System and method for detecting exfiltration content

• US 10,467,414 B1
• Filed: 04/02/2018
• Issued: 11/05/2019
• Est. Priority Date: 03/13/2013
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Kindlund, Darien, Wolf, Julia, Bennett, James
• Primary Examiner(s): Simitoski, Michael
• Application Number:
  US15/943,406
• Time in Patent Office: 582 Days
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/565 by checking file integrity
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Techniques for detecting exfiltration content are described herein. According to one embodiment, a malicious content suspect is executed and a packet inspection of outbound network traffic is performed by a packet inspector running within the virtual machine. Occurring before the outbound network traffic leaving the virtual machine, the packet inspector determines whether a portion of outbound network traffic matches one or more portions of predetermined network traffic patterns or signatures. If so, a determination is made whether the outbound network traffic includes at least one environmental property of the virtual machine that is unique or almost unique to the virtual machine. If so, migration of the outbound network traffic outside of the virtual machine is precluded and an alert is transmitted. The alert includes the malicious content suspect that is attempting to perform an exfiltration of data.

Claims

1. A computer-implemented method for detecting exfiltration of data, comprising:

executing a malicious content suspect within a virtual machine that is configured to simulate a target operating environment, wherein the malicious content suspect comprises content that is potentially malicious;

performing a packet inspection on attempted outbound network traffic by a packet inspector running within the virtual machine, the packet inspection to determine whether a portion of the attempted outbound network traffic matches one or more portions of predetermined network traffic patterns or signatures;

determining whether the attempted outbound network traffic includes at least one environmental property, which is unique or distinctive of the target operating environment including at least the virtual machine, by at least determining the portion of the attempted outbound network traffic matches the one or more portions of predetermined network traffic patterns or signatures, the match indicates that the malicious content suspect is attempting to perform an exfiltration of data; and

transmitting an alert indicating that the malicious content suspect is attempting to perform an exfiltration of data from the virtual machine based on determining that the attempted outbound network traffic includes the at least one environmental property of the target operating environment and precluding migration of the attempted outbound network traffic outside of the virtual machine when the attempted outbound network traffic includes the at least one environmental property that is unique or distinctive to the target operating environment.

2. The method of claim 1, wherein the determining whether the attempted outbound network traffic includes the at least one environmental property of the target operating environment comprises matching the at least one environmental property to any of a set of patterns or signatures predefined according to a plurality of rules that represent a set of predefined system characteristics.

3. The method of claim 1, wherein the at least one environmental property comprises at least one of (i) a computer name or NetBIOS name, (ii) a serial number of a hardware component, or (iii) an identifier of a software application.

4. The method of claim 1, wherein the at least one environmental property comprises information that uniquely or distinctively identifies hardware of a machine represented by the virtual machine.

5. The method of claim 1, wherein the alert being transmitted over a network.

6. The method of claim 1 further comprising:

causing a firewall to block any further network traffic associated with the malicious content suspect.

7. The method of claim 6, wherein the blocked network traffic includes at least an inbound traffic associated with the malicious content suspect.

8. The method of claim 6, wherein the blocked network traffic includes outbound network traffic transmitted to reach an actual destination outside of the virtual machine.

9. A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor of a system, cause the processor to perform operations for detecting exfiltration, comprising:

executing a malicious content suspect within a virtual machine that is configured to simulate a target operating environment, wherein the malicious content suspect comprises content that is potentially malicious;

performing a packet inspection within the virtual machine on attempted outbound network traffic by analyzing a portion of the attempted outbound network traffic in comparison to one or more portions of predetermined network traffic patterns or signatures;

determining whether the attempted outbound network traffic includes at least one environmental property of the target operating environment represented by the virtual machine that is unique or distinctive of the target operating environment by at least determining that the portion of the attempted outbound network traffic matches the one or more portions of predetermined network traffic patterns or signatures, the at least one environmental property is unique or distinctive of the target operating environment and the match indicates that the malicious content suspect is attempting to perform an exfiltration of data; and

transmitting an alert indicating that the malicious content suspect is attempting to perform an exfiltration of data from the virtual machine based on determining that the attempted outbound network traffic includes the at least one environmental property of the target operating environment and precluding migration of the attempted outbound network traffic outside of the virtual machine when the attempted outbound network traffic includes the at least one environmental property that is unique or distinctive to the target operating environment.

