Malicious mobile code runtime monitoring system and methods

• US 10,552,603 B2
• Filed: 11/16/2015
• Issued: 02/04/2020
• Est. Priority Date: 05/17/2000
• Status: Expired due to Fees

• Current Assignee: Finjan Holdings, Inc. (SoftBank Group Corp.)
• Original Assignee: Finjan, Inc. (SoftBank Group Corp.)
• Inventors: Edery, Yigal Mordechai, Vered, Nimrod Itzhak, Kroll, David R.
• Primary Examiner(s): Lemma, Samson B
• Assistant Examiner(s): Cruz-Franqui, Richard W
• Application Number:
  US14/941,911
• Publication Number:
  US 20160070907A1
• Time in Patent Office: 1,541 Days
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system provides for monitoring information received, determining whether received information does or is likely to include executable code, and if so, causes as sandboxed package including the received information and mobile protection code (MPC) to be transferred to a destination device of the received information. At a destination device, the sandboxed package is unbundled such that upon initiating the Downloadable, malicious Downloadable operating attempts are received by the MPC causing (predetermined) corresponding operations to be executed in response to the attempts.

Claims

1. A processor-based method, comprising:

receiving, by a server, a file;

detecting whether the file includes one or more instances of executable code, including detecting, by a detector engine of the server, that the file includes one or more instances of executable code when the file is determined to include a code pattern indicative of executable code;

generating, by a protection engine, mobile protection code when one or more instances of executable code is detected by the code detector;

receiving, by a linking engine, the generated mobile protection code and the file containing the one or more instance of executable code, and bundling, by the linking engine, the mobile protection code, at least one security policy, and the file into a sandboxed package, wherein the bundling does not alter the file;

unbundling the sandboxed package in the following order;

mobile protection code first, at least one security policy second and the file third; and

transferring the file, by the server, to a destination when no instances of executable code are detected therein.

2. The processor-based method of claim 1, further comprising:

communicating the sandboxed package to a computing device.

3. A processor-based method for monitoring for received executables, comprising:

detecting, by a first processing device, a received executable;

detecting whether the received executable includes one or more instances of executable code, including detecting, by a detector engine of the first processing device, the received executable when the received executable is determined to include an executable file type;

wrapping, by a server, the received executable with a sandbox agent, wherein wrapping includes bundling the following separate code objects into a sandbox file;

the sandbox agent,

a security policy related to the received executable and

the received executable, and

further wherein the bundling does not alter the separate code objects;

sending, by the server, the sandbox file to a second processing device;

unbundling the sandbox file in the following order at the second processing device;

sandbox agent first, security policy second and the received executable third; and

transferring the file, by the server, to the second processing device when no instances of executable code are detected therein.

4. The processor-based method of claim 3, further comprising:

detecting, by a detector engine of the first processing device, the received executable when the received executable is determined to include a code pattern indicative of an executable.

5. A processor-based method, comprising:

receiving, at a server, a file;

detecting whether the file includes one or more instances of executable code, including detecting, by a detector engine, at least one received executable within the received file wherein the detector engine is a code detector and the detecting further including

detecting, by a file-type detector of the code detector, that the received file is a compressed file type;

opening, by an inflator of the code detector, the compressed received file into one or more open received files; and

detecting, by the file-type detector, that one or more opened received files is an executable file type;

wrapping, by the server, the received file with a sandbox agent, wherein wrapping includes bundling the following separate code objects into a sandbox file;

the sandbox agent,

a security policy related to the at least one received executable and the received file, and

further wherein the bundling does not alter the separate code objects;

sending, by the server, the sandbox file to a processing device;

unbundling the sandbox file in the following order at the processing device;

sandbox agent first, security policy second and the received file third; and

transferring the file, by the server, to the processing device when no instances of executable code are detected therein.

6. The processor-based method of claim 5, further comprising:

detecting by a file-type detector of the code detector that the received file is an executable file type.

7. The processor-based method of claim 5, wherein the detector engine is a content detector.

8. The processor-based method of claim 7, comprising:

parsing, by a parser of the detection engine, the received file into one or more portions;

analyzing, by a pattern detector of the content detector, that the one or more portions of the received file include a code pattern indicating a received executable.

9. A computer-implemented method, comprising:

receiving program code at a first computing device;

detecting whether the program code includes one or more instances of executable code, including detecting when the program code contains an executable file wherein the program code is determined to contain an executable file when the program code is determined to include a code pattern indicative of an executable file;

forming a sandbox package including protection code, a security policy and the program code when it contains an executable file;

sending the sandbox package to a second computing device;

unbundling the sandbox package in the following order at the computing device;

protection code first, security policy second and the program code third; and

transferring the program code, by the server, to a second computing device when no instances of executable code are detected therein.