Applying Antimalware Logic without Revealing the Antimalware Logic to Adversaries

• US 20120317644A1
• Filed: 06/09/2011
• Published: 12/13/2012
• Est. Priority Date: 06/09/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kumar, Ajith, Marinescu, Adrian M., Seinfeld, Marc E., Stokes, Jack Wilson III, Thomas, Anil Francis, Fraser, Timothy Jon
• Granted Patent: US 8,955,133 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

The subject disclosure is directed towards a technology by which antimalware detection logic is maintained and operated at a backend service, with which a customer frontend machine communicates (queries) for purposes of malware detection. In this way, some antimalware techniques are maintained at the backend service rather than revealed to antimalware authors. The backend antimalware detection logic may be based upon feature selection, and may be updated rapidly, in a manner that is faster than malware authors can track. Noise may be added to the results to make it difficult for malware authors to deduce the logic behind the results. The backend may return results indicating malware or not malware, or return inconclusive results. The backend service may also detect probing-related queries that are part of an attempt to deduce the unrevealed antimalware detection logic, with noisy results returned in response and/or other actions taken to foil the attempt.

Claims

1. In a computing environment, a method performed at least in part on at least one processor, comprising, receiving a malware-related query at a backend service, processing data associated with the malware-related query at the backend service, including via updateable detection logic that is not revealed outside of the backend service, to determine whether the data associated with the malware-related query corresponds to detected malware, and returning a corresponding result in response to the query indicating whether the data associated with the malware-related query corresponds to detected malware.

2. The method of claim 1 wherein processing the data associated with the malware-related query comprises determining that additional data is needed, requesting the additional data from the client, receiving the additional data from the client, and using at least some of the additional data as at least part of the data associated with the malware-related query that is processed to determine the corresponding result.

3. The method of claim 1 wherein the data associated with the malware-related query comprises feature data, and wherein processing the data associated with the malware-related query comprises classifying the feature data via at least one feature-based classifier.

4. The method of claim 3 further comprising, extracting the feature data at a frontend client, and sending the feature data with the malware-related query from the frontend client to the backend service.

5. The method of claim 1 further comprising, updating the updateable detection logic based upon one or more updating criteria.

6. The method of claim 1 wherein the updateable detection logic comprises a set of classifiers, and further comprising, updating the updateable detection logic by changing at least one classifier in the set.

7. The method of claim 6 wherein the classifiers are feature-based classifiers, and further comprising selecting a subset of features based upon training data and training the classifiers based upon the selected subset of features.

8. The method of claim 1 further comprising, providing noise that changes the result to indicate that the data associated with the malware-related query does not correspond to detected malware when the processing determined that the malware-related query does correspond to detected malware.

9. The method of claim 1 further comprising, determining that the query is part of a probing attempt.

10. The method of claim 9 further comprising, providing noise that changes the result to indicate that the data associated with the malware-related query does not correspond to detected malware when the processing determined that the malware-related query does correspond to detected malware.

11. The method of claim 9 further comprising, taking action to analyze program code from which the data associated with the malware-related query is obtained.

12. In a computing environment, a system comprising, a backend service, the backend service configured with malware detection logic, the malware detection logic configured to process data associated with queries to determine whether for each query the data associated with that query is indicative of malware, the backend service further configured to respond to each query with a result indicating whether the logic determined the data to be indicative of malware, or with a request for more associated data from which the result may be determined, and the backend service further comprising an unpredictability mechanism configured to operate to keep antimalware techniques in the malware detection logic from being deduced based upon the returned result.

13. The system of claim 12 wherein the data associated with the query includes feature data, and wherein the malware detection logic includes at least one feature-based classifier.

14. The system of claim 12 wherein the unpredictability mechanism operates to update the malware detection logic, or to vary at least one result that is returned in response to a corresponding query, or both.

15. The system of claim 12 wherein the unpredictability mechanism operates to determine when a query is part of a probe attempt, and is configured to take action with respect to a query that is determined to be part of a probe attempt.

16. The system of claim 15 wherein the unpredictability mechanism takes action to vary the result of the query that is determined to be part of a probe attempt.

17. One or more computer-readable media having computer-executable instructions, which when executed perform steps of a process, comprising:

receiving a query and associated data at a backend service, in which the associated data is received with the query or received via one or more subsequent communications, or via a combination of both;

processing the associated data at the backend service to detect that the data corresponds to malware, and returning a response corresponding to the query including a result indicating that malware was detected;

taking an action at the backend service that is capable of providing a different result if given another query with similar associated data;

receiving another query with similar associated data at the backend service in which the similar associated data is received with the query or received via one or more subsequent communications, or via a combination of both; and

returning a response corresponding to the other query including a result indicating that malware was not detected.

18. The one or more computer-readable media of claim 17 wherein taking the action comprises updating malware detection logic between processing the associated data and processing the similar associated data.

19. The one or more computer-readable media of claim 17 wherein taking the action comprises applying a noise component that changes the result to a different result.

20. The one or more computer-readable media of claim 17 having further computer-executable instructions comprising, detecting that the other query is part of a probing attempt, and wherein taking the action comprises applying a noise component, based upon detecting that the other query is part of a probing attempt, which changes the result to a different result.