Method of detecting malicious code

• US 20030159090A1
• Filed: 04/09/2003
• Published: 08/21/2003
• Est. Priority Date: 07/01/2000
• Status: Active Grant

• Current Assignee: Ericsson AB (Telefonaktiebolaget LM Ericsson)
• Original Assignee: Ericsson AB (Telefonaktiebolaget LM Ericsson)
• Inventors: Wray, Stuart C, Sparry, Icarus W J
• Granted Patent: US 7,131,036 B2
• Time in Patent Office: Days
• US Class Current: 714/38
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

The invention provides a method of detecting malicious code in a code-executing device (10), the method characterised in that it includes the steps of: (a) generating test data which is substantially unsusceptible to compression without reducing its information content and storing it as image data (230) in memory external to the device (10); (b) loading the test data (R₀ to R_m) into memory (30) of the device (10); (c) performing a checksum calculation on the test data (R₀ to R_m) stored in the memory (30) of the device (10) to generate a first checksum value, performing a corresponding checksum calculation on the image data (230) to generate a second checksum value, and the comparing the first value with the second value to determine whether or not the test data in the memory of the device (30) has been corrupted; (d) repeating step (c) until sufficient test data in the memory (30) of the device (10) is checksum tested to determine whether or not malicious code is present in the device (10). The method makes it difficult for the malicious code to conceal itself from the checksums, hence it is possible to determine whether or not the device (10) has been compromised.

Claims

1. A method of detecting malicious code in a code-executing device, the method characterised in that it includes the steps of:

(a) generating test data which is substantially unsusceptible to compression without reducing its information content and storing the test data as image data in memory external to the device;

(b) loading the test data into memory of the device;

(c) performing a checksum calculation on the test data stored in the memory of the device to generate a first checksum value, performing a corresponding checksum calculation on the image data to generate a second checksum value, and then comparing the first value with the second value to determine whether or not the test data in the memory of the device has been corrupted;

(d) repeating step (c) until sufficient test data in the memory of the device is checksum tested to determine whether or not malicious code is present in the device.

2. A method according to claim 1 wherein the device is interrogated to make it divulge names of software applications stored therein prior to performing step (b) to overwrite the applications in the memory of the device.

3. A method according to claim 2 wherein uncorrupted versions of the software applications divulged by the device are loaded into the device after step (d) when the device is found to be devoid of malicious code.

4. A method according to claim 1, 2 or 3 wherein the test data includes one or more random number sequences.

5. A method according to any preceding claim wherein checksum calculations performed in step (c) are performed on one or more sequences of memory locations of the memory of the device using challenges to specify the memory locations and to specify one or more initialization vectors to be used in the checksum calculations.

6. A method according to claim 5 wherein the one or more sequences skip memory locations therein.

7. A method according to any preceding claim wherein at least one checksum calculation in step (c) is performed on interfacing software residing in the memory of the device, the interfacing software operable to communicate the test data to the memory of the device and to output data from the memory of the device, the interfacing software also being included in the image data for comparison.

8. A method according to any preceding claim wherein the rapidity with which the device outputs checksum calculations is used to determine whether or not the memory of the device includes malicious code.

9. A method according to any preceding claim wherein the device is hindered from accessing memory external thereto during calculation of the checksums in step (c).

10. A method according to any preceding claim wherein a cryptographic hash algorithm is used for calculating the checksums.

11. A testing apparatus operable to apply a method according to any preceding claim to interrogate a code-executing device to determine whether or not the device includes malicious code.