LEVERAGING BEHAVIOR-BASED RULES FOR MALWARE FAMILY CLASSIFICATION

• US 20170083703A1
• Filed: 12/11/2015
• Published: 03/23/2017
• Est. Priority Date: 09/22/2015
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Abbasi, Fahim H., Salam, Abdul, Shahzad, Farrukh
• Granted Patent: US 10,176,321 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/561 Virus type analysis
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

According to one embodiment, a malware classification scheme operating with an electronic device, configured with one or more hardware processors and a memory that stores the software handling the malware classification scheme that is conducted through analysis of behavior-based rules, is described. This malware classification scheme (i) conducts a determination whether a sequence of rules correspond to potential malicious behaviors detected during analysis of a malware sample within one or more virtual machines, and in response to determining that the sequence of rules corresponds to potential malicious behaviors, (ii) conducts an attempt to classify the malware sample to at least one known malware family based on an analysis of the sequence of rules.

Claims

1. An electronic device comprising:

one or more hardware processors; and

a memory coupled to the one or more processors, the memory comprises software that, when executed by the one or more hardware processors, (i) determines whether a sequence of rules correspond to potential malicious behaviors detected during analysis of a malware sample, and in response to determining that the sequence of rules corresponds to potential malicious behaviors, (ii) attempts to classify the sample to at least one known malware family based on an analysis of the sequence of rules.

2. The electronic device of claim 1, wherein the software stored in the memory, when executed by the one or more hardware processors, conducts the attempt to classify the malware sample comprises comparing at least a portion of the sequence of rules to a set of rules associated with the at least one known malware family.

3. The electronic device of claim 1, wherein the software stored in the memory, when executed by the one or more hardware processors, conducts the determination whether the sequence of rules correspond to the potential malicious behaviors comprises (i) monitoring behaviors of the sample during execution within the one or more virtual machines, (ii) organizing the monitored behaviors in accordance with a chronological order as to a time of detection, (iii) determining whether a series of the monitored behaviors are non-compliant with a series of rules, and if so, (iv) including the series of rules as part of the sequence of rules.

4. The electronic device of claim 3, wherein the software stored in the memory, when executed by the one or more hardware processors, conducts the determination whether the sequence of rules correspond to the potential malicious behaviors further comprises (v) assigning a weight value to each rule of the sequence of rules and (vi) removing a rule from the sequence of rules when the weight value assigned to the rule is below a predetermined threshold.

5. The electronic device of claim 1, wherein the memory comprises software that, when executed by the one or more hardware processors, generates electrical alert signals to identify the malware sample and an identified malware family to which the malware sample pertains.

6. The electronic device of claim 1, wherein the software stored in the memory, when executed by the one or more hardware processors, conducts the determination whether the sequence of rules correspond to the potential malicious behaviors comprises (i) monitoring behaviors of the malware sample during execution within the one or more virtual machines, (ii) organizing the monitored behaviors in accordance with a chronological order as to a time of detection, (iii) determining whether a series of the monitored behaviors are compliant with a series of rules, and if so, (iv) including the series of rules as part of the sequence of rules.

7. An electronic device comprising:

one or more hardware processors; and

a memory coupled to the one or more processors, the memory comprises

dynamic analysis logic that includes components that, when executed by the one or more hardware processors, generate one or more virtual machines that are configured to process a malware sample and monitor behaviors of the malware sample during processing within the one or more virtual machines,

correlation logic that, when executed by the one or more hardware processors, conducts a determination as to whether a sequence of rules correspond to potential malicious behaviors detected during analysis of the malware sample within the one or more virtual machines, and

classification logic that, when executed by the one or more hardware processors and in response to determining that the sequence of rules corresponds to potential malicious behaviors, attempts to classify the malware sample to at least one known malware family based on an analysis of the sequence of rules.

8. The electronic device of claim 7, wherein the classification logic stored in the memory, when executed by the one or more hardware processors, attempts to classify the malware sample by comparing at least a portion of the sequence of rules to unique rules associated with the at least one known malware family.

