RU2602372C2 - System and method for distributed detection of malicious objects - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: invention relates to computer security. Method, which comprises analysing by means of a first security client objects in order to detect a malicious object; collecting by means of first security client object information during analysis; selecting by first security client a second client from at least two security clients to participate in interaction with first security client; wherein selection of second security client is carried out based on geographic mutual arrangement of security clients, communication channel capacity between security clients, query results, previously processed by other security clients; analysing by second security client an object in order to detect a malicious object; eliminating by means of first security client on a computing device malicious object by means of eliminating malicious object obtained from side of second client.

EFFECT: technical result is improved security of computing device.

2 cl, 6 dwg

Description

Technical field

The invention relates to the field of protection against computer threats, and in particular to systems and methods for the distributed detection of malicious objects.

State of the art

Currently, along with the widespread adoption of computers and similar devices, such as mobile phones, there is an increase in the number of computer threats. In general, computer threats mean objects that can cause any harm to a computer or a computer user, for example, network worms, keyloggers, computer viruses.

To protect the user and his personal computer from possible computer threats, various anti-virus technologies are used. The anti-virus software includes various computer threat detection modules. Special cases of such modules are signature and heuristic detection modules. Also, anti-virus software may contain tools to eliminate both malicious objects and the consequences of their presence. There may be situations when the detection modules are not effective - each of the mentioned detection methods, as a rule, requires the presence of signature databases or rules for heuristic detection, which are distributed using the servers intended for this. And often anti-virus software may not have a set of relevant databases for the used detection modules for a number of reasons, for example, due to a lack of connection with servers that have been distributing database updates for a long time.

There are solutions aimed at solving this problem, for example, in the patent US 7716660 B2 describes a system of software updates, which involves downloading parts of the update from other computers on the network other than the server. The classic scheme of the BitTorrent networks is described.

However, the above approach has a drawback. The reaction rate to infection with a malicious computer object can be quite high, which will entail harm to the computer and the data stored on them.

The present invention allows to more effectively solve the problem of distributed detection of malicious objects.

Disclosure of invention

The present invention is intended to detect malicious software.

The technical result of the present invention is to increase the security of a computing device, which is achieved by eliminating a malicious object using a security client on a computing device.

A distributed malware detection method in which objects are analyzed using a first security client to detect a malicious object; using the first security client, collect information about the object during the analysis; requesting, with the help of the first security client, an analysis of the object by the second security client using the previously collected information about the object if, at the stage of analysis carried out by the first security client, it was not possible to detect a malicious object; using the second security client, analyze the object in order to detect a malicious object; using the second security client, transmit the results of the analysis performed by the said security client, as well as at least one means for eliminating the malicious object, if a malicious object was detected at the analysis stage, to the first security client; eliminate the malicious object using the first security client on the computing device using the means for eliminating the malicious object received from the second client.

In the particular case of implementing the method, at least a file, a process, a portion of the RAM of a computing device acts as an object.

In another particular case of the method, the collection of information about the object includes the calculation of the checksums of the objects and their parts, the formation of a call log of system functions when executing the program code of the object both using emulation of execution and during execution on a computing device, determining the process, created and launched the execution of the object, determining the processes started by the object, determining the network address from which the object was downloaded, determining the network addresses to which access is made from the side of the object at runtime, defining the areas of memory that are accessed from the side of the gate at runtime.

In another particular case of implementing the method, the second security client participating in the interaction with the first security client is a security client selected based on at least the geographical location of the security clients, the bandwidth of the communication channel between the security clients, the results of requests previously processed by other security clients when help first security client.

In another particular case of the implementation of the method, elimination of malicious objects on the computing device further includes eliminating the consequences of the presence of said objects on the computing device

Brief Description of the Drawings

Additional objectives, features and advantages of the present invention will be apparent from reading the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

FIG. 1 illustrates an interaction diagram of a plurality of computing devices.

FIG. 2 shows a detailed diagram of one embodiment of a security client.

FIG. 3 shows a diagram of one embodiment of a distributed malware detection system.

