NEGATIVE LIGHT-WEIGHT RULES

• US 20130312098A1
• Filed: 05/21/2012
• Published: 11/21/2013
• Est. Priority Date: 05/21/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Kapoor, Aditya, Roberts, Guy
• Granted Patent: US 9,384,349 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements

Abstract

A method for securing an electronic device includes, at a level below all of the operating systems of an electronic device, trapping a first attempt and second attempt to access sensitive system resources of the electronic device. The method also includes identifying the first attempt and second attempt as representing a potential malware attack, comparing the sequence of the first attempt and second attempt against a first anti-malware rule, and, based on the comparison of the sequence of the first attempt and second attempt against the first anti-malware rule, allowing the second attempt. The first attempt and second attempt originate from code of the same operating entity. The first anti-malware rule includes a requirement of a sequence of attempts including the first attempt followed by the second attempt.

Claims

1. A method for securing an electronic device, comprising:

trapping, at a level below all of the operating systems of an electronic device, a first attempt to access sensitive system resources of the electronic device;

identifying the first attempt as representing a potential malware attack on the electronic device;

trapping, at a level below all of the operating systems of an electronic device, a second attempt to access sensitive system resources of the electronic device, the second attempt trapped after the first attempt, the first attempt and second attempt originating from code of the same operating entity;

identifying the second attempt as representing a potential malware attack on the electronic device;

comparing the sequence of the first attempt and second attempt against a first anti-malware rule, the first anti-malware rule including a requirement of a sequence of attempts including the first attempt followed by the second attempt; and

based on the comparison of the sequence of the first attempt and second attempt against the first anti-malware rule, allowing the second attempt.

2. The method according to claim 1, further comprising:

trapping, at a level below all of the operating systems of an electronic device, a third attempt to access sensitive system resources of the electronic device, the third attempt trapped after the second attempt, the third attempt and second attempt originating from code of the same operating entity;

based on the comparison of the sequence of the first attempt and second attempt against the first anti-malware rule, allowing the third attempt.

3. The method according to claim 1, further comprising:

trapping, at a level below all of the operating systems of an electronic device, a third attempt and a fourth attempt to access sensitive system resources of the electronic device, the third and fourth attempt originating from code of the same operating entity;

identifying the third attempt and fourth attempt as potential malware attacks on the electronic device;

determining that a malware status of the fourth attempt is unknown;

comparing the sequence of the third attempt and fourth attempt against a second anti-malware rule, the anti-malware rule including a requirement of a sequence of attempts including the third attempt followed by the fourth attempt followed by a fifth attempt, the fifth attempt identified as accessing a designated portion of the sensitive system resources of the electronic device;

determining that the fifth attempt has not occurred; and

based upon the determination that the fifth attempt has not occurred and upon the determination that the malware status of the fourth attempt is unknown and upon the second anti-malware rule, taking a default action upon the fourth attempt.

4. The method according to claim 1, further comprising determining that the first attempt and the second attempt are not known to be safe.

5. The method according to claim 1, wherein the sequence of attempts included within the first anti-malware rule is an ordered sequence of attempts.

6. A system for securing an electronic device, comprising:

a memory;

a processor;

a plurality of sensitive system resources; and

one or more security agents including instructions resident in the memory and operable for execution by the processor, wherein;

one of the security agents is configured to;

trap, at a level below all of the operating systems of the electronic device, a first attempt to access one of the sensitive system resources; and

trap, at a level below all of the operating systems of the electronic device, a second attempt to access one of the sensitive system resources, the second attempt trapped after the first attempt, the first attempt and second attempt originating from code of the same operating entity; and

one of the security agents is configured to;

identify the first attempt as representing a potential malware attack on the electronic device;

identify the second attempt as representing a potential malware attack on the electronic device;

compare the sequence of the first attempt and second attempt against a first anti-malware rule, the first anti-malware rule including a requirement of a sequence of attempts including the first attempt followed by the second attempt; and

based on the comparison of the sequence of the first attempt and second attempt against the first anti-malware rule, allow the second attempt.

