RU2776926C1 - Method for changing the malware detection rule - Google Patents

Abstract

FIELD: information security.

SUBSTANCE: method for changing the malware detection rule includes the stages of: using and storing at least one malware detection rule in the form of a set of conditions, wherein the analysed object is considered malware-containing when complying to said set of conditions; collecting data on the use of the stored malware detection rule; identifying the presence of a type I or II error when using the malware detection rule by means of the error detection rules based on the collected data; if an error is identified when using the malware detection rule, making a in the used malware detection rule by changing at least one condition from the set of conditions of the used malware detection rule in accordance with the identified error.

EFFECT: ensured information security due to the change in the set of conditions of the malware detection rule when detecting an error while using the malware detection rule.

8 cl, 3 dwg

Description

Technical field

The invention relates to the field of information security, and more specifically to a method for changing the rules for detecting malicious code.

State of the art

The rapid development of computer technology in the last decade and the widespread use of computer systems (personal computers, laptops, tablets, smartphones, etc.) have become a powerful incentive for the use of these devices in various fields of activity and for performing a huge number of tasks (from Internet surfing to bank transfers and electronic document management). In parallel with the growth in the number of computer systems and software, the number of malicious programs is also growing at a rapid pace.

At the moment, there are a huge number of varieties of malicious programs. Some steal from users' devices their personal and confidential data (for example, logins and passwords, bank details, electronic documents). Others form so-called botnets from user devices, which are used to organize attacks on a third-party computer system, the purpose of which is to bring to a denial of service (Eng. DDoS - Distributed Denial of Service) or brute force password brute force (English brute force). Still others offer users paid content through intrusive advertising, sending SMS messages to paid numbers, etc.

To detect applications containing malicious code, various technologies and methods are used, such as: static analysis, behavioral analysis, analysis and comparison of databases of trusted applications and applications containing malicious code, etc. Each technology involves the use of signatures or sets of conditions in order to detect the presence of malicious code. The mentioned technologies or methods have their pros and cons, which affect the appearance of errors of the first and second kind when detecting malicious applications (the so-called detection efficiency or detection rate) and the use of computing resources for the detection of malicious applications (the so-called performance). In turn, malicious applications evolve with the means of detection and become more difficult to detect.

Currently, there are solutions designed to analyze the effectiveness of detecting malicious code using a particular technology, namely, checking the correct operation of the signatures used in the technology. For example, US8819835B2 presents a system that detects signatures that do not work correctly by using hidden signatures. Rules built on the statistics of signature triggering allow you to determine the quality of the signature. If the signature works correctly, then it is transferred to the active state, otherwise, its use is canceled. Although the method of operation described above is partially successful in detecting a signature that does not work correctly, it does not involve analyzing the error that the use of the signature leads to and the possibility of making changes to the signature, which can change the efficiency of detecting malicious code when using the mentioned signature. The present invention solves this problem.

Disclosure of invention

The invention relates to the field of information security, and more specifically to methods for managing malicious code detection rules. The invention is intended to change the rule for detecting malicious code. The technical result of the present invention is to provide information security protection by keeping the malicious code detection rules up to date by detecting an error when using the malicious code detection rule and changing it.

In one embodiment, a method for modifying a malware detection rule is provided, comprising the steps of: collecting data on usage of the malware detection rule; detecting the presence of an error when using the malicious code detection rule using the error detection rules; if an error is detected when using the malicious code detection rule, a change is made to the used malware detection rule.

In another embodiment of the method, a malicious code detection rule is understood as a set of conditions under which the analyzed object is considered to contain malicious code.

In another embodiment of the method, the data on the use of the malicious code detection rule is understood to mean the following data: the time of using the malicious code detection rule; date of creation of the malicious code detection rule; the result of the malicious code detection rule; data about the object of analysis; settings of the anti-virus program that used the malicious code detection rule; data about the software of the computer system on which the anti-virus program is active, which used the malicious code detection rule; data about the hardware of the computer system on which the anti-virus program is active, which used the malware detection rule; data about the security policy applied on the computer system on which the anti-virus program is active, which used the malicious code detection rule; the user's reaction to the result of using the rule.

In yet another embodiment of the method, a Type I error is detected.

In one of the embodiments of the method, an error of the second kind is detected.

In another embodiment of the method, when an error is detected, the value of at least one of the conditions used in the malicious code detection rule is changed.