FIG. 4 illustrates a diagram of yet another embodiment of a distributed malware detection system.

FIG. 5 shows a diagram of an embodiment of one of the operation algorithms of a distributed malware detection system.

FIG. 6 illustrates an example of a general purpose computer system.

Although the invention may have various modifications and alternative forms, the characteristic features shown by way of example in the drawings will be described in detail. It should be understood, however, that the purpose of the description is not to limit the invention to its specific embodiment. On the contrary, the purpose of the description is to cover all changes, modifications that are included in the scope of this invention, as defined by the attached formula.

Description of Embodiments

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than the specific details necessary to assist the specialist in the field of technology in a comprehensive understanding of the invention, and the present invention is defined in the scope of the attached claims.

FIG. 1 illustrates an interaction scheme of a plurality of computing devices 110. Computing device 110 can generally be a personal computer, a mobile computing device (eg, a smartphone), a laptop, or several of these computing devices that are networked, for example, for performing distributed computing. A detailed diagram of a variant of the computing device will be shown in FIG. 6. A plurality of devices 110 are connected through a network for transmitting information 120. Through a network 120, computing devices 110 exchange information, transmit requests and corresponding responses. Network 120 may, in the particular case of implementation, be one subnet, and in another implementation case, network 120 is a collection of interconnected subnets. For data transmission in the network 120, at least data transmission technologies may be used: Ethernet, Wi-Fi, Bluetooth.

A security client is present on each of computing devices 110, a detailed diagram of which is shown in FIG. 2. In the particular case of implementation, the security client 200 may be anti-virus software. In the particular case of the implementation, the security client performs the functions of protecting the device 110 from malicious objects. In general, an object is understood to mean at least a file, a process, a portion of the RAM of a computing device. A malicious object is any object on a computing device (for example, a file, process, or memory area) that can cause any harm to a computing device, device user, or user data (for example, passwords for accessing mail, etc.), for example, a network a worm, keylogger, computer virus, as well as a link to the mentioned object.

Security client 200 includes a detection module 210 for analyzing the objects of device 110 to detect malicious objects on device 110. In the particular case of implementation, the detection module 210 includes a signature analysis module 211 for conducting signature analysis, a heuristic analysis module 212 for performing heuristic analysis of objects, a proactive defense module 213 and an emulator 214 for emulating the execution of objects. Under the emulation of the execution of objects in the particular case of the invention, the formation of a call log (API functions, function arguments, as well as the results of the execution of functions) is understood, while the computing device 110 does not execute the real instructions of the object. The proactive protection module 213 is designed to analyze the execution of objects on the device 110, namely the system call log during the execution of the instructions of the object on the real computing device 110. The instructions of the object mean the program code stored in the object, in the particular case of implementation, the machine code of the executable file. During the analysis of objects by the detection module 210, depending on which module is used to detect a malicious object (for example, signature analysis module 211 or module 212), information about the analyzed object is collected. Such information is collected by the information collection module 220. In the particular case of implementation, such information about the object includes:

- checksums of objects and their parts;

- a log of system calls of the object (both during emulation, and during the actual execution of instructions);

- source of the object: the process that created the object, as well as a link to the source of the object (URL when downloading from the network);

- parent process - the process that launched the execution of the instructions of the object, as well as the processes started by executing the instructions of the object;

- memory areas accessed by the object in both RAM and ROM;

- URL (Eng. Uniform Resource Locator, pointer to the address of the resource), by which the object was accessed;

- packers used to protect the facility.

In the particular case of implementation, the information collection module 220 uses the results of the operation of the modules included in the detection module, for example, the system call log generated by the emulator 214. Based on the information collected, the detection module 210 decides to detect a malicious object during the analysis. Communication module 230 is designed to exchange data with similar modules of other security clients (operating within other computing devices). The data that can be transmitted is the data operated by the security client 200, including the results of the analysis of objects carried out by the security module 210, information about objects collected by the information collection module 220. The malware removal module 240 is designed to eliminate malicious objects present on the computing device , for example, to delete files that are malicious objects. In the particular case of implementation, the elimination of malicious objects also includes the elimination of the consequences of the presence of the mentioned objects on the computing device, for example, changes made by the malicious object to the file system of the computer or to the registry of the operating system.

