Method and apparatus for the automatic determination of potentially worm-like behavior of a program

• US 7,996,905 B2
• Filed: 04/03/2008
• Issued: 08/09/2011
• Est. Priority Date: 07/23/2002
• Status: Expired due to Fees

• Current Assignee: Finjan Blue, Inc. (SoftBank Group Corp.)
• Original Assignee: Trend Micro Inc.
• Inventors: Whalley, Ian N., Morar, John F., Arnold, William C., Segal, Alla, Chess, David M., White, Steve R.
• Primary Examiner(s): Moorthy; Aravind K
• Application Number:
  US12/062,152
• Publication Number:
  US 20080189787A1
• Time in Patent Office: 1,223 Days
• Field of Search: 726/24, 726/25, 713/151, 713/188
• US Class Current: 726/24
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability

Abstract

A method and system for the automatic determination of the behavioral profile of a program suspected of having worm-like characteristics includes analyzing data processing system resources required by the program and, if the required resources are not indicative of the program having worm-like characteristics, running the program in a controlled non-network environment while monitoring and logging accesses to system resources to determine the behavior of the program in the non-network environment. A logged record of the observed behavior is analyzed to determine if the behavior is indicative of the program having worm-like characteristics. The non-network environment may simulate the appearance of a network to the program, without emulating the operation of the network.

Claims

1. A method for the automatic determination of a behavioral profile of a sample program suspected of having worm-like characteristics, comprising analyzing data processing system resources required by the sample program and, if the required resources are not indicative of the sample program having worm-like characteristics, running the sample program in a controlled non-network environment while monitoring and logging accesses to system resources to determine the behavior of the sample program in the non-network environment, where the non-network environment simulates the appearance of a network to the sample program without emulating the operation of the network.

2. A method as in claim 1, where a behavioral profile of a program having worm-like characteristics comprises a program that performs one or more of:

importing a send method from a network dll, changing a network resource or attempting to access a system registry for obtaining information that is descriptive of an installed electronic mail program.

3. A non-transitory computer readable storage medium storing a computer program for implementing a method for the automatic determination of a behavioral profile of a sample program suspected of having worm-like characteristics, where the execution of the computer program causes a computer to analyze computer system resources required by the sample program and, if the required resources are not indicative of the sample program having worm-like characteristics, further execution of the computer program causes the computer to run the sample program in a controlled non-network environment while monitoring and logging accesses to system resources to determine the behavior of the sample program in the non-network environment, where said further execution of the computer program causes the computer to simulate the appearance of a network to the sample program without emulating the operation of the network.

4. A computer readable storage medium as in claim 3, where a behavioral profile of a program having worm-like characteristics comprises a program that performs one or more of:

importing a send method from a network dll, changing a network resource or attempting to access a system registry for obtaining information that is descriptive of an installed electronic mail program.

5. A computer readable storage medium as in claim 3, where resources indicative of the sample program having worm-like characteristics comprise:

dynamic link libraries for network access, methods imported from the dynamic link libraries that indicate possible attempts to send electronic mail and dynamic link libraries and methods indicating the automation of existing mail programs.

6. A computer readable storage medium as in claim 3, where the behavioral profile comprises:

changes made by the sample program to one or more network dlls, creation by the sample program of one or more files with a VBS extension and creation by the sample program of any new files and corresponding changes to and/or creation of system initialization files that would cause a replacement of at least one network dll with a new file.

7. A data processing system comprising at least one computer configured to execute a stored program for making an automatic determination of potentially worm-like behavior of a sample program, comprising:

means for determining a behavioral profile of the sample program in an environment that does not emulate the operation of a network, where said means for determining the behavioral profile comprises means for executing the sample program in at least one known non-network environment that simulates the appearance of a network to the sample program without emulating the operation of the network;

means for comparing the determined behavioral profile against a stored profile indicative of worm-like behavior; and

means for providing an indication of potentially worm-like behavior based on the result of the comparison.

8. A data processing system as in claim 7, where said determining means further determines said behavioral profile by determining what system resources are required by the sample program.

