Computer worm defense system and method

• US 8,006,305 B2
• Filed: 06/13/2005
• Issued: 08/23/2011
• Est. Priority Date: 06/14/2004
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Aziz, Ashar
• Primary Examiner(s): Patel; Nirav B
• Assistant Examiner(s): Moran; Randal D
• Application Number:
  US11/152,286
• Publication Number:
  US 20110093951A1
• Time in Patent Office: 2,262 Days
• Field of Search: 726 22- 25
• US Class Current: 726/24
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/568 eliminating virus, restoring damaged files
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A computer worm defense system comprises multiple containment systems tied together by a management system. Each containment system is deployed on a separate communication network and contains a worm sensor and a blocking system. Computer worm identifiers generated by a worm sensor of one containment system can be provided not only to the blocking system of the same containment system, but can also be distributed by the management system to blocking systems of other containment systems.

Claims

1. A computer worm defense system comprising:

a plurality of computer worm containment systems, each computer worm containment system including

a worm sensor implemented in a computing device and configured to generate a computer worm identifier for a computer worm propagating within a communication network,

a computer worm blocking system in communication with the worm sensor over the communication network and configured to receive the computer worm identifier from the worm sensor to block the propagation of the computer worm within the communication network,

a hidden computer network, and

a controller configured to monitor the hidden computer network and to determine the computer worm identifier based on anomalous behavior caused within the hidden computer network by the computer worm; and

a management system in communication with the plurality of computer worm containment systems and configured to obtain a computer worm identifier from a worm sensor of a first computer worm containment system of the plurality of computer worm containment systems and distribute the computer worm identifier to a computer worm blocking system of a second computer worm containment system of the plurality of computer worm containment systems.

2. The computer worm defense system of claim 1 wherein the controller of each computer worm containment system is further configured to generate a sequence of network activities within the hidden computer network based on an orchestration pattern.

3. The computer worm defense system of claim 2 wherein the controller of each computer worm containment system determines the computer worm identifier by comparing observed behavior in the hidden computer network with orchestrated behavior expected from the orchestration pattern.

4. The computer worm defense system of claim 1 wherein the anomalous behavior includes a communication anomaly.

5. The computer worm defense system of claim 1 wherein the anomalous behavior includes an execution anomaly.

6. The computer worm defense system of claim 1 wherein the computer worm identifier includes a signature.

7. The computer worm defense system of claim 6 wherein the signature includes a destination port and a sequence of tokens.

8. The computer worm defense system of claim 1 wherein the computer worm identifier includes a vector.

9. The computer worm defense system of claim 1 wherein the controller of each computer worm containment system is further configured to generate a recovery script.

10. The computer worm defense system of claim 1 wherein the management system maintains and manages subscriber accounts.

11. The computer worm defense system of claim 1 wherein the management system automatically distributes the computer worm identifier to the computer worm blocking system of the second computer worm containment system.

12. The computer worm defense system of claim 1 wherein the worm sensor of each computer worm containment system includes

a traffic analysis device in communication with the communication network and configured to identify a sequence of network communications characteristic of the computer worm, and

another controller configured to generate a sequence of network activities within the hidden computer network based on the sequence of network communications.

13. A computer worm defense method comprising:

monitoring a plurality of separate communication networks, each communication network being monitored by a computer worm containment system including

a worm sensor implemented within a computing device and configured to generate computer worm identifiers for computer worms propagating within the communication network, and

a computer worm blocking system in communication with the worm sensor over the communication network and configured to receive the computer worm identifiers from the worm sensor to block the propagation of the computer worms within the communication network;

detecting a computer worm with a worm sensor of a first computer worm containment system by identifying a sequence of network communications, within a communication network associated with the first computer worm containment system, that are characteristic of the computer worm, providing the sequence of network communications to a hidden network, and determining the computer worm identifier from anomalous behavior in the hidden network;

distributing a computer worm identifier from the worm sensor of the first computer worm containment system to a computer worm blocking system of a second computer worm containment system; and

blocking the computer worm from propagating in a communication network associated with the second computer worm containment system.

14. The method of claim 13 wherein distributing the computer worm identifier is performed periodically.

15. The method of claim 13 wherein distributing the computer worm identifier is performed by a management system.

16. The method of claim 13 wherein distributing the computer worm identifier includes charging a fee to a subscriber associated with the second computer worm containment system.

17. The method of claim 13 wherein determining the computer worm identifier includes replaying the sequence of network communications within the hidden network to produce the anomalous behavior.

18. The method of claim 13 wherein detecting the computer worm with the worm sensor of the first computer worm containment system further includes providing the sequence of network communications to the hidden network, and determining the computer worm identifier from the anomalous behavior in the hidden network.

19. The method of claim 18 wherein identifying the sequence of network communications includes using a heuristic analysis technique to filter communication traffic of the communication network.

20. The method of claim 18 wherein determining the computer worm identifier includes replaying the sequence of network communications within the hidden network to produce the anomalous behavior.

21. A computer worm defense system comprising:

a plurality of computer worm containment systems, each computer worm containment system including

a worm sensor implemented in a computing device and configured to generate a computer worm identifier for a computer worm propagating within a communication network,

a computer worm blocking system in communication with the worm sensor over the communication network and configured to receive the computer worm identifier from the worm sensor to block the propagation of the computer worm within the communication network,

a hidden computer network, and

a controller configured to;

monitor the hidden computer network and to determine the computer worm identifier based on anomalous behavior caused within the hidden computer network by the computer worm, and

generate a sequence of network activities within the hidden computer network based on an orchestration pattern; and

a management system in communication with the plurality of computer worm containment systems and configured to obtain a computer worm identifier from a worm sensor of a first computer worm containment system of the plurality of computer worm containment systems and distribute the computer worm identifier to a computer worm blocking system of a second computer worm containment system of the plurality of computer worm containment systems.

22. The computer worm defense system of claim 21 wherein the computer worm identifier includes a signature.

23. The computer worm defense system of claim 21 wherein the computer worm identifier includes a vector.