9. The electronic device of claim 7, wherein the correlation logic stored in the memory, when executed by the one or more hardware processors, determines whether the sequence of rules correspond to the potential malicious behaviors by performing operations that comprises (i) monitoring behaviors of the malware sample during execution within the one or more virtual machines, (ii) organizing the monitored behaviors in accordance with a chronological order as to a time of detection, (iii) determining whether a series of the chronologically ordered, monitored behaviors are non-compliant with a series of rules, and if so, (iv) including the series of rules as part of the sequence of rules.

10. The electronic device of claim 9, wherein the series of rules depend on a type of the malware sample where a first series of rules associated with an executable operating as the malware sample is different from a second series of rules associated with a Portable Document Format (PDF) document.

11. The electronic device of claim 9, wherein the series of rules depend on a type of the electronic device where a first series of rules associated with a first type of security appliance is different from a second series of rules associated with a second type of security appliance.

12. The electronic device of claim 9, wherein the correlation logic stored in the memory, when executed by the one or more hardware processors, determines whether the sequence of rules correspond to the potential malicious behaviors by performing operations that further comprises (v) assigning a weight value to each rule of the sequence of rules and (vi) removing a rule from the sequence of rules when the weight value assigned to the rule is below a predetermined threshold.

13. The electronic device of claim 7, wherein the memory further comprises a reporting logic that, when executed by the one or more hardware processors, generates electrical alert signals to identify the malware sample and an identified malware family to which the malware sample pertains.

14. The electronic device of claim 7, wherein the correlation logic stored in the memory, when executed by the one or more hardware processors, determines whether the sequence of rules correspond to the potential malicious behaviors by performing operations that comprises (i) monitoring behaviors of the malware sample during execution within the one or more virtual machines, (ii) organizing the monitored behaviors in accordance with a chronological order as to a time of detection, (iii) determining whether a series of the chronologically ordered, monitored behaviors are compliant with a series of rules, and if so, (iv) including the series of rules as part of the sequence of rules.

15. An electronic device comprising:

one or more hardware processors; and

a memory coupled to the one or more processors, the memory comprises

one or more software components that, when executed by the one or more hardware processors, generates one or more virtual machines that process a malware sample and monitor behaviors by the malware sample during processing within the one or more virtual machines,

correlation logic that, when executed by the one or more hardware processors, determines a sequence of rules that correspond to potential malicious behaviors detected during analysis of a malware sample within one or more virtual machines, and filters the sequence of rules by removal of one or more rules corresponding to one or more potentially malicious behaviors based on severity of the one or more potentially malicious behaviors, and

classification logic that, when executed by the one or more hardware processors, compares the filtered sequence of rules to unique rules associated with a known malware family.

16. The electronic device of claim 15, wherein the correlation logic stored in the memory, when executed by the one or more hardware processors, determines whether the sequence of rules correspond to the potential malicious behaviors by performing operations that comprises (i) monitoring behaviors of the malware sample during execution within the one or more virtual machines, (ii) organizing the monitored behaviors in accordance with a chronological order as to a time of detection, (iii) determining whether a series of the chronologically ordered, monitored behaviors are non-compliant with a series of rules, and if so, (iv) including the series of rules as part of the sequence of rules.

17. The electronic device of claim 16, wherein the series of rules selected for analysis with the series of chronologically ordered, monitored behaviors is based on a type of the malware sample where the series of rules comprises a first series of rules when the malware sample is an executable.

18. The electronic device of claim 17, wherein the series of rules comprises a second series of rules that is different from the first series of rules when the malware sample is a Portable Document Format (PDF) document.

19. The electronic device of claim 16, wherein memory further comprises (i) scanning logic that obtains one or more labels associated with known malware having matching characteristics to characteristics of the malware sample and (ii) label assignment logic to assign a label to a cluster of malware samples including the malware sample.

20. The electronic device of claim 19, the label assignment logic to assign the label that includes information associated with a label most common of the one or more labels obtained by the scanning logic.