9. A data processing system as in claim 7, where said determining means further determines said behavioral profile by determining what system resources are referred to by the sample program.

10. A data processing system as in claim 7, where said determining means further comprises:

means for examining the environment and determining what changes, if any, have occurred in the environment; and

means for recording any determined changes as said behavioral profile.

11. A data processing system as in claim 7, where, in response to the sample program seeking to determine if the environment has network capabilities, said executing means provides a network address to the sample program as an inducement for the sample program to display worm-like behavior.

12. A data processing system as in claim 7, where the known non-network environment exhibits at least one of non-existent local resources and objects to the sample program.

13. A data processing system as in claim 12, where, in response to the sample program seeking to determine information about a file, said executing means responds as if the file exists as an inducement for the sample program to display worm-like behavior.

14. A data processing system as in claim 12, where, in response to the sample program seeking to determine information about a file, said executing means creates the file before returning the file to the sample program as an inducement for the sample program to display worm-like behavior.

15. A data processing system as in claim 12, where, in response to the sample program seeking to determine information about an electronic mail program, said executing means returns the information to the sample program as an inducement for the sample program to display worm-like behavior.

16. A data processing system as in claim 12, where, in response to the sample program seeking to determine information about an electronic mail address book, said executing means returns the information to the sample program as an inducement for the sample program to display worm-like behavior.

17. A data processing system as in claim 7, where said determining means exercises the sample program in a plurality of ways.

18. A data processing system as in claim 7, where said determining means determines a dynamic link library usage of the sample program.

19. A data processing system as in claim 7, where said determining means determines the identities of methods imported by the sample program from a library.

20. A data processing system as in claim 7, where said determining means determines what resources are requested by the sample program.

21. A data processing system as in claim 20, where said resources comprise at least one of dynamic link libraries for network access, methods imported from dynamic link libraries that indicate a possible attempt to send electronic mail, and dynamic link libraries and methods indicating an automation of an electronic mail program.

22. A data processing system as in claim 7, where said determining means determines if system resources requested by the sample program match certain predetermined system resources and, if so, executing means executes the sample program in a controlled environment, determines if system changes made during execution of the sample program match certain predetermined system changes and, if so, declares the sample program to be a possible worm, and if not, determines if activities reported by a program behavior monitor match certain predetermined activities and, if so, declares the sample program to be a possible worm.

23. A non-transitory computer readable storage medium storing a computer program for implementing a method for the automatic determination of potentially worm-like behavior of a sample program, where the execution of the computer program causes a computer to determine a behavioral profile of the sample program in an environment that does not emulate the operation of a network, where the determination of the behavioral profile comprising comprises executing the ˜

program in at least one known non-network environment that simulates the appearance of a network to the sample program without emulating the operation of the network;

to compare the determined behavioral profile against a profile indicative of worm-like behavior; and

to provide an indication of potentially worm-like behavior based on the result of the comparison.

24. A computer readable storage medium as in claim 23, where the behavioral profile is further determined by determining at least one of what system resources are required by the sample program and what system resources are referred to by the sample program.

25. A computer readable storage medium as in claim 23, where the determination of the behavioral profile further comprises using an automated method for examining the environment and determining what changes, if any, have occurred in the environment;

and recording any determined changes as said behavioral profile.

26. A computer readable storage medium as in claim 23, where determining the behavioral profile of the sample program further comprises determining what resources are requested by the sample program.

27. A computer readable storage medium as in claim 26, where said resources comprise at least one of dynamic link libraries for network access, methods imported from dynamic link libraries that indicate a possible attempt to send electronic mail, and dynamic link libraries and methods indicating an automation of an electronic mail program.

28. A computer readable storage medium as in claim 23, where determining the behavioral profile of the sample program further comprises determining if system resources requested by the sample program match certain predetermined system resources and, if so, executing the sample program in a controlled environment, determining if system changes made during execution of the sample program match certain predetermined system changes and, if so, declaring the sample program to be a possible worm, and if not, determining if activities reported by a program behavior monitor match certain predetermined activities and, if so, declaring the sample program to be a possible worm.