In another embodiment of the method, when an error is detected, the list of conditions of the used malware detection rule is changed.

In yet another embodiment of the method, the error determination rules are stored in a rule database.

In one embodiment of the method, the rules for detecting malicious code are stored in a database of heuristic rules.

Brief description of the drawings

Fig. 1 illustrates the structure of a malware detection rule change system.

Fig. 2 illustrates a method for modifying a malicious code detection rule.

Fig. 3 represents an example of a general purpose computer system, a personal computer or a server.

Although the invention may have various modifications and alternative forms, the characteristic features shown by way of example in the drawings will be described in detail. It should be understood, however, that the purpose of the description is not to limit the invention to a particular embodiment thereof. On the contrary, the purpose of the description is to cover all changes, modifications, included in the scope of this invention, as defined by the attached claims.

Description of embodiments of the invention

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, but may be embodied in various forms. The gist of the description is nothing but the specific details necessary to assist a person skilled in the art in a thorough understanding of the invention, and the present invention is defined within the scope of the appended claims.

When analyzing the presence of malicious code, the anti-virus program uses methods that involve the use of rules for detecting malicious code.

In general, a heuristic analyzer in an antivirus program is a specific set of rules. The mentioned analyzer uses rules to decide on the basis of the data received during the analysis whether the analyzed application contains malicious code (https://xakep.ru/static/re-malware/18_avresearch.pdf). A malicious code detection rule is a set of conditions under which the analyzed object is considered to contain malicious code. Depending on the object of analysis, different types of conditions are distinguished, on the basis of which rules are formed. For example, malicious code in file type objects can be detected using heuristics based on the analysis of a known file containing malicious code. The mentioned heuristic is a special case of the malicious code detection rule (http://dspace.nbuv.gov.ua/bitstream/handle/123456789/6920/10-Ruvinskaya.pdf?sequence=1). As conditions, conditions and features specific to files can be used, for example: parts of a file in the form of a file signature, commands contained in the file, unique lines, file type, file size, file structure. In addition, malicious code in files can be detected using a behavioral signature (Yu. M. Tumanov, "DETECTION OF MALICIOUS JAVASCRIPT SCENARIOS BASED ON BEHAVIOR SIGNATURES", https://bit.mephi.ru/index.php/bit/article/ download/828/818). In this case, the actions of the application in relation to other programs, to the hardware of the computer system, to the operating system, etc., can act as conditions.

The object of analysis can be not only a file, but also, for example, a message sent by e-mail. In this case, spam heuristics is a special case of the rules, the conditions are the parameters and features specific to the message sent by e-mail, for example: the subject text of the message, the title of the message body text, the language of the message text, etc.

During the analysis of one object, different rules for detecting malicious code can be used. In the course of using the rules, they determine with what probability the analyzed object contains malicious code. If the probability limit value is exceeded, an object can be classified as an object containing malicious code. If the probability limit is not exceeded, the object can be classified as an object that does not contain malicious code. In either case, there is a possibility of an error occurring. A Type I error or a false positive is considered to be a situation where an object that is not actually malicious is recognized as an object containing malicious code after using the rule. A type 2 error is a situation where an object that is actually a malicious application is recognized as an object that does not contain malicious code after using the rule. Errors of the first and second types must be detected and error data used to change the corresponding rules for detecting malicious code. To do this, use a system for changing the rule for detecting malicious code.

FIG. 1 illustrates the structure of a malware detection rule change system that includes an antivirus program 110 , a collection tool 120 , a detection tool 130 , a changer 140 , a rule database 150 , a heuristic rule database 160 .

The antivirus program 110 searches for and detects malicious code on users' computer systems using methods and technologies known in the art using malware detection rules from the heuristic rule database 160 .

Collection medium120 designed to collect data on the use of a malicious code detection rule from a database of heuristic rules160. When the antivirus program110 during the analysis of objects used the malware detection rule of the heuristic rules database160, remedy collection120collects data on the use of a malicious code detection rule, namely at least one of:

• the time when the malicious code detection rule was used;

• date of creation of the malicious code detection rule;

• the result of the operation of the malicious code detection rule – the decision to recognize the object of analysis as containing or not containing malicious code after using the malicious code detection rule;

• data about the object of analysis, for example, if the object is a file, then the following data can be obtained:

- name,

- the size,

- extension,

- checksum of the code section,

- section checksum, etc.;