7. The system according to claim 6, wherein:

one of the security agents is further configured to trap, at a level below all of the operating systems of the electronic device, a third attempt to access one of the sensitive system resources, the third attempt trapped after the second attempt, the third attempt and second attempt originating from code of the same operating entity; and

one of the security agents is configured to, based on the comparison of the sequence of the first attempt and second attempt against the first anti-malware rule, allow the third attempt.

8. The system according to claim 6, wherein:

one of the security agents is further configured to;

trap, at a level below all of the operating systems of the electronic device, a third attempt and a fourth attempt to the access sensitive system resources, the third attempt and fourth attempt originating from code of the same operating entity; and

one of the security agents is further configured to;

identify the third attempt and fourth attempt as representing a potential malware attack on the electronic device;

determine that a malware status of the fourth attempt is unknown;

compare the sequence of the third attempt and fourth attempt against a second anti-malware rule, the anti-malware rule including a requirement of a sequence of attempts including the third attempt followed by the fourth attempt followed by a fifth attempt, the fifth attempt identified as accessing a designated portion of the sensitive system resources of the electronic device;

determine that the fifth attempt has not occurred; and

based upon the determination that the fifth attempt has not occurred and upon the determination that the malware status of the fourth attempt is unknown and upon the second anti-malware rule, take a default action upon the fourth attempt.

9. The system according to claim 6, wherein one of the security agents is configured to determine that the first attempt and the second attempt are not known to be safe.

10. The system according to claim 6, wherein the sequence of attempts included within the first anti-malware rule is an ordered sequence of attempts.

11. An article of manufacture, comprising:

a computer readable medium;

computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when executed, for causing the processor to;

trap, at a level below all of the operating systems of an electronic device, a first attempt to access one of a plurality of sensitive system resources of the electronic device; and

trap, at a level below all of the operating systems of the electronic device, a second attempt to access one of the sensitive system resources, the second attempt trapped after the first attempt, the first attempt and second attempt originating from code of the same operating entity; and

identify the first attempt as representing a potential malware attack on the electronic device;

identify the second attempt as representing a potential malware attack on the electronic device;

compare the sequence of the first attempt and second attempt against a first anti-malware rule, the first anti-malware rule including a requirement of a sequence of attempts including the first attempt followed by the second attempt; and

based on the comparison of the sequence of the first attempt and second attempt against the first anti-malware rule, allow the second attempt.

12. The article according to claim 11, wherein the processor is further caused to:

trap, at a level below all of the operating systems of the electronic device, a third attempt to access one of the sensitive system resources, the third attempt trapped after the second attempt, the third attempt and second attempt originating from code of the same operating entity; and

based on the comparison of the sequence of the first attempt and second attempt against the first anti-malware rule, allow the third attempt.

13. The article according to claim 11, wherein the processor is further caused to:

trap, at a level below all of the operating systems of the electronic device, a third attempt and a fourth attempt to the access sensitive system resources, the third attempt and fourth attempt originating from code of the same operating entity; and

identify the third attempt and fourth attempt as representing a potential malware attack on the electronic device;

determine that a malware status of the fourth attempt is unknown;

compare the sequence of the third attempt and fourth attempt against a second anti-malware rule, the anti-malware rule including a requirement of a sequence of attempts including the third attempt followed by the fourth attempt followed by a fifth attempt, the fifth attempt identified as accessing a designated portion of the sensitive system resources of the electronic device;

determine that the fifth attempt has not occurred; and

based upon the determination that the fifth attempt has not occurred and upon the determination that the malware status of the fourth attempt is unknown and upon the second anti-malware rule, take a default action upon the fourth attempt.

14. The article according to claim 11, wherein the processor is further caused to determine that the first attempt and the second attempt are not known to be safe.

15. The article according to claim 11, wherein the sequence of attempts included within the first anti-malware rule is an ordered sequence of attempts.