System and method for detecting malicious applications

• US 7,788,724 B2
• Filed: 04/10/2003
• Issued: 08/31/2010
• Est. Priority Date: 04/10/2003
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Gabriel, Basil, Spiegel, Mark
• Primary Examiner(s): Parthasarathy; Pramila
• Application Number:
  US10/412,708
• Publication Number:
  US 20040205354A1
• Time in Patent Office: 2,700 Days
• Field of Search: 726 2- 33
• US Class Current: 726/25
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A system and method are disclosed for detecting malicious computer applications. According to an embodiment of the present invention, it is determined whether a communication is attempting to occur, wherein the communication is associated with a first application. It is also determined whether there is a second application associated with the first application; and also determined whether the second application is trusted.

Claims

1. A method for handling communications associated with computer applications comprising:

determining whether a communication from a first computer to a second computer is attempting to occur, wherein the communication is associated with a first application that is trusted;

determining whether a second application launched the first application;

determining whether the second application is trusted; and

initiating a security response relating to the communication in the event it is determined that the second application is not trusted.

2. The method of claim 1, further comprising associating the first application with the second application in a process tree.

3. The method of claim 1, further comprising listing the second application in a warning if it is determined that the second application is not trusted.

4. The method of claim 1, further comprising determining whether there is an untrusted launcher warning.

5. The method of claim 1, further comprising allowing the communication if there is no warning.

6. The method of claim 1, further comprising allowing the communication if the first application and second application are trusted.

7. The method of claim 1, further comprising allowing the communication if a user permits the communication.

8. The method of claim 7, further comprising adding the second application to a list of trusted launchers if the user permits the communication.

9. A system for handling communications associated with computer applications comprising:

a processor configured to;

determine whether a communication from a first computer to a second computer is attempting to occur, wherein the communication is associated with a first application;

determine whether a second application launched the first application;

determine whether the second application is trusted; and

initiate a security response relating to the communication in the event it is determined that the second application is not trusted; and

a memory coupled with the processor, wherein the memory provides instructions to the processor.

10. The system of claim 9, wherein the processor is further configured to list the second application in a warning if it is determined that the second application is not trusted.

11. The system of claim 9, wherein the processor is further configured to determine whether there is an untrusted launcher warning.

12. The system of claim 9, wherein the processor is further configured to allow the communication if a user permits the communication.

13. The system of claim 12, wherein the processor is further configured to add the second application to a list of trusted launchers if the user permits the communication.

14. A non-transitory computer-readable storage medium for handling communications associated with computer applications, the storage medium comprising computer instruction for:

determining whether a communication from a first computer to a second computer is attempting to occur, wherein the communication is associated with a first application;

determining whether a second application launched the first application;

determining whether the second application is trusted; and

initiating a security response relating to the communication in the event it is determined that the second application is not trusted.