• settings of the anti-virus program 110 that used the malicious code detection rule, for example, emulation depth, time and date of the last update of anti-virus databases, frequency of anti-virus database updates, set of files to be scanned, etc.;

• data about the software of the computer system and its settings on which the anti-virus program 110 is active, which used the malware detection rule, for example, the list of installed programs, the name of the program, information about the program developer, the version of the program, the period of time the program was used, etc. .;

• data about the hardware of the computer system and its settings on which the anti-virus program 110 is active, which used the malicious code detection rule, for example, the list of installed hardware, processor model, motherboard model, network card model;

• data about the security policy applied on the computer system on which the anti-virus program 110 is active that used the malware detection rule, such as the list of users and their roles, software permissions, hardware permissions, etc.;

• The user's reaction to the result of using the rule is the user's action on the object of analysis after using the rules for detecting malicious code.

In addition, the collector 120 is configured to report the usage of the malicious code detection rule to the detection engine 130 .

The detecting tool 130 is designed to detect the presence of an error when using the malicious code detection rule using the error detection rules.

The detection of the presence of an error is performed using the error detection rules from the rule database 150 . An error detection rule is a set of conditions under which the detection engine 130 determines the presence of an error rate after using a malicious code detection rule. The limiting value of the error rate, when exceeded, an error is considered detected, can be determined empirically, statistically, and change in accordance with the detection of new objects of analysis containing malicious code.

An example of one of the error detection rules can be the following set of conditions: result of using a malicious code detection rule - the object of analysis contains malicious code, cancellation by 10 different users of the result of using a malicious code detection rule when analyzing the same object, security policy, hardware and software of computer systems on which the rule was canceled match 80 percent, the time period for using the rule is 7 days. When these conditions are met, the coefficient of presence of a type I error is considered to be 9. If the limit value of the coefficient is defined as 9, it is considered that a type I error has been detected.

Another example of one of the rules for detecting an error can be the following set of conditions: the result of using a malicious code detection rule is that the object of analysis contains malicious code, while using the rule, the list of equipment was reduced by one device, the object of analysis was detected on 10 computer systems, the list of equipment and software of which matches by 80 percent, the list of equipment of the mentioned devices has also been reduced by one device mentioned earlier. When these conditions are met, the coefficient of presence of a type I error is considered to be 9. If the limit value of the coefficient is defined as 9, it is considered that a type I error has been detected.

Another example of one of the error detection rules can be the following set of conditions: the result of using a malicious code detection rule is that the object of analysis does not contain malicious code, the object of analysis is similar to the previously known object of analysis containing malicious code by 80 percent, the date of creation of the malicious code detection rule is greater than 90 days, the settings of the antivirus program that used the malware detection rule match 90 percent. When these conditions are met, the coefficient of the presence of a type 2 error is considered to be 9. If the limit value of the coefficient is defined as 9, it is considered that a type 2 error has been detected.

Another example of one of the error detection rules can be the following set of conditions: the result of using the malicious code detection rule is that the object of analysis does not contain malicious code, the result of using the malicious code detection rule was confirmed on 10 computer systems, the analysis object was extracted from the archive of objects containing malicious code . When these conditions are met, the coefficient of the presence of a type 2 error is considered to be 9. If the limit value of the coefficient is defined as 9, it is considered that a type 2 error has been detected.

Example 1 of the implementation of the rules for determining an error of the first kind when analyzing a file with a behavioral signature. Conditions mean the following conditions:

• file 1 detected by behavioral heuristic 1 contains malicious code (a);

• in the last 2 hours, the number of users who added file 1 to exceptions exceeded the value 1 (b).

When these conditions are met, the coefficient of presence of an error of the first kind is considered equal to Y, where Y = f(a, b). In this case, the coefficient of presence of a type I error is 9. If the limit value of the coefficient is defined as 9, it is considered that a type I error has been detected.

Example 2 of implementing the rules for detecting an error of the first kind when analyzing a file with a behavioral signature. The following conditions are used:

• the file identified by behavioral heuristic 1 contains malicious code (a);

• Behavioral signature released in test mode less than 2 hours ago (c).

When these conditions are met, the coefficient of presence of an error of the first kind is considered equal to Y, where Y = f(a, c). In this case, the coefficient of presence of a type I error is 9. If the limit value of the coefficient is defined as 9, it is considered that a type I error has been detected.

