated program, such as API: WriteFile, and call arguments: ARG1, ARG2, ARGN. Reference information 330 may also be displayed, such as, for example, the argument ARG1 was found on the link “Full name of critical system objects”, and also that the event was identified with the behavior of the example of the behavior “Opening host object”. Statistical information 340 may also be included, for example, demonstrating that an unclassifiable event was found 3217 times in the black list of programs and never in the white list. The described interface is just one example of the implementation of an interface that provides information to the analyst.

As the event-related information is completed, the analyst will be able to classify the events as malicious, non-malicious, and non-categorical. Events that cannot be classified can be automatically sent to other analysts in real time for review and subsequent classification. As an alternative approach, classifiable events can be temporarily placed in the data warehouse by the system and provided to the same analyst after some time.

In a particular example of a system implementation, the data processor 105 can be configured to separate classifiable events between analysts based on specialization, workload, and other parameters. For example, if a malware detection application 150 attributes a type of Trojan to the behavior of an unclassifiable event, the system can send the event to an analyst specializing in Trojan programs. Another example may be the situation when the first analyst is in the queue for processing 500 events, and the second is 1000, then the system will send the less loaded analyst, the first, to process the event. The system can also periodically send classified events to the same analysts for reconsideration to increase the accuracy and accuracy of the analysis.

System 100 includes one or more analyst workstations 115. Workstations may be computer terminals having a processor, memory, network interfaces for connecting to data processing means 105 over a local area network, such as Ethernet. Each workstation may also include a video output device capable of providing the analyst with information about unclassifiable events. The analyst workstation may also include information input devices capable of receiving the physiological reactions of the analyst, indicating that the events are malicious or legitimate. Workstations can be separated from each other and isolated from external stimuli. To achieve this goal, a video helmet or video glasses can be used. These devices must be capable of displaying, for example, pictures with a resolution of 640 × 480 with information about the event, as shown in Fig.3. This type of video device isolates analytics from external visual stimuli. Analysts can also be provided with headphones or earplugs to block external sounds and other audio irritants. These insulating agents increase the efficiency of analysts.

In order to prevent false alarms and configure the system for various analysts, workstation 115 includes a calibration device that generates a calibration profile for the analyst based on examples of known malicious and legally used programs 180 stored in the data warehouse. The analyst’s calibration profile contains tables that match the parameters of the input device with malicious or legitimate software.

Analytics Workstation 115 contains an analyzer designed to detect malware taking into account data parameters received by the input device and data from the analytic workstation calibration device.

The input device of the workstation 115 may be tuned to increase the decision-making efficiency of the analyst. For example, the input device may include a button device or a pressure sensor sensitive to finger movements. If the device is single-button, then a single click can mean that the event is malicious, double - the event is not malicious, triple - the event can not be classified. You can also apply many other different ways of recording events.

As an alternative approach, other methods of recording psychological reactions to program information can be used. For example, you can use a voice command sensor or a camera that records analyst’s eye movements, the expansion of the pupils of which may indicate harmfulness or legitimacy of the program code. The system can be adapted individually for each analyst, thereby it can determine the reaction of the analyst with great accuracy. Various analytic biosignal sensors may also be used. Such devices may include sensors for detecting a skin galvanic reaction (GSR), an electroencephalogram detection system (EEG) that records the analyst’s brain activity, and an electrocardiogram system (ECG) to monitor the heart rate. The above and similar systems can be used to determine whether an event belongs to a class of malware.

Figure 4 shows an example implementation of a method for detecting malware using the described system. The first step is to calibrate the Analyst 401 workstation to compile a table of correspondence between the parameters of the input device and malicious or legitimate software. At step 405, the data processing system searches the Internet for new programs and applications. For each program encountered, the system checks in its database whether the program belongs to the white list, step 410, or to the black list, step 415. If the program appears in one of the lists, it is discarded. If the program was not found in the black or white list, the data processing system activates the emulation tool, step 420. The emulation tool loads the program into an isolated computer environment, step 425, and emulates the program using system and software emulators, step 430. Events that occur as a result of the program’s execution, they are recorded and compared with the malware behavior patterns as indicated earlier, at step 435. Based on the results of this analysis, the program is classified by the data processing system as in edonosnaya not malicious or unclassifiable.

If the program is classified as malicious, step 440, it is added to the black list of programs, step 445. If the program is classified as not malicious, it is added to the white list of programs, step 450, and the emulation of the program stops. If the data processing system determines that the program cannot be classified, the system collects all possible information about the events, step 455, converts it and sends the analytics to the workstation, step 460. Information about the event is provided to the analyst by means of a video device attached to the analyst’s head , for example, video glasses or a video helmet, step 465. Next, the system determines the analyst’s psychological reactions to the information provided, reactions indicate that the event belongs to malicious or non-malicious taking into account the data of the analyst’s calibration profile, step 470. If the event is classified as malicious, step 480, the program is added to the black list of programs, step 485. If the program is classified as not malicious, it is added to the white list of programs, step 490, the program emulation is terminated. If it is not possible to determine whether the program belongs to a particular class, the event information is sent to another analyst, step 495, or other actions can be applied.

