Malware Detector

• US 20110099620A1
• Filed: 04/09/2010
• Published: 04/28/2011
• Est. Priority Date: 04/09/2009
• Status: Active Grant

• Current Assignee: George Mason Research Foundation Inc.
• Original Assignee: George Mason Research Foundation Inc.
• Inventors: Stavrou, Angelos, Andrianakis, Charalampos, Martin, Rhandi, Ghosh, Anup, Jajodia, Sushil
• Granted Patent: US 8,935,773 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A transparent proxy for malware detection includes a monitor module, a protocol determination module, a challenge generation module, a response determination module, and a data control module. The monitor module examines data originating from an application towards a remote server. The protocol determination module identifies the protocol type used for the data. The challenge generation module produces a challenge for the application based upon the protocol type, sends the challenge to the application, and maintains a state related to the data and the challenge. The response determination module makes a determination if an automatic non-interactive application response is received in response to the challenge from the application. The data control module allows the first data to continue to the remote server when the determination is valid. The data control module reports malware detection and blocks the data to continue to the remote server when the determination is invalid.

Claims

1. A transparent proxy, comprising:

a) a monitor module configured to examine first data originating from at least one application running on a computing machine towards a remote server, said at least one application expecting a server response from said remote server;

b) a protocol determination module configured to identify the protocol type used for said first data generated from one of said at least one application;

c) a challenge generation module configured to;

i) produce a challenge for said one of said at least one application based upon said protocol type;

ii) send said challenge to said one of said at least one application

iii) maintain a state related to;

(1) said data; and

(2) said challenge;

d) a response determination module configured to make a determination if an automatic non-interactive application response is received in response to said challenge from said one of said at least one application;

e) a first data control module configured to;

i) allow said first data to continue to said remote server when said determination is valid; and

ii) block said first data to continue to said remote server when said determination is invalid.

2. A transparent proxy according to claim 1, wherein said first data control module if further configured to:

a) allow said server response from said remote server to be received by said one of said at least one application when said determination is valid; and

b) block said server response from said remote server to be received by said one of said at least one application when said determination is invalid.

3. A transparent proxy according to claim 1, further comprising a malware classification module configured to determine a malicious software running on said computing machine.

4. A transparent proxy according to claim 3, wherein said malware software is determined using at least one of the following:

a) said first data;

b) said at least one application; and

c) said automatic non-interactive application response.

5. A transparent proxy according to claim 1, further comprising a reporting module configured to report if said determination is invalid.

6. A transparent proxy according to claim 1, wherein said transparent proxy is located on a network edge and examines outgoing traffic.

7. A transparent proxy according to claim 1, wherein said protocol determination module uses protocol fingerprinting to identify said protocol type.

8. A transparent proxy according to claim 1, wherein said challenge generated by the challenge generation module is further based upon said one of said at least one application state when transmitting said first data.

9. A transparent proxy according to claim 1, wherein said challenge is non-disruptive to said at least one application and is transparent to users.

10. A transparent proxy according to claim 1, wherein said at least one application is one of the following:

a) a Web browser;

b) a VOIP application;

c) a peer-to-peer application;

d) a database client; and

e) a database server.

11. A transparent proxy according to claim 1, wherein said protocol type is one of the following:

a) a HTTP;

b) a VOIP protocol;

c) a Session Description Protocol;

d) a Session Initiation Protocol; and

e) a Real Time Transport Control Protocol.

12. A transparent proxy according to claim 1, wherein said application response does not involve the end application user.

13. A transparent proxy according to claim 1, wherein said one of said at least one application is a Web browser and said challenge is an encoded redirect request that is triggered after the page is processed by the targeted said Web browser engine.

14. A transparent proxy, comprising:

a) a monitor module configured to examine first data originating from at least one application running on a computing machine towards a remote server, said at least one application expecting a server response from said remote server;

b) a protocol determination module configured to identify the protocol type used for said first data generated from one of said at least one application;

c) a challenge generation module configured to;

i) produce a challenge for said one of said at least one application based upon said protocol type;

ii) send said challenge to said one of said at least one application

iii) maintain a state related to;

(1) said data; and

(2) said challenge;

d) a response determination module configured to make a determination if an automatic non-interactive application response is received in response to said challenge from said one of said at least one application;

e) a first data control module configured to;

i) allow said server response from said remote server to be received by said one of said at least one application when said determination was valid; and

ii) block said server response from said remote server to be received by the said one of said at least one application when said determination was invalid.

15. A transparent proxy according to claim 14, wherein said first data control module if further configured to:

a) allow said first data to continue to said remote server when said determination is valid; and

b) block said first data to continue to said remote server when said determination is invalid.

16. A transparent proxy, comprising:

a) a monitor module configured to examine first data originating from at least one application running on a computing machine towards a remote server, said at least one application expecting a server response from said remote server;

b) a protocol determination module configured to identify the protocol type used for said first data generated from one of said at least one application;

c) a challenge generation module configured to;

i) produce a challenge for said one of said at least one application based upon said protocol type;

ii) send said challenge to said one of said at least one application

iii) maintain a state related to;

(1) said data; and

(2) said challenge; and

d) a response determination module configured to make a determination if an automatic non-interactive application response is received in response to said challenge from said one of said at least one application.

17. A transparent proxy according to claim 16, further comprising a first data control module configured to:

a) allow said server response from said remote server to be received by said one of said at least one application when said determination was valid; and

b) block said server response from said remote server to be received by the said one of said at least one application when said determination was invalid.

18. A transparent proxy according to claim 16, wherein said first data control module if further configured to:

a) allow said first data to continue to said remote server when said determination is valid; and

b) block said first data to continue to said remote server when said determination is invalid.

19. A transparent proxy according to claim 16, further comprising a malware classification module configured to determine a malicious software running on said computing machine.

20. A transparent proxy according to claim 16, further comprising a reporting module configured to report if said determination is invalid.