System and method of detecting computer worms

• US 8,528,086 B1
• Filed: 03/31/2005
• Issued: 09/03/2013
• Est. Priority Date: 04/01/2004
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Aziz, Ashar
• Primary Examiner(s): Chea, Philip
• Assistant Examiner(s): DOLLY, KENDALL LYNN
• Application Number:
  US11/096,287
• Time in Patent Office: 3,078 Days
• Field of Search: 726/22, 726/23, 726/24, 726/25, 713/188
• US Class Current: 726/23
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A computer worm detection system orchestrates a sequence of network activities in a computer network and monitors the computer network to identify an anomalous behavior of the computer network. The computer worm detection system then determines whether the anomalous behavior is caused by the computer worm and can determine an identifier for detecting the computer worm based on the anomalous behavior. The computer worm detection system can also generate a recovery script for disabling the computer worm or repairing damage caused by the computer worm.

Claims

1. A system for detecting a computer worm, comprising:

a traffic analysis device configured to identify and copy network traffic traveling over a communication network, the network traffic having a characteristic associated with one or more computer worms;

a computer network communicatively coupled with a memory, the computer network being configured to detect anomalies; and

a controller communicatively coupled with the memory and in communication with the traffic analysis device, the controller being configured to (i) receive the copied network traffic, (ii) replay the copied network traffic and a plurality of network activities in the computer network, (iii) monitor a behavior of the computer network in response to the replay of the copied network traffic and the plurality of network activities, (iv) identify an anomalous behavior as an unexpected occurrence in the monitored behavior to detect a computer worm of the one or more computer worms, and (v) create an identifier associated with the anomalous behavior for subsequently detecting the computer worm in a second computer network different than the computer network,

wherein the identifier comprises a signature that is associated with the anomalous behavior for detecting a presence of the computer worm in the second computer network.

2. The system of claim 1, wherein the plurality of network activities includes a computing process executing in the computer network being a hidden computer network, and wherein the anomalous behavior includes an execution anomaly.

3. The system of claim 1, further comprising a gateway in communication with the computer network being a hidden computer network and the communication network, the gateway configured to propagate the computer worm from the communication network to the computer network.

4. The system of claim 3, wherein the gateway is further configured to facilitate propagation of the computer worm from the communication network to the computer network.

5. The system of claim 3, wherein the gateway is further configured to prevent selected network communications from propagating from the communication network to the computer network.

6. The system of claim 3, wherein the computer network is transparent to the communication network.

7. The system of claim 1, wherein the network traffic having the characteristic associated with one or more computer worms is a sequence of network communications and the controller further comprising a protocol sequence replayer in communication with the traffic analysis device and configured to replay the sequence of network communications in the computer network.

8. The system of claim 7, wherein the protocol sequence replayer is further configured to substitute a session identifier of at least one network communication in the sequence of network communications with a session identifier of the computer network.

9. The system of claim 1, wherein the traffic analysis device identifies the network traffic having the characteristic associated with one or more computer worms by using heuristics.

10. The system of claim 1, wherein the traffic analysis device is a hardware device configured to filter the network traffic being a portion of overall network traffic traveling over the communication network and having the characteristic associated with one or more computer worms, duplicate the network traffic being the copied network traffic, and providing the copied network traffic with the characteristic associated with one or more computer worms to the controller.

11. The system of claim 1, wherein the controller is further configured to generate a recovery script to either disable the computer worm or repair damage caused by the computer worm.

12. The system of claim 1, wherein the controller generates a recovery script based on discrepancies between a current image of a file system in the computer network and an original image of the file system in the computer network, where the recovery script is used to disable the computer worm or repair damage caused by the computer worm, and uploads the recovery script over the communication network to a source of the computer worm.

13. The system of claim 1, wherein the computer network is a virtual computer network that comprises one or more virtual computing systems, the one or more virtual computing systems are configured to detect the anomalies within the copied network traffic.

14. The system of claim 1 wherein the controller further comprises a software configuration unit configured to establish a software environment of the computer network.

15. The system of claim 1, wherein the anomalous behavior within the computer network is a network communication initiated during replay of the copied network traffic within a virtual computer.

16. The system of claim 1, wherein the computer network comprises one or more computing systems, at least one of the computing systems being configured to intercept a time-sensitive call generated by execution of the copied network traffic and modify the time-sensitive call to accelerate execution of the copied network traffic.