Example 1 of the implementation of the rule for determining an error of the second kind when analyzing a file by behavioral heuristics. The following conditions are used:

file 2 checked by behavioral heuristic 2 contains malicious code (p);

file 2, tested by behavioral heuristic 2, performs 3 actions with the operating system (OS) in the same way as a known file containing malicious code (q);

file 2, tested by behavioral heuristic 2, uses the parent startup process in the same way as a known file containing malicious code (r);

the distribution source of file 2 is the same as the distribution source of the known file containing the malicious code(s).

When these conditions are met, the coefficient of presence of an error of the second kind is considered equal to Y, where Y = f(p, q, r, s). In this case, the coefficient of presence of the error of the first kind is equal to 9. If the limit value of the coefficient is determined as 9, it is considered that the error of the second kind is detected.

If one of the conditions is not met, then the error presence rate decreases depending on the influence of the condition on the error determination. If one of the conditions has a high influence on the determination of the error further, then the error presence rate is increased. The influence factor of a condition can be calculated empirically, statistically, or by using machine learning.

In addition, the detection engine 130 is designed to report the detected error when using the malicious code detection rule to the changer 140 .

The modification tool 140 is adapted to modify the used malware detection rule when an error is detected while using the malicious code detection rule.

When an error of the first kind is detected, the used malware detection rule is changed. In one of the implementation options, depending on the object of analysis, the list of conditions that make up the rule is changed, namely, their number is increased. For example, rule 1 contained 3 conditions. After using rule 1 and detecting a Type I error, rule 1 is modified by adding at least one additional condition. As a result, the modified rule 1 already contains 4 conditions, which will lead to a decrease in the probability of a Type I error.

In another embodiment, depending on the object of analysis, the value of at least one of the conditions that make up the rule is changed, namely, reduce or reduce its value. For example, rule 1 contained 3 conditions, one condition had a value range of 10-20 units. After using the rule and detecting an error of the first kind, the rule is changed by reducing the range of condition values to 10 units. As a result, the modified rule 1 contains 3 conditions, one condition already has a value of 10, which will lead to a decrease in the probability of a type 1 error.

When an error of the second kind occurs, the used malware detection rule is changed. In one of the implementation options, depending on the object of analysis, the list of conditions that make up the rule is changed, namely, their number is reduced. For example, rule 3 contained 4 conditions. After using the rule and detecting a type 2 error, rule 3 is modified by reducing at least one additional condition of high importance. As a result, the modified rule 3 already contains 3 conditions, which will lead to a decrease in the probability of an error of the second kind.

In another embodiment, depending on the object of analysis, the value of at least one of the conditions that make up the rule is changed, namely, its value is increased or added. For example, rule 4 contained 3 conditions, one condition had a value range of 5-10 units. After using rule 4 and detecting a type 2 error, the rule is changed by increasing the value of the condition to 10 units. As a result, the modified rule 4 contains 3 conditions, one condition already has a value of 10, which will lead to a decrease in the probability of a type 2 error.

The rule database 150 is designed to store the error definition rules. The heuristic rules database 160 is designed to store rules for detecting malicious code. Various types of databases can be used to store and process data, namely: hierarchical (IMS, TDMS, System 2000), network (Cerebrum, Сronospro, DBVist), relational (DB2, Informix, Microsoft SQL Server), object-oriented ( Jasmine, Versant, POET), object-relational (Oracle Database, PostgreSQL, FirstSQL / J, functional, etc. Rules can be created using machine learning algorithms and automated processing of large data sets.

Fig. 2 illustrates a method for modifying a malicious code detection rule.

In step 211 , collector 120 collects data on the use of a malicious code detection rule from a database of heuristic rules 160 and passes the collected data to detection engine 130 .

At steps 212 and 213 , the detection engine 130 checks whether errors occurred during the use of the malicious code detection rule using the error detection rules from the rule database 150 . Next, the detecting means 130 transmits the detected error data to the modifying means 140 .

If an error is detected in the operation of the malware detection rule, at step 214 , the changer 140 makes changes to the used malware detection rule. If there are no errors at step 215 , the system terminates.

Fig. 3 shows an example of a general purpose computer system, a personal computer or a server 20 ', comprising a central processing unit 21 ', system memory 22 ', and a system bus 23 ', which contains various system components including memory associated with the central processing unit 21 '. The system bus 23 is implemented as any bus structure known in the art, comprising in turn a bus memory or bus memory controller, a peripheral bus, and a local bus capable of interfacing with any other bus architecture. The system memory contains read only memory (ROM) 24 , random access memory (RAM) 25 . The main input/output system (BIOS) 26 contains the main procedures that ensure the transfer of information between the elements of a personal computer 20 , for example, at the time of booting the operating system using ROM 24 .

