SYSTEMS AND METHODS TO DETECT MALICIOUS MEDIA FILES

• US 20110321160A1
• Filed: 06/24/2010
• Published: 12/29/2011
• Est. Priority Date: 06/24/2010
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Mohandas, Rahul, Thomas, Vinoo, Prashanth, Palasamudram Ramagopal
• Granted Patent: US 8,510,829 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Systems and method to detect malicious media file are described. In one example, an apparatus including a network connection, a memory, and a programmable processor communicatively coupled to the memory is discussed. The memory can include instructions, which when executed by the programmable processor cause the apparatus to receive a data stream from the network connection and detect at least a portion of a media file within the data stream. The instructions can also cause the apparatus to determine a file type of the media file and extract the media file from the data stream. Further, the instructions cause the apparatus to parse the media file to location a suspicious tag, extract an embedded URL from the suspicious tag, determine with the embedded URL is malicious, and block the media file if the embedded URL is malicious.

Claims

1. An apparatus comprising:

a network connection;

a memory including instructions stored thereon; and

a programmable processor communicatively coupled to the memory, wherein the instructions, when executed by the programmable processor, cause the programmable processor to;

receive a data stream from the network connection;

detect, within the data stream, at least a portion of a media file;

determine a file type of the media file from the detected portion of the media file;

extract the media file from the data stream received from the network connection;

parse the media file to locate a suspicious tag, wherein the suspicious tag is part of a set of tags and wherein the set of tags vary as a function of file type;

extract an embedded uniform resource locator (URL) from the suspicious tag;

determine whether the embedded URL is malicious; and

block the media file if the embedded URL is malicious.

2. The apparatus of claim 1, wherein the instructions cause the programmable processor to determine whether the embedded URL is malicious by comparing the embedded URL signature against a plurality of known URL signatures.

3. The apparatus of claim 2, wherein the instructions cause the programmable processor to determine whether the embedded URL is malicious by comparing the embedded URL signature against a plurality of known malicious URLs and known good URLs.

4. The apparatus of claim 1, wherein the instructions cause the programmable processor to determine whether the embedded URL is malicious by:

determining whether the embedded URL matches a known malicious URL within a local database; and

submitting the embedded URL to a domain reputation system, if a match is not found within the local database, the domain reputation system to analyze the embedded URL against a centralized database.

5. The apparatus of claim 1, wherein the instructions cause the programmable processor to detect a media file in the data stream by identifying a media file object tag within the data stream.

6. The apparatus of claim 1, wherein the instructions cause the programmable processor to determine a file type of the media file by determining that the media file is one of the media file types in the following group of media file types:

Advanced System Format (ASF);

QuickTime File Format; and

Real Media File Format.

7. The apparatus of claim 1, wherein the instructions cause the programmable processor to parse the media file by searching within the media file for signatures matching the suspicious tags associated with the file type.

8. A method comprising:

receiving data from an incoming network connection;

detecting, within the data, at least a portion of a media file;

determining a file type of the media file from the detected portion of the media file;

extracting the media file from the data received from the incoming network connection;

parsing the media file to locate a suspicious tag, wherein the suspicious tag is part of a set of tags and wherein the set of tags vary as a function of file type;

extracting an embedded uniform resource locator (URL) from the suspicious tag;

determining whether the embedded URL is malicious; and

blocking the media file if the embedded URL is malicious.

9. The method of claim 8, wherein determining whether the embedded URL is malicious includes comparing an embedded URL signature against a plurality of known URL signatures.

10. The method of claim 9, wherein the plurality of known URL signatures includes known malicious URLs and known good URLs.

11. The method of claim 8, wherein determining whether the embedded URL is malicious includes:

determining whether the embedded URL matches a known malicious URL within a local database; and

submitting the embedded URL to a domain reputation system, if a match is not found within the local database, the domain reputation system to analyze the embedded URL against a centralized database.

12. The method of claim 8, wherein the detecting a media file includes identifying a media file related object tag within a web page.

13. The method of claim 8, wherein the determining a file type of the media file includes determining that the media file is one of the media file types in the following group of media file types:

Advanced System Format (ASF);

QuickTime File Format; and

Real Media File Format.

14. The method of claim 8, wherein the parsing the media file includes searching within the media file for signatures matching the suspicious tags associated with the file type.

15. A system comprising:

a local network;

a database including data related to potentially malicious URLs; and

a computer communicatively coupled to the database, the computer including;

a network interface connecting the computer to the local network;

a memory containing instructions; and

one or more processors communicatively coupled to the memory, wherein the instructions, when executed by the one or more processors, cause the computer to;

monitor data transferred over the network through the network interface;

detect, within the data transferred over the network, at least a portion of a media file;

divert the media file into the memory;

determine a file type of the media file from the detected portion of the media file;

parse the media file to locate suspicious tags, wherein the suspicious tags are part of a set of tags and wherein the set of tags vary as a function of file type;

extract an embedded uniform resource locator (URL) from a suspicious tag;

determine whether the embedded URL is malicious; and

discard the media file if the embedded URL is malicious.

16. The system of claim 15, wherein the instructions cause the computer further to transmit the media file on to an original destination of the media file if the embedded URL is not malicious.

17. The system of claim 15, wherein the database is connected to the local network;

and

wherein the instructions cause the computer to determine whether the embedded URL is malicious by comparing the embedded URL against data related to potentially malicious URLs in the database.

18. The system of claim 17, wherein the database includes a plurality of URL signatures including signatures of known good URLs and known malicious URLs.

19. The system of claim 15 further comprising:

an external network connected to the local network through a gateway device;

a domain reputation system connected to the external network; and

wherein the instructions cause the computer to determine whether the embedded URL is malicious by;

determining whether the embedded URL matches data related to potentially malicious URLs within the database; and

submitting the embedded URL to the domain reputation system, if a match is not found within the database, the domain reputation system to analyze the embedded URL against a centralized reputation database.

20. The system of claim 19, wherein the computer further includes a second network interface connected to the external network;

and

wherein the memory further includes instructions that cause the computer to function as the gateway device.