17. The system of claim 16, wherein the time-sensitive call comprises a sleep system call for causing a sleep state for some predetermined time so as to increase the execution time, the at least one of the computing systems being further configured to modify a parameter of the sleep system call to reduce the execution time of the sleep system call.

18. The system of claim 16, wherein the time-sensitive call comprises a time-of day system call, the at least one of the computing systems being further configured to modify the time or date in a response to the time-of-day system call to a future time or date to accelerate execution of the copied network traffic.

19. The system of claim 1, wherein the computer network comprises one or more computing systems, at least one of the computing systems being configured to intercept responses to time-sensitive calls generated by execution of the copied network traffic and modify the responses to the time-sensitive calls so as to accelerate execution of the copied network traffic.

20. The system of claim 1, wherein the computer network comprises one or more computing systems, at least one of the computing systems being configured to identify a time consuming program loop in a portion of the copied network traffic and in response, increase priority of the portion of the copied network traffic so as to accelerate execution of the program loop.

21. The system of claim 1, wherein the computer network comprises one or more computing systems, the computing systems in the computer network being configured to operate in a predetermined manner in response to network activities occurring in the computer network.

22. The system of claim 1, wherein the traffic analysis device analyzes web traffic on a selected network link in the communication network to identify a request from a web browser to a web server and a response from the web server to the web browser.

23. The system of claim 1, wherein the controller configures a web browser in the computer network to initiate a corresponding request in the computer network and to generate a corresponding response to the browser in the computer network.

24. The system of claim 1, wherein the plurality of network activities includes a well defined pattern of network activities, and wherein the anomalous behavior includes a communication anomaly which is not part of the well defined pattern of network activities.

25. The system of claim 24, the well defined pattern being a non-existent set of communications, wherein the anomalous behavior includes a communication anomaly which is any communication initiated in the computer network.

26. The system of claim 1, wherein a network activity of the plurality of network activities include at least one of an access to a web server, an access to a File Transfer Protocol (FTP) server and an access to a mail server.

27. The system of claim 1, wherein the traffic analysis device, including a hardware interface configured for coupling to the communication network, to duplicate a portion of network traffic traveling over the communication network as the copied network traffic and provide the copied network traffic with the characteristic associated with one or more computer worms to the controller.

28. The system of claim 1, wherein the signature that is associated with the anomalous behavior comprises information that identifies a source of the copied network traffic.

29. The system of claim 28, wherein the signature that is associated with the anomalous behavior identifies the source of the copied network traffic based on an uniform resource locator (URL) associated with the copied network traffic.

30. The system of claim 29, wherein the signature that is associated with the anomalous behavior further comprises a regular expression for the URL.

31. The system of claim 1, wherein the signature that is associated with the anomalous behavior identifies an uniform resource locator (URL) associated with the copied network traffic.

32. The system of claim 1, wherein the signature that is associated with the anomalous behavior identifies an execution anomaly based on system calls.

33. The system of claim 1, wherein the computer worm is any malicious code associated with the copied network traffic.

34. The system of claim 1, wherein the traffic analysis device identifies the network traffic having the characteristic associated with one or more computer worms and subsequently duplicates the network traffic having the characteristic associated with one or more computer worms to produce the copied network traffic.

35. The system of claim 1, wherein the signature being used to detect presence of the computer worm in the second computer network for other network traffic.

36. The system of claim 4, wherein the gateway is further configured to propagate Simple Mail Transfer Protocol (SMTP) messages containing the computer worm from the communication network to the computer network.

37. The system of claim 36, wherein the computer network is a virtual computer network, the controller being configured to perform a replay pattern which includes opening an email message containing the computer worm within the virtual computer network.

38. The system of claim 37, wherein opening the email message in the virtual computer network includes opening an attachment or a URL link inside the virtual computer network.

39. The system of claim 4, wherein the controller is further configured to monitor computer network Simple Mail Transfer Protocol (SMTP) messages.

40. The system of claim 4, wherein the controller is further configured to monitor computer network behavior with respect to a computer network email message.

41. The system of claim 11, wherein the controller is further configured to store a first image of the computer network prior to the replaying, store a second image of the computer network after the replaying, and generate the recovery script based on differences between the first image and the second image.

42. The system of claim 41, wherein the recovery script includes computer program code for replacing infected files in the second image with the respective files in the first image.

