System and method for detecting time-bomb malware

• US 10,083,302 B1
• Filed: 12/29/2016
• Issued: 09/25/2018
• Est. Priority Date: 06/24/2013
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: FireEye, Inc. (Alphabet Inc.)
• Inventors: Paithane, Sushant, Vincent, Michael, Vashisht, Sai, Kindlund, Darien
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): GUNDRY, STEPHEN T
• Application Number:
  US15/394,681
• Time in Patent Office: 635 Days
• CPC Class Codes: B01D 61/06 Energy recovery
• CPC Class Codes: C02F 1/44 by dialysis, osmosis or reverse osmosis general membrane separation processes B01D61/00, membrane modules B01D63/00, electrodialysis C02F1/4693, combination of membrane modules and bioreactors C02F3/1268
• CPC Class Codes: C02F 1/52 by flocculation or precipitation of suspended impurities C02F1/463 takes precedence
• CPC Class Codes: C02F 1/66 by neutralisation; pH adjustment for degassing C02F1/20; using ion-exchange C02F1/42; for flocculation or precipitation of suspended impurities C02F1/52; for removing dissolved compounds C02F1/58
• CPC Class Codes: C02F 1/76 with halogens or compounds of halogens C02F1/4674 takes precedence
• CPC Class Codes: C02F 2103/08 Seawater, e.g. for desalination
• CPC Class Codes: C02F 2303/10 Energy recovery
• CPC Class Codes: C02F 2303/18 Removal of treatment agents after treatment
• CPC Class Codes: C02F 2303/185 The treatment agent being halogen or a halogenated compound
• CPC Class Codes: C02F 3/1273 Submerged membrane bioreactors
• CPC Class Codes: C02F 5/08 Treatment of water with complexing chemicals or other solubilising agents for softening, scale prevention or scale removal, e.g. adding sequestering agents
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: Y02W 10/10 Biological treatment of water, waste water, or sewage
• CPC Class Codes: Y02W 10/30 Wastewater or sewage treatment systems using renewable energies

Abstract

According to one embodiment, a system comprises one or more counters; comparison logic; and one or more hardware processors communicatively coupled to the one or more counters and the comparison logic. The one or more hardware processors are configured to instantiate one or more virtual machines that are adapted to analyze received content, where the one or more virtual machines are configured to monitor a delay caused by one or more events conducted during processing of the content and identify the content as including malware if the delay exceed a first time period.

Claims

1. A system comprising:

one or more counters;

comparison logic; and

one or more hardware processors communicatively coupled to the one or more counters and the comparison logic, the one or more hardware processors being configured, using a virtual machine (VM) image selected based on metadata associated with received content, to instantiate one or more virtual machines for analysis of the received-content, the one or more virtual machines being configured to utilize the one or more counters to monitor a delay caused by one or more events conducted during processing of the received content and utilize the comparison logic to identify the received content as including malware if the delay exceeds a first time period.

2. The system of claim 1, wherein the one or more virtual machines being configured to utilize the one or more counters in monitoring time intervals for Sleep request messages initiated during processing of the received content and identifying the received content as including malware if, based on a determination by the comparison logic, a combined delay for the Sleep request messages exceeds the first time period.

3. The system of claim 1, wherein the one or more virtual machines being configured to utilize the one or more counters in monitoring time intervals for Sleep request messages initiated during processing of the received content and identifying the received content as including malware if, based on a determination by the comparison logic, one of the time intervals exceeds the first time period.

4. The system of claim 1, wherein the one or more virtual machines being configured to further monitor the one or more events being a number of function calls initiated during processing of the received content and identifying the received content as including malware if the number of function calls exceeds a threshold value.

5. The system of claim 1, wherein the one or more virtual machines being configured to further monitor the one or more events by determining if, during processing of the received content, an instruction pointer is repeatedly directed to a specific address or address range and identifying the received content as including malware if the instruction pointer is repeatedly directed to the specific address or address range.

6. The system of claim 1, wherein the first time period has a duration that is dynamically set.

7. The system of claim 1, wherein the one or more virtual machines being configured to maintain and monitor values of time intervals for Sleep calls per call site, initiated during processing of the received content and identifying the received content as including malware if, based on a determination by the comparison logic, one of the time intervals exceeds a predetermined time period.

8. The system of claim 1, wherein the one or more virtual machines being configured to maintain and monitor values of the one or more counters being call counters for certain functions per call site, initiated during processing of the received content, and identifying the received content as including malware if, based on a determination by the comparison logic, one of the call counters exceeds the a predetermined count threshold.

9. The system of claim 1 further comprising a reporting module being configured to differentiate call sites based on module names and assign weights accordingly and identifying the received content as including malware if a higher count is associated with a call site residing in the received content under analysis.

10. The system of claim 1 further comprising a heuristic engine being configured to identify delay hotspots and identifying the received content as including malware if one of a plurality of time intervals associated with the delay exceeds a predetermined time period.

11. The system of claim 1, wherein the comparison logic includes one or more comparators.

12. A system for detecting time-bomb malware, comprising:

one or more processors;

a memory communicatively coupled to the one or more processors and including one or more virtual machine images, wherein

the one or more processors, using a virtual machine image selected based on metadata associated with received content, to instantiate one or more virtual machines adapted to analyze the received content and determine if the received content includes time-bomb malware by monitoring at least one of (i) a number of events that delay processing of the received content and (ii) an amount of delay caused by the events and correspondingly determining that the received content includes malware if at least one of (a) the number of events exceeds a first threshold and (b) the amount of delay caused by the events exceeds a second threshold.

13. The system of claim 12, wherein the one or more virtual machines being configured to monitor time intervals for one type of event being one or more Sleep request messages initiated during processing of the received content and identifying the received content as including malware if a total delay requested by the one or more Sleep request messages exceeds the second threshold being a first predetermined time period.

14. The system of claim 12, wherein the one or more virtual machines being configured to monitor time intervals for one type of event being one or more Sleep request messages initiated during processing of the received content and identifying the received content as including malware if one of the time intervals exceeds a first predetermined time period.

15. The system of claim 12, wherein the one or more virtual machines being configured to further monitor the number of events being a number of function calls initiated during processing of the received content and identifying the received content as including malware if the number of function calls exceeds the first threshold.

16. The system of claim 12, wherein the one or more virtual machines being configured to further monitor an event by determining if, during processing of the received content, an instruction pointer is repeatedly directed to a specific address or address range and identifying the received content as including malware if the instruction pointer is repeatedly directed to the specific address or address range.

17. The system of claim 12, wherein the second threshold has a duration that is dynamically set.

18. The system of claim 12, wherein the one or more virtual machines being configured to maintain and monitor time intervals for Sleep calls per call site, initiated during processing of the received content and identifying the received content as including malware if one of the time intervals exceeds a predetermined time period.

19. The system of claim 12 further comprising a reporting module being configured to differentiate call sites based on module names and assign weights accordingly and identifying the received content.

20. A system comprising:

one or more counters;

one or more comparators coupled to the one or more counters; and

one or more hardware processors communicatively coupled to the one or more counters and the one or more comparators, the one or more hardware processors being configured, using a virtual machine (VM) image selected based on metadata associated with received content, to instantiate one or more virtual machines that, utilizing the one or more counters and the one or more comparators, are adapted to analyze received content, the one or more virtual machines being configured to (i) monitor a delay caused by at least one of (a) repetitive Sleep request messages or (b) Application Programming Interface (API) function calls that is conducted during processing of the received content and (ii) identify the received content as including malware if the delay exceed a first time period.