ZERO-DAY DISCOVERY SYSTEM

• US 20140380473A1
• Filed: 06/24/2013
• Published: 12/25/2014
• Est. Priority Date: 06/24/2013
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Bu, Zheng, Lin, Yichong
• Granted Patent: US 10,133,863 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware

Abstract

A method for determining a zero-day attack by an electronic device is described. According to one embodiment, the method comprises instantiating, by the electronic device, at least one virtual machine, the at least one virtual machine being based on a fortified software profile. The method further comprises executing content capable of behaving as an exploit on the at least one virtual machine, and determining that the exploit is associated with zero-day exploit when the exploit, upon execution of the content on the at least one virtual machine, performs an undesired behavior.

Claims

1. A method for determining a zero-day attack by an electronic device, comprising:

instantiating, by the electronic device, at least one virtual machine, the at least one virtual machine being based on a fortified software profile;

executing content capable of behaving as an exploit on the at least one virtual machine; and

determining that the exploit is associated with zero-day exploit when the exploit, upon execution of the content on the at least one virtual machine, performs an undesired behavior.

2. The method of claim 1, wherein prior to instantiating the at least one virtual machine based on the first fortified software profile, the method further comprises

instantiating, by the electronic device, at least a first virtual machine based on a vulnerable software profile;

executing suspicious content on at least the first virtual machine; and

determining the exploit if the suspicious content, upon execution within the first virtual machine, performs an undesired behavior.

3. The method of claim 1 further comprising:

instantiating, by the electronic device, at least a first virtual machine based on a vulnerable software profile;

executing suspicious content on at least the first virtual machine; and

determining the exploit if the suspicious content, upon execution within the first virtual machine, performs an undesired behavior.

4. The method of claim 1, wherein the fortified software profile identifying software updated with one or more security patches to address known exploits targeted for the software.

5. The method of claim 1, wherein the fortified software profile identifying a most recent version of software updated to address known exploits targeted for the software.

6. The method of claim 3, wherein the fortified software profile identifying software updated with one or more security patches to address known exploits targeted for the software.

7. The method of claim 6, wherein the vulnerable software profile identifying software without security patches to address the known exploits.

8. The method of claim 6, wherein the fortified software profile identifying a type of an operating system and a version number of the operating system.

9. The method of claim 8, wherein the fortified software profile further identifying one or more applications and a version number for each of the one or more applications.

10. The method of claim 1, wherein the at least one virtual machine comprises (1) a first virtual machine based on a first fortified software profile associated with a first version of an operating system upgraded with one or more security patches directed to known exploits and (2) a second virtual machine based on a second fortified software profile associated with a second version of the operating system upgraded to address vulnerabilities exploited by the previously known exploits.

11. An electronic device, comprising:

a communication interface logic adapted to receive incoming content; and

one or more hardware processors in communication with the communication interface logic, the one or more hardware processors to (i) instantiate at least a first virtual machine being based on a fortified software profile, (ii) control execution of content capable of behaving as an exploit on at least the first virtual machine, and (iii) determine whether the exploit is associated with a zero-day exploit if the exploit, upon execution on the first virtual machine, performs an undesired behavior.

12. The electronic device of claim 11, wherein the one or more hardware processors further (i) instantiating a second virtual machine based on a vulnerable software profile, (ii) executing suspicious content on the second virtual machine, and (iii) determining the exploit if the suspicious content, upon execution within the second virtual machine, performs an undesired behavior different than the undesired behavior detected by the first virtual machine.

13. The electronic device of claim 11, wherein the fortified software profile identifying software updated with one or more security patches to address already known exploits targeted for the software.

14. The electronic device of claim 11, wherein the fortified software profile identifying a most recent version of software updated to address known exploits targeted for the software.

15. The electronic device of claim 12, wherein the fortified software profile identifying one of (i) software updated with one or more security patches to address known exploits targeted for the software and (ii) a most recent version of the software updated to address known exploits targeted for the software.

16. The electronic device of claim 15, wherein the fortified software profile identifying a type of an operating system and a version number of the operating system.

17. The electronic device of claim 16, wherein the fortified software profile further identifying one or more applications and a version number for each of the one or more applications.

18. The electronic device of claim 15, wherein the vulnerable software profile identifying software without security patches to address the known exploits.

19. The electronic device of claim 11, wherein the one or more hardware processors instantiating at least (1) the first virtual machine based on a first fortified software profile associated with a first version of an operating system upgraded to addresses vulnerabilities exploited by previously known exploits and (2) a second virtual machine based on a second fortified software profile associated with a second version of the operating system upgraded to address vulnerabilities exploited by the previously known exploits.

20. A non-transitory storage medium to contain software that, when executed by one or more processors within an electronic device, performs operations comprising:

intercepting content propagating over a transmission medium being part of a network;

determining a software profile for the incoming content based on information associated with the intercepted content;

instantiating, by the one or more processors, a first virtual machine being based on an earlier version of software identified in the software profile,

determining, by the first virtual machine executed by the one or more processors, whether the intercepted content includes an exploit when the intercepted content, upon processing by the first virtual machine, performs an undesired behavior;

instantiating, by the one or more processors, a second virtual machine being based on an updated version of software identified in the software profile, where the updated version of the software includes one or more security patches to address already known exploits targeted for the software;

determining whether the exploit uncovered by the first virtual machine is a zero-day exploit if information associated with the exploit, upon execution on the second virtual machine by the one or more processors, performs an undesired behavior.

21. The non-transitory storage medium of claim 20, wherein the software profile identifying a type of an operating system and a version number of the operating system.

22. The non-transitory storage medium of claim 21, wherein the software profile further identifying one or more applications and a version number for each of the one or more applications.

23. The non-transitory storage medium of claim 22, wherein the software profile identifying the earlier version of the software where the software is without security patches to address the known exploits.