The personal computer 20 , in turn, contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29 and an optical drive 30 for reading and writing to removable optical disks 31 , such as CD-ROM, DVD -ROM and other optical storage media. The hard disk 27 , the magnetic disk drive 28 , the optical drive 30 are connected to the system bus 23 via the hard disk interface 32 , the magnetic disk interface 33 , and the optical drive interface 34 , respectively. Drives and related computer storage media are non-volatile means of storing computer instructions, data structures, program modules, and other personal computer data 20 .

The present description discloses an implementation of a system that uses a hard disk 27 , a removable magnetic disk 29 and a removable optical disk 31 , but it should be understood that other types of computer storage media 56 that are capable of storing data in a computer-readable form (solid-state drives, flash memory cards, digital disks, random access memory (RAM), etc.), which are connected to the system bus 23 through the controller 55 .

The computer 20 has a file system 36 that stores the recorded operating system 35 as well as additional software applications 37 , other program modules 38 and program data 39 . The user has the ability to enter commands and information into the personal computer 20 through input devices (keyboard 40 , mouse 42 ). Other input devices (not shown) may be used: microphone, joystick, game console, scanner, etc. Such input devices are normally connected to the computer system 20 via a serial port 46 , which in turn is connected to the system bus, but may be connected in other ways, such as through a parallel port, game port, or universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48 '. In addition to the monitor 47 , the personal computer may be equipped with other peripheral output devices (not shown), such as speakers, a printer, etc.

The personal computer 20 is capable of operating in a networked environment using a network connection to another or more remote computers 49 . The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the nature of the personal computer 20 shown in FIG. 3 . Other devices may also be present in the computer network, such as routers, network stations, peer-to-peer devices, or other network nodes.

The network connections may form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local network 50 via a network adapter or network interface 51 . When using networks, personal computer 20 may use a modem 54 or other means to communicate with a wide area network, such as the Internet. The modem 54 , which is an internal or external device, is connected to the system bus 23 via the serial port 46 . It should be clarified that the network connections are only indicative and are not required to represent the exact network configuration, i.e. in fact, there are other ways to establish a connection by technical means of communication from one computer to another.

In conclusion, it should be noted that the information given in the description are examples that do not limit the scope of the present invention defined by the formula.

Claims (21)

1. A method for modifying a malicious code detection rule, comprising the steps of: a) use and store at least one malicious code detection rule as a set of conditions under which the analyzed object is considered to contain malicious code; b) collect data on the use of the stored malicious code detection rule; c) detecting the presence of an error of the first type or an error of the second type when using the malicious code detection rule using the error detection rules based on the collected data; d) if an error is detected when using the malicious code detection rule, a change is made to the used malware detection rule by changing at least one condition from the set of conditions of the used malware detection rule in accordance with the detected error. 2. The method according to claim 1, in which the following data is understood as data on the use of a malicious code detection rule: • the time when the malicious code detection rule was used; • date of creation of the malicious code detection rule; • result of operation of the malicious code detection rule; • data about the object of analysis; • settings of the anti-virus program that used the malicious code detection rule; • data about the software of the computer system on which the anti-virus program is active, which used the malicious code detection rule; • data about the hardware of the computer system on which the anti-virus program is active, which used the malicious code detection rule; • data about the security policy applied on the computer system on which the anti-virus program is active, which used the malicious code detection rule; • the user's reaction to the result of using the rule. 3. The method according to claim 1, in which the error detection rule is understood as a set of conditions under which the error presence coefficient is determined after using the malicious code detection rule. 4. The method according to claim 3, in which the limit value of the error coefficient is determined, when exceeded, an error of the first or second kind is considered detected. 5. The method according to claim 1, in which, upon detection of an error, the range of values of at least one condition from the set of conditions of the used malware detection rule is reduced. 6. The method according to claim 1, in which, upon detection of an error, the range of values of at least one condition from the set of conditions of the used malware detection rule is expanded. 7. The method according to claim. 1, in which, when an error is detected, at least one additional condition is added to the set of conditions of the used malware detection rule. 8. The method according to claim. 1, in which, upon detection of an error, at least one condition is removed from the set of conditions of the used malware detection rule.

Images