43. The system of claim 13, wherein the controller is circuitry that controls operations of the one or more virtual computing systems to monitor the behavior of the computer network in response to the replay of the copied network traffic.

44. A method for detecting a computer worm, comprising the steps of:

identifying and copying network traffic traveling over a communication network by a traffic analysis device, the network traffic having a characteristic associated with one or more computer worms;

replaying the copied network traffic received from the traffic analysis device and a plurality of network activities in a computer network communicatively coupled with a memory, the computer network being configured to detect anomalies;

monitoring a behavior of the computer network in response to the replay of the copied network traffic and the plurality of network activities;

identifying an anomalous behavior as an unexpected occurrence in the monitored behavior to detect a computer worm of the one or more computer worms; and

creating an identifier associated with the anomalous behavior for subsequently detecting the computer worm in a second computer network different than the computer network,

wherein the identifier comprises a signature associated with the anomalous behavior for detecting a presence of the computer worm in the second computer network.

45. The method of claim 44, wherein the plurality of network activities includes a computing process executing in the computer network being a hidden computer network, and wherein the anomalous behavior includes an execution anomaly.

46. The method of claim 44, further comprising the step of propagating the computer worm from the communication network to the computer network.

47. The method of claim 46, wherein the step of propagating the computer worm from the communication network to the computer network comprises facilitating propagation of the computer worm from the communication network to the computer network.

48. The method of claim 44, further comprising the step of preventing selected network communications from propagating from the communication network to the computer network.

49. The method of claim 44, wherein the network traffic having the characteristic associated with one or more computer worms is a sequence of network communications.

50. The method of claim 49, wherein the step of replaying comprises substituting a session identifier of at least one network communication in the sequence of network communications with a session identifier of the computer network.

51. The method of claim 49, wherein identifying network traffic having the characteristic associated with one or more computer worms is accomplished by using heuristics.

52. The method of claim 44, further comprising the step of generating an identifier based on the anomalous behavior for detecting the computer worm.

53. The method of claim 44, wherein the computer network is a virtual computer network that comprises one or more virtual computing systems, the one or more virtual computing systems are configured to detect the anomalies within the copied network traffic.

54. The method of claim 44, further comprising the step of generating a recovery script for disabling the computer worm.

55. The method of claim 54, wherein the step of generating the recovery script for disabling the computer worm further comprises generating the recovery script for repairing damage caused by the computer worm.

56. The method of claim 44, further comprising the step of establishing a software environment of the computer network.

57. The method of claim 44, wherein the computer network comprises one or more computing systems, the method further comprising intercepting by at least one of the computing systems a time-sensitive call generated by execution of the copied network traffic and modifying the time-sensitive call to accelerate execution of the copied network traffic.

58. The method of claim 57, wherein the time-sensitive call comprises a sleep system call for causing a sleep state for some predetermined time so as to increase the execution time, the method further comprising modifying by the at least one of the computing systems a parameter of the sleep system call to reduce the execution time of the sleep system call.

59. The method of claim 58, wherein the time-sensitive call comprises a time-of day system call, the method further comprising modifying by the at least one of the computing systems the time or date in a response to the time-of-day system call to a future time or date so as to accelerate execution of the copied network traffic.

60. The method of claim 44, wherein the computer network comprises one or more computing systems, the method further comprising intercepting by at least one of the computing systems responses to time-sensitive calls generated by execution of the copied network traffic and modifying the responses to the time-sensitive calls so as to accelerate execution of the copied network traffic.

61. The method of claim 44, wherein the computer network comprises one or more computing systems, the method further comprising identifying by at least one of the computing systems a time consuming program loop in a portion of the copied network traffic and in response, increasing priority of the portion of the copied network traffic so as to accelerate execution of the program loop.

62. The method of claim 44, wherein the computer network comprises one or more computing systems, the method further comprising configuring the computing systems in the computer network to operate in a predetermined manner in response to network activities occurring in the computer network.

63. The method of claim 44, wherein the signature that is associated with the anomalous behavior comprises information that identifies a source of the copied network traffic.

64. The method of claim 63, wherein the signature that is associated with the anomalous behavior identifies the source of the copied network traffic based on an uniform resource locator (URL) associated with the copied network traffic.

65. The method of claim 64, wherein the signature that is associated with the anomalous behavior further comprises a regular expression for the URL.

66. The method of claim 44, wherein the signature that is associated with the anomalous behavior identifies an uniform resource locator (URL) associated with the copied network traffic.