In addition to the above modules, the security client 200 also includes a database 250, which in a particular case contains information for detection 251. This information is used by the detection module 210 to analyze objects in order to detect malicious objects, for example, signatures for detecting malicious objects or heuristic rules . Database 250 also contains tools for eliminating malicious objects 252 on computing device 110. Tools 252 are a set of rules, scripts, and executable modules (for example, libraries or drivers) required by the module for eliminating malicious objects 240 to perform tasks to eliminate malicious objects . In the particular case of the implementation of tools for eliminating malicious objects 252, they store a set of the above rules, scripts, and executable modules in combination with the identifier of the malicious object (for example, a checksum or symbolic name). Having received the identifier of the malicious object (for example, from the detection module 210), the malware removal module 240 uses the necessary rules and scripts to eliminate the malicious object that correspond to the received identifier of the malicious object. In the particular case of implementation, the database 250 additionally stores information about the objects collected as part of the analysis of the objects, as well as the corresponding results of the analysis (whether the malicious object was detected or not according to the results of the analysis, within which information about the object was collected).

Security client 200 is able to add new information or change information available from database 250. In the particular case of implementation, security client 200 is able to change means to eliminate malicious objects 252 based on incoming data from, for example, a remote server or a person. In another particular case of implementation, the security client 200 itself generates new tools for eliminating malicious objects, for example, scripts. Such scenarios can be generated by the security client on the basis of information about the object generated during the analysis: the script for eliminating the malicious object is formed from sets of procedures, each of which corresponds to a system call from the log generated by the emulator 214. In another particular case, instead of the system log is implemented of calls generated by the emulator 214, the system call log generated by the proactive defense module 213 is used. In a particular case, the implementation for storing sets of procedure is used by the data base procedures, part of the security client 200 (not displayed in Fig. 2). This database also stores the correspondence of the sets of procedures to system calls, the consequences of which the mentioned set of procedures should eliminate. Thus, in the particular case of the implementation, the scenario for eliminating the malicious object is formed as a sequence of sets of procedures for eliminating the consequences of system calls of the object.

FIG. 3 shows a diagram of one embodiment of a distributed malware detection system. To refer to the entities in FIG. 3 (similarly to FIG. 4) the letters (a, b, ...) are used added to the numbering of the corresponding entities described in FIG. 1 and FIG. 2 to refer to the respective instances described in FIG. 1 and FIG. 2. For example, computing device 110a and security client 200a are one of the instances of computing device 110 and security client 200. This numbering is introduced to simplify the designation of the interaction of entities of different computing devices (“device a”, “device b”, etc.).

In one embodiment, it is contemplated to use at least two interconnected security clients 200, each of which operates on its computing device 110. On the computing device 110a, objects are analyzed using the security client 200a. As part of the analysis, the client 200a generates information about the object (the volume of the generated set of information described above). If the security client detects a malicious object at the analysis stage, appropriate measures are taken (using the malware removal module 240a).

If a malicious object cannot be detected, security client 200a sends a request to security client 200b to analyze the object in order to detect the malicious object. In the particular case of implementation, in order to carry out the aforementioned analysis by the security client 200b, the security client 200a transmits to it the previously collected object information. In another particular implementation, for the analysis by the security client 200b, the security client 200a passes the object to it. A security client 200b operating on computing device 110b, upon receipt of a request from the security client 200a, analyzes the object in order to detect a malicious object. In a particular implementation, this analysis involves the use of a detection module 210b in relation to the object information received from the security client 200a. In another particular embodiment, the security client 200b analyzes the object received from the security client 200a using the object itself (for example, a file). After the analysis requested by the security client 200a, the security client 200b passes the results of the corresponding analysis to the security client (whether or not a malicious object was detected). In the particular case of implementation, if the security client 200b detects a malicious object, the security client 200b, together with the analysis results, additionally sends funds to the security client 200a to eliminate the corresponding malicious object.

