Dynamically remote tuning of a malware content detection system

• US 10,341,363 B1
• Filed: 12/28/2015
• Issued: 07/02/2019
• Est. Priority Date: 03/31/2014
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Vincent, Michael, Thioux, Emmanuel, Vashisht, Sai, Kindlund, Darien
• Primary Examiner(s): Shehni, Ghazal B
• Application Number:
  US14/981,765
• Time in Patent Office: 1,282 Days
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

According to one embodiment, an apparatus comprises a processor and memory. Communicatively coupled to the processor, the memory includes a detection module that, when executed, conducts an analysis of a received object to determine if the received object is associated with a malicious attack. The detection module is configurable, and thus, certain capabilities can be enabled, disabled or modified. The analysis is to be altered upon receipt of a configuration file that includes information to alter one or more rules controlling the analysis conducted by the detection module.

Claims

1. An apparatus comprising:

a processor; and

a memory communicatively coupled to the processor, the memory has stored thereon a first detection logic including software that is configurable to enable, disable or modify analysis capabilities of the first detection logic, wherein the first detection logic, when executed by the processor, conducts a first analysis of a received object to determine if the received object is associated with a malicious attack,

wherein the first detection logic receives a configuration file, the configuration file being automatically generated by a parameter generation logic including second software to automatically generate the configuration file based on a result of the first analysis,

wherein the capabilities of the first detection logic are altered based on the configuration file, the first detection logic, after alteration of the capabilities, performs a second analysis on the received object or a second received object, the second analysis being different than the first analysis and configured to detect characteristics or behaviors associated with the malicious attack that are used to classify the received object or the second received object as malware, wherein the configuration file modifies a weighting of at least one of a first analysis score being at least part as the result of the first analysis or a second analysis score being at least part of a result of the second analysis as used in classifying the received object or the second received object as malware.

2. The apparatus of claim 1, wherein the first detection logic includes parameters that control operability of one or more rules for use in the analysis of the received object for malware, a first subset of the parameters being modifiable based on the result of the first analysis.

3. The apparatus of claim 2, wherein the first detection logic includes a first plurality of rules for controlling monitoring logic, the first detection logic, when executed by the processor, conducts the analysis of the received object by (i) one or more virtual machines processing the received object and (ii) the monitoring logic monitoring behaviors of the received object during processing by the one or more virtual machines so as to detect one or more anomalous behaviors from the monitored behaviors,

wherein the configuration file alters the first subset of the parameters to change the one or more rules of the first plurality of rules so as to change operability of the monitoring logic.

4. The apparatus of claim 3, wherein the configuration file alters the first subset of the parameters so as to alter which monitors forming the monitoring logic are in operations during the analysis of the received object by the first detection logic.

5. The apparatus of claim 3, wherein the configuration file alters the first subset of the parameters so as to change at least one of (i) a number or type of behaviors to be monitored by the monitoring logic or (ii) signature patterns associated with one or more behaviors being monitored by the monitoring logic.

6. The apparatus of claim 2, wherein the configuration file alters the first subset of the parameters so as to change at least one of (1) a number or type of signatures for signature matching conducted during the analysis of the received object by the first detection logic, (2) a number or type of characteristics to be monitored during the analysis of the received object by the first detection logic, or (3) a maximum or minimum time for the analysis of the received object by the first detection logic.

7. The apparatus of claim 1, wherein the configuration file alters what data is to be returned to the first detection logic in response to the intercepted function calls set by the configuration file during the analysis of the received object by the first detection logic.

8. The apparatus of claim 1, wherein the first detection logic is software that is configurable and includes a first plurality of rules of one or more rules for controlling a comparison of content within the received object with a first set of signature patterns associated with known malware of a plurality of signature patterns preloaded into the first detection logic,

wherein the configuration file at least deactivates one or more of the first set of signature patterns or activates one or more of the plurality of signature patterns different than the first set of signature patterns to prior to performance of the second analysis without reloading of the software associated with the first detection logic.

9. The apparatus of claim 1, wherein the configuration file is uploaded via a user interface communicatively coupled to the one or more detection logic.

10. The apparatus of claim 1, wherein the memory has stored thereon a second detection logic that operates as a dynamic analysis engine including (i) one or more virtual machines that process the received object or (ii) monitoring logic that monitors behaviors of the received object during processing by the one or more virtual machines so as to detect one or more anomalous behaviors from the monitored behaviors and the configuration file alters one or more parameters associated with dynamic analysis rules to change operation of the monitoring logic for analysis of objects subsequent to the received object for the malware.

11. The apparatus of claim 1, further comprising:

a second detection logic that operates as a static analysis engine that conducts an analysis of characteristics of the received object without processing of the received object, and the configuration file alters one or more parameters associated with static analysis rules to change operations of the static analysis rules, the change in operation includes a change in how the received object is evaluated in determining whether the object exhibits characteristics associated with the malicious attack.

12. The apparatus of claim 1, wherein the first detection logic operates as a classification engine that classifies the received object as potentially malicious or not based on results from one or more of a dynamic analysis engine, a status analysis engine or emulation engine, and the configuration file alters one or more parameters associated with classification rules that control operability of the classification engine.

13. The apparatus of claim 1, wherein generation of the configuration file based on a result of the first analysis includes use of machine learning techniques.

14. The apparatus of claim 1, wherein the altering the parameters of the monitoring logic further includes modifying (i) types of the behaviors of the object being monitored or (ii) patterns or combinations of observed behaviors that are associated with the malicious attack.

15. A method for altering operability of a malware content detection system, comprising:

conducting a first analysis of an object for malware, the first analysis including monitoring behaviors of the object being processed within a virtual machine;

determining whether results of the first analysis of the object are sufficient to classify the object as part of a malicious attack;

generating an alert in response to the results of the first analysis of the object being sufficient to classify the object as part of a malicious attack; and

responsive to determining that results of the analysis of the object are insufficient to classify the object as part of the malicious attack, (1) receiving an automatically generated configuration file based on the results of the first analysis, and (2) altering parameters of monitoring logic that controls operability of one or more rules controlling a second analysis of the object for a presence of malware,

wherein the parameters of the monitoring logic are altered based on the configuration file, and wherein the altering includes adjusting a weighting of at least one of a first analysis score being at least part of the results of the first analysis or a second analysis score being at least part of results of the second analysis that are used in classifying the object as being part of a malicious attack.

16. The method of claim 15, wherein the configuration file alters a first subset of the parameters so as to alter which monitors forming the monitoring logic are in operation during the analysis of the object for the malware.

17. The method of claim 15, wherein the configuration file alters a first subset of the parameters so as to change a number or type of behaviors to be monitored by the monitoring logic.

18. The method of claim 15, wherein the configuration file alters a first subset of the parameters so as to change one or more signature patterns associated the behaviors being monitored by the monitoring logic.

19. The method of claim 15, wherein the configuration file alters a first subset of the parameters so as to change a maximum or minimum time for the analysis of the received object for the malware.

20. The method of claim 15, wherein generation of the configuration file based on a result of the first analysis includes use of machine learning techniques.

21. The method of claim 15, wherein altering the capabilities of the first detection logic includes modifying (i) types of the behaviors of the object being monitored or (ii) patterns or combinations of observed behaviors that are associated with the malicious attack.