67. The method of claim 44, wherein the signature that is associated with the anomalous behavior identifies an execution anomaly based on system calls.

68. The method of claim 44, wherein the computer worm is any malicious code associated with the copied network traffic.

69. The method of claim 44, wherein the traffic analysis device identifies the network traffic having the characteristic associated with one or more computer worms and subsequently duplicates the network traffic having the characteristic associated with one or more computer worms to produce the copied network traffic.

70. The method of claim 44, wherein the signature being used to detect presence of the computer worm in the second computer network for other network traffic.

71. The method of claim 54, further comprising storing a first image of the computer network prior to the replaying, storing a second image of the computer network after the replaying, and generating the recovery script based on second image.

72. The method of claim 71, wherein the recovery script includes computer program code for replacing infected files in the second image with the respective files in the first image.

73. A system for detecting a computer worm, comprising:

means for identifying and copying network traffic having a characteristic associated with one or more computer worms;

means for replaying the copied network traffic and a plurality of network activities in a computer network communicatively coupled with a memory, the computer network being configured to detect anomalies;

means for monitoring a behavior of the computer network;

means for identifying an anomalous behavior as an unexpected occurrence in the monitored behavior;

means for comparing the anomalous behavior with the monitored behavior to detect a computer worm of the one or more computer worms; and

means for creating an identifier associated with the anomalous behavior for subsequently detecting the computer worm in a second computer network different than the computer network,

wherein the identifier comprises a signature that is associated with the anomalous behavior for detecting a presence of the computer worm in the second computer network.

74. The system of claim 73, further comprising means for propagating the computer worm from the communication network to the computer network.

75. The system of claim 73, wherein the signature that is associated with the anomalous behavior comprises information that identifies a source of the copied network traffic.

76. The system of claim 73, wherein the signature that is associated with the anomalous behavior identifies an uniform resource locator (URL) associated with the copied network traffic.

77. The system of claim 73, wherein the signature that is associated with the anomalous behavior identifies an execution anomaly based on system calls.

78. The system of claim 73, wherein the computer worm is any malicious code associated with the copied network traffic.

79. A non-transitory computer readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for detecting a computer worm, the method comprising:

identifying and copying network traffic that is characteristic of a computer worm in a communication network;

replaying the copied network traffic and a plurality of network activities in a computer network communicatively coupled with a memory, the computer network being configured to detect anomalies;

monitoring a behavior of the computing network;

identifying an anomalous behavior as an unexpected occurrence in the monitored behavior;

comparing the anomalous behavior with the monitored behavior to detect a computer worm; and

creating an identifier associated with the anomalous behavior for subsequently detecting the computer worm in a second computer network different than the computer network,

wherein the identifier comprises one or more of (1) a signature associated with anomalous behavior of the computer worm for detecting a presence of the computer worm in the second computer network, or (2) a vector associated with a sequence of paths traveled by the computer worm in the computer network, or (3) a vector associated with the anomalous behavior of the computer network, the vector includes a set of values, where each value includes a port number and identifies a transport protocol.

80. The non-transitory computer readable storage medium of claim 79, further comprising propagating the computer worm from the communication network to the computer network.

81. The non-transitory computer readable storage medium of claim 79, wherein the signature that is associated with the anomalous behavior identifies an uniform resource locator (URL) associated with the copied network traffic.

82. A system comprising:

a traffic analysis device configured to identify and copy network traffic, the network traffic having a characteristic associated with one or more computer worms;

a computer network that comprises one or more virtual computing systems, the one or more virtual computing systems are configured to detect anomalies within the copied network traffic; and

a controller communicatively in communication with the traffic analysis device and the computer network, the controller being configured to (i) receive the copied network traffic, (ii) replay the copied network traffic and a plurality of network activities in the one or more computing systems, (iii) monitor a behavior of the one or more computing systems in response to the replay of the copied network traffic and the plurality of network activities, (iv) identify an anomalous behavior as an unexpected occurrence in the monitored behavior to detect a computer worm of the one or more computer worms, and (v) create an identifier associated with the anomalous behavior for subsequently detecting the computer worm in a second computer network different than the computer network,

wherein the identifier comprises a signature associated with the anomalous behavior associated for detecting a presence of the computer worm in the second computer network.