It should be noted that the emulation-based processing technologies described above can be implemented with alternative approaches. For example, a data processing system can be configured to execute programs directly in real time, that is, without emulating system resources, such as a central processor 125, memory 130, and others. After the execution of the program is completed, the resources used by the malware detection application can be returned to their original state, and the program execution data can be deleted.

The stated system and method have high efficiency and accuracy of analysis of known and unknown software and applications. Analysts isolated from external audio and video irritators are equipped with convenient input devices. Provided events can be instantly analyzed. The system is able to classify about 3000 events per hour. The analyst’s work has become automatic, often reflective. Moreover, since recurring events are not provided to the analyst, event classification is applied to all events. This means that if event A is repeated 2572 times, then the classification of one of 2572 events entails the classification of all events in this group.

In accordance with the description, components, execution steps, data structure described above can be performed using various types of operating systems, computer platforms, programs.

In conclusion, it should be noted that the information provided in the description are only examples that do not limit the scope of the present invention defined by the claims. One skilled in the art will recognize that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

Claims (15)

1. The malware detection system contains:
program search tool for searching programs on the Internet associated with a data processing means;
data processing means designed to process the programs found by the program search tool and associated with the analytics workstation, including:
a repository of data on malicious and legitimate software containing black lists, white lists, examples of program behavior, examples of malicious and legitimately used programs designed to calibrate the system;
means for verifying that the programs found by the search tool belong to the black or white list of programs;
means for emulating code of programs not related to the black or white list;
means for tracking events that are called during program execution during emulation;
a means of classifying events monitored during emulation into malicious and non-malicious;
a means of collecting information about events that are not amenable to classification; and
analytics workstation associated with a data processing tool, including:
means for isolating the analyst from external audio and video irritators;
analytic workstation calibration device designed to generate the analyst’s calibration profile based on examples of known malicious and legally used programs stored in the data warehouse in order to prevent false positives and configure the system for various analysts;
an output device for providing a list of non-categorized events and additional information about these events to the analyst;
an input device consisting of at least one sensor; and an analyzer designed to detect malicious software, taking into account the parameters of the data received by the input device and the data of the calibration device of the analyst workstation. 2. The system according to claim 1, in which the means of isolation means a video device, mounted on the head of the analyst, and headphones. 3. The system of claim 2, wherein the video device may be video glasses or a video helmet. 4. The system according to claim 1, in which the input device may include:
a button device that is sensitive to finger movements;
pressure sensor sensitive to finger movements;
video camera tracking analyst’s eye movements;
an audio sensor for detecting and analyzing voice commands;
electric sensor for tracking bio signals of the analyst. 5. The system according to claim 1, in which additional information about the events includes:
the frequency of occurrence of unclassifiable events during program emulation; and
the frequency of occurrence of unclassifiable events in a known malicious program. 6. The system of claim 1, wherein the list of non-categorized events does not include duplicate events. 7. The system according to claim 1, in which the analytics calibration profile contains tables of correspondence between the parameters of the input device and malicious or legitimate software. 8. The malware detection method consists of:
the formation of the analyst’s calibration profile based on examples of known malicious and legally used programs;
search for new programs on the Internet;
comparing the programs found with the black and white list of programs;
emulation of program code execution;
tracking program execution events;
classifying events as malicious or non-malicious;
collecting information on events that are not amenable to classification;
providing a list of unclassifiable events to the analyst through the video device;
transformations of the analyst’s psychological reactions to the information provided to him; and
determination of malicious events from the list of non-malleable events based on the received data of the analyst’s psychological reactions. 9. The method of claim 8, wherein the event tracking includes at least one or more software system calls and one or more system responses to the call. 10. The method according to claim 8, in which the classification of events consists in comparing the events obtained as a result of emulation of the program code with the samples of events associated with malicious programs. 11. The method according to claim 8, in which information about not classifiable events includes:
the frequency of occurrence of unclassifiable events during program emulation; and
the frequency of occurrence of unclassifiable events in a known malicious program. 12. The method of claim 8, wherein the list of non-categorized events does not include duplicate events. 13. The method of claim 8, wherein the video device may be video glasses or a video helmet. 14. The method of claim 8, in which psychological reactions are recognized using:
a button device that is sensitive to finger movements; pressure sensor sensitive to finger movements; analyst eye tracking video camera; an audio sensor for detecting and analyzing voice commands; An electric sensor for tracking biosignals analyst. 15. Machine-readable medium for controlling access to a storage device on which a computer program is stored, during which the following steps are performed on a computer:
emulation of program code execution;
tracking of program execution events;
classification of events;
collection of information about events that are not amenable to classification;
Providing a list of non-categorizable analytics events through the video device
tracking the analyst’s psychological reactions to the information provided to him; and
determination of malicious events from the list of non-malleable events based on the received data of the analyst’s psychological reactions.

Images