If the security client 200b detected a malicious object during the analysis and the corresponding analysis results were transferred to the security client 200a, then the security client 200a recognizes the object whose analysis was requested for security client 200b to be malicious. In the particular case of implementation, the security client 200a additionally eliminates the malicious object detected in this way. In the particular case of implementation, to eliminate the malicious object, the security client 200a uses the means to eliminate the malicious object obtained from the security client 200b on the computing device.

FIG. 4 illustrates a diagram of yet another embodiment of a distributed malware detection system. As part of another embodiment of the invention, a computing device 110a analyzes objects using a security client 200a. As part of the analysis, the client 200a generates information about the object (the volume of the generated set of information described above). If the security client detects a malicious object at the analysis stage, appropriate measures are taken (using the malware removal module 240a). Information collected during the analysis phase is also marked in accordance with the analysis results.

After performing the above operations, the security client 200a sends out to other security clients (for example, 200b and 200n) data that these security clients can use to detect malicious objects. In the particular case of implementation, the security client 200a transfers to the security client 200b the identifier of the analyzed object, the collected information about the object, the results of the analysis of the object, as well as means for eliminating malicious objects (if such tools are necessary and are available to the security client 200a). After receiving the mentioned data, the security client 200b uses this data to analyze objects (the obtained information about the object is used, as well as the results of the analysis of the object), as well as to eliminate malicious objects on the computing device (the obtained means are used to eliminate malicious objects on the computing device).

In the particular case of the invention, the security client 200b during the analysis of the object compares the collected information about the object with information about the objects that comes from the security client 200a. In the particular case of implementation, the security client 200b detects a malicious object as part of the analysis if the information about the malicious object received from the security client 200a matches the collected information about the analyzed object. In another particular implementation case, in order to detect a malicious object by the security client 200b in accordance with the above scheme, a partial match of the malicious object information received from the security client 200a and the object information collected during the analysis is sufficient, for example, 90% of the information matches.

It should be understood that the above interaction between the security client 200a and the security client 200b is a special case of any two security clients 200, and the security client 200b can be any other, for example, 200n, and the security client 200b instead of the security client 200a.

FIG. 5 shows a diagram of an embodiment of one of the operation algorithms of a distributed malware detection system. At step 501, the security client 200 (the first security client 200) analyzes the object on the computing device 110 in order to detect a malicious object. At step 502, the said security client 200 collects information obtained during the analysis of the analyzed object. It is worth noting that the analysis of the object and the collection of information in the particular case of implementation can be carried out in parallel, and the decision to recognize the object as malicious, for example, can be made before the end of the information collection phase 502 (if sufficient information about the object has already been collected to detect the malicious object) . If at step 503 a malicious object was detected by security client 200 in accordance with the results of a previous analysis, then at step 504, security client 200 eliminates the detected malicious object on computing device 110. If at step 503 a malicious object was not detected by security client 200 in according to the results of the previous analysis, then at step 505, the security client 200 performs a request for analysis by the second security client 200 in order to detect malicious object. At step 506, the second security client 200 performs the requested analysis of the object in order to detect a malicious object. It should be noted that at this stage previously collected information about the object is used using the first security client 200. At step 507, the second security client 200 detects a malicious object, and then, at step 508, the second security client 200 passes the results of the analysis to the first security client 200 together with means for eliminating the detected malicious object. At step 509, the first security client 200 eliminates the malicious object using means for eliminating malicious objects on the computing device received from the second security client.

It should be noted that the choice of a security client for interaction (for example, transmitting an analysis request, information about an object, means for eliminating malicious objects and any other information), namely, the first security client 200 selects a second security client 200, can be implemented in several ways. In the particular case of the implementation, the first security client 200 selects the second security client 200 for interaction based on the geographic location of the security clients 200: for the interaction, the security client 200 is selected that is geographically the least distant from the first security client 200. In another particular case of implementation, the principle of geographic location is understood as the principle according to which, for interaction, the security client 200, which is located in a certain geographical zone (for example, so that the data in the framework of the interaction is not transmitted over the networks of an unfriendly state). In another special case of implementation, a security client 200 is selected for interaction, the communication channel throughput is the highest among other security clients 200. In another particular implementation case, the choice of security client 200 for interaction can be based on its “reliability”: if the first security client 200 for interaction has a choice of two security clients 200, then the security client 200 will be selected, which previously could detect the largest number of malicious objects and / or provide Means to eliminate the greatest number of malicious objects.