83. The system of claim 82, wherein the traffic analysis device, including hardware for coupling to a communication network, is configured to duplicate a portion of network traffic traveling over the communication network as the copied network traffic and provide the copied network traffic with the characteristic associated with one or more computer worms to the controller.

84. The system of claim 82, wherein the controller is circuitry that controls operations of the one or more virtual computing systems and monitors the behavior of the one or more computing systems in response to the replay of the copied network traffic.

85. The system of claim 82, wherein the signature that is associated with the anomalous behavior comprises information that identifies a source of the copied network traffic.

86. The system of claim 82, wherein the signature that is associated with the anomalous behavior identifies the source of the copied network traffic based on an uniform resource locator (URL) associated with the copied network traffic.

87. The system of claim 86, wherein the signature that is associated with the anomalous behavior further comprises a regular expression for the URL.

88. The system of claim 82, wherein the signature that is associated with the anomalous behavior identifies an uniform resource locator (URL) associated with the copied network traffic.

89. The system of claim 82, wherein the signature that is associated with the anomalous behavior identifies an execution anomaly based on system calls.

90. The system of claim 82, wherein the computer worm is any malicious code associated with the copied network traffic.

91. The system of claim 82, wherein the traffic analysis device identifies the network traffic having the characteristic associated with one or more computer worms and subsequently duplicates the network traffic having the characteristic associated with one or more computer worms to produce the copied network traffic.

92. The system of claim 82, wherein the signature being used to detect presence of the computer worm in the second computer network for other network traffic.

93. A system for detecting a computer worm, comprising:

a traffic analysis device configured to identify and copy network traffic, the network traffic having a characteristic associated with one or more computer worms;

a computer network communicatively coupled with a memory, the computer network being configured to detect anomalies; and

a controller communicatively coupled with the memory and in communication with the traffic analysis device, the controller being configured to (i) receive the copied network traffic, (ii) replay the copied network traffic and a plurality of network activities in the computer network, (iii) monitor a behavior of the computer network in response to the replay of the copied network traffic and the plurality of network activities, (iv) identify an anomalous behavior as an unexpected occurrence in the monitored behavior to detect a computer worm of the one or more computer worms, and (v) create an identifier associated with the anomalous behavior for subsequently detecting the computer worm in a second computer network different than the computer network,

wherein the identifier comprises a vector that characterizes a sequence of paths traveled by the computer worm in the computer network.

94. The system of claim 93, wherein the computer network comprises one or more virtual computing systems, the one or more virtual computing systems are configured to detect the anomalies within the copied network traffic.

95. The system of claim 93, wherein the traffic analysis device, including hardware for coupling to a communication network, is configured to duplicate a portion of network traffic traveling over the communication network as the copied network traffic and provide the copied network traffic with the characteristic associated with one or more computer worms to the controller.

96. The system of claim 93, wherein the controller is circuitry that controls operations of the one or more virtual computing systems and monitors the behavior of the one or more computing systems in response to the replay of the copied network traffic.

97. A system for detecting a computer worm, comprising:

a traffic analysis device configured to identify and copy network traffic, the network traffic having a characteristic associated with one or more computer worms;

a computer network communicatively coupled with a memory, the computer network being configured to detect anomalies; and

a controller communicatively coupled with the memory and in communication with the traffic analysis device, the controller being configured to (i) receive the copied network traffic, (ii) replay the copied network traffic and a plurality of network activities in the computer network, (iii) monitor a behavior of the computer network in response to the replay of the network traffic and the plurality of network activities, (iv) identify an anomalous behavior as an unexpected occurrence in the monitored behavior to detect a computer worm of the one or more computer worms, and (v) create an identifier associated with the anomalous behavior for subsequently detecting the computer worm in a second computer network different than the computer network,

wherein the identifier comprises a vector associated with the anomalous behavior of the computer network, the vector includes a set of values, where each value includes a port number and identifies a transport protocol.

98. The system of claim 97, wherein the computer network comprises one or more virtual computing systems, the one or more virtual computing systems are configured to detect the anomalies within the copied network traffic.

99. The system of claim 97, wherein the traffic analysis device, including hardware for coupling to a communication network, is configured to duplicate a portion of network traffic traveling over the communication network as the copied network traffic and provide the copied network traffic with the characteristic associated with one or more computer worms to the controller.

100. The system of claim 97, wherein the computer network comprises one or more virtual computing systems, the one or more virtual computing systems are configured to detect the anomalies within the copied network traffic.