10. The non-transitory machine-readable medium of claim 9, wherein the determining whether the outbound network traffic includes the at least one environmental property of the target operating environment comprises matching the at least one environmental property to any of a set of patterns associated with a virtual machine selected to process the malicious content suspect operating within the virtual machine.

11. The non-transitory machine-readable medium of claim 9, wherein the at least one environmental property of the target operating environment comprises an identifier of an electronic device corresponding to the virtual machine.

12. The non-transitory machine-readable medium of claim 9, wherein the performing of the packet inspection comprises performing a search of data that is part of the attempted outbound network traffic based on a predetermined signature that was generated by encoding, using a predetermined encoding algorithm, a text string representing a unique identifier of an electronic device corresponding to the virtual machine.

13. The non-transitory machine-readable medium of claim 9, wherein the at least one environmental property of the target operating environment is unique when an encoded or compressed form of data of the at least one environmental property fails to match generic network traffic.

14. The non-transitory machine-readable medium of claim 9, wherein the migration of the attempted outbound network traffic is precluded by blocking network traffic associated with the malicious content suspect.

15. The non-transitory machine-readable medium of claim 14, wherein the blocked network traffic includes at least an inbound traffic associated with the malicious content suspect.

16. The non-transitory machine-readable medium of claim 14, wherein the blocked network traffic includes outbound network traffic transmitted to reach an actual destination outside of the virtual machine.

17. The non-transitory machine-readable medium of claim 9, wherein the migration of the attempted outbound network traffic is precluded by causing a firewall to block any further network traffic associated with the malicious content suspect.

18. A system, comprising:

a processor; and

a memory coupled to the processor for storing instructions, which when executed from the memory, cause the processor to

execute a malicious content suspect within a virtual machine that is configured to simulate a target operating environment, wherein the malicious content suspect comprises content that is potentially malicious,

perform a packet inspection, by a packet inspector executed by the processor and running within the virtual machine, on attempted outbound network traffic, the packet inspection to determine whether a portion of the attempted outbound network traffic matches one or more portions of predetermined network traffic patterns or signatures,

determine whether the attempted outbound network traffic includes at least one environmental property of the target operating environment that is unique or distinctive of the target operating environment based on determining that the portion of the attempted outbound network traffic matches the one or more portions of predetermined network traffic patterns or signatures, and

transmit an alert indicating that the malicious content suspect is attempting to perform an exfiltration of data from the virtual machine upon determining that the attempted outbound network traffic includes the at least one environmental property of the target operating environment and precluding migration of the attempted outbound network traffic outside of the virtual machine when the attempted outbound network traffic includes the at least one environmental property that is unique or distinctive to the target operating environment.

19. The system of claim 18, wherein the determining whether the attempted outbound network traffic includes the at least one environmental property of the target operating environment comprises matching the at least one environmental property to any of a set of patterns associated with the virtual machine selected to process the malicious content suspect.

20. The system of claim 18, wherein the alert being transmitted to a controller, the controller is implemented as part of a virtual machine monitor (VMM).

21. The system of claim 18, wherein the at least one environmental property of the target operating environment comprises an identifier of an electronic device corresponding to the virtual machine.

22. The system of claim 18, wherein the performing of the packet inspection comprises performing a search of data that is part of the attempted outbound network traffic based on a predetermined signature that was generated by encoding, using a predetermined encoding algorithm, a text string representing a unique identifier of an electronic device corresponding to the virtual machine comprising the at least one environmental property.

23. The system of claim 18, wherein the at least one environmental property of the virtual machine is unique or distinctive when an encoded or compressed form of data of the at least one environmental property fails to match generic network traffic.

24. The system of claim 18, wherein the at least one environmental property is unique or distinctive to the target operating environment represented by the virtual machine in that the at least one environmental property pertains to the virtual machine so as to allow the match to indicate that the malicious content suspect is attempting to perform an exfiltration of data.

25. The system of claim 24, wherein the at least one environmental property includes at least one of (i) a computer name or NetBIOS name, (ii) a serial number of a hardware component, or (iii) an identifier of a software application.

26. The system of claim 18 wherein the packet inspector to perform packet inspection based on a set of rules or policies.

27. The system of claim 18, wherein the migration of the attempted outbound network traffic is precluded by at least blocking network traffic associated with the malicious content suspect.

28. The system of claim 18, wherein the migration of the attempted outbound network traffic is precluded by causing a firewall to block any further network traffic associated with the malicious content suspect.