In the particular case of implementation, the security client 200, if it failed to detect a malicious object within the framework of the analysis requested by another security client 200, may send a similar analysis request to detect another malicious object to another security client 200 (different from security client 200, initiating the analysis) and transmit to the security client 200, which requested the analysis, the results of the analysis performed by another security client 200.

FIG. 6 is an example of a general purpose computer system, a personal computer or server 20 comprising a central processor 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented as any prior art bus structure comprising, in turn, a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26 contains the basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading the operating system using ROM 24.

The personal computer 20 in turn contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD -ROM and other optical information carriers. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the interface of the magnetic disks 33 and the interface of the optical drive 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that can store data in a form readable by a computer (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.) that are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36 where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38, and program data 39. The user is able to enter commands and information into personal computer 20 via input devices (keyboard 40, keypad “ the mouse "42). Other input devices (not displayed) can be used: microphone, joystick, game console, scanner, etc. Such input devices are, as usual, connected to the computer system 20 via a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer may be equipped with other peripheral output devices (not displayed), such as speakers, a printer, and the like.

The personal computer 20 is capable of operating in a networked environment, using a network connection with another or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the creature the personal computer 20 of FIG. 6. Other devices, for example, routers, network stations, peer-to-peer devices or other network nodes, may also be present on the computer network.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local area network 50 via a network adapter or network interface 51. When using the networks, the personal computer 20 may use a modem 54 or other means of providing communication with a global computer network such as the Internet. The modem 54, which is an internal or external device, is connected to the system bus 23 via the serial port 46. It should be clarified that the network connections are only exemplary and are not required to display the exact network configuration, i.e. in reality, there are other ways to establish a technical connection between one computer and another.

In conclusion, it should be noted that the information provided in the description are examples that do not limit the scope of the present invention defined by the claims.

Claims (2)

1. The method of distributed detection of malicious objects, in which:
a. analyze objects with the first security client in order to detect a malicious object;
b. using the first security client, collect information about the object during the analysis;
c. using the first security client, select a second security client from at least two security clients to participate in interaction with the first security client;
wherein the second security client is selected from at least two security clients associated with the first security client, based on at least the geographical location of the security clients, the bandwidth of the communication channel between the security clients, the results of requests previously processed by other security clients;
d. requesting, with the help of the first security client, an analysis of the object by the second security client using the previously collected information about the object if, at the stage of analysis carried out by the first security client, it was not possible to detect a malicious object;
e. using the second security client, analyze the object in order to detect a malicious object;
f. using the second security client, transmit the results of the analysis performed by the said security client, as well as at least one means for eliminating the malicious object, if a malicious object was detected at the analysis stage, to the first security client;
g. eliminate the malicious object using the first security client on the computing device using the means for eliminating the malicious object received from the second client. 2. A distributed malware detection system that contains:
interconnected first security client and at least two security clients, each of which is designed to analyze objects in order to detect malicious objects, collect information about objects during the analysis, eliminate malicious objects on the computing device, request the analysis of objects to another security client in order to detect malicious objects, to analyze objects requested by another security client, using received from this client coagulant security information about the objects in order to detect malicious programs, transmitting the results of the analysis to other security clients, to transmit at least one means for removing on the computing device of malware other security clients and to select a different client security to participate in the interaction;
however, the selection of another security client is carried out from at least two security clients associated with the selecting security client, based on at least the geographical location of the security clients, the bandwidth of the communication channel between the security clients, the results of requests previously processed by other security clients;
moreover, one security client is also able to use the means transferred from the other security client to eliminate malicious objects on the computing device.

Images