Detecting malicious use of computer resources by tasks running on a computer system

• US 8,931,096 B2
• Filed: 12/09/2011
• Issued: 01/06/2015
• Est. Priority Date: 10/29/2008
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Freeman, Robert G., Ollmann, Gunter
• Primary Examiner(s): Eskandarnia, Arvin
• Application Number:
  US13/315,895
• Publication Number:
  US 20120084862A1
• Time in Patent Office: 1,124 Days
• Field of Search: 726/23
• US Class Current: 726/23
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method, apparatus, and computer program product for identifying malware is disclosed. The method identifies processes in a running process list on a host computer system. The method identifies ports assigned to the processes in the running process list on the host computer system. The method determines whether any one of ports that is currently in use in the host computer system is not assigned to any of the processes in the running process list. The method then makes a record that a hidden, running process is present as a characteristic of an attack in response to a determination that one of the ports is currently in use but is not assigned to any of the processes in the running process list in the host computer system.

Claims

1. A method for identifying malware, the method comprising the steps of:

identifying, by one or more processors, processes in a running process list on a first computer system;

identifying, by one or more processors, ports assigned to the processes in the running process list on the first computer system;

identifying, by one or more processors, ports currently in use in the first computer system;

determining, by one or more processors, a first use of a first port of the ports currently in use in the first computer system but not assigned to any of the processes in the running process list in the first computer system; and

determining, by one or more processors, whether a second computer system is using a second port on the second computer system in a non-malicious manner, wherein the second port on the second computer system maps to the first port on the first computer system, and

if determined that the second computer system is using the second port on the second computer system in the non-malicious manner, determining, by one or more processors, that the first port is not being used in an attack, and

if determined that the second computer system is not using the second port on the second computer system in the non-malicious manner, determining, by one or more processors, that a hidden, running process is present as a characteristic of an attack.

2. The method of claim 1, wherein the first computer system is remote from each of one or more processors which perform the identifying and determining steps, and further comprising:

responsive to a determination that none of the ports is currently in use and unassigned to any of the processes in the running process list in the first computer system, one or more processors making a record that there is no hidden process attack in the first computer system.

3. The method of claim 1, wherein the step of identifying, by one or more processors, ports currently in use in the first computer system comprises:

identifying, by one or more processors, a group of open ports on the first computer system, wherein the group of open ports includes the ports assigned to the processes in the running process list and the ports currently in use but not assigned to any of the processes in the running process list in the first computer system.

4. The method of claim 3, wherein the first use of the first port of the ports currently in use but not assigned to any of the processes in the running process list in the first computer system is by a group of tasks running in the first computer system, and wherein the step of determining, by one or more processors, whether the second computer system is using the second port on the second computer system in the non-malicious manner is further responsive to a determination that a difference in port use is not new comprising:

retrieving, by one or more processors, a first configuration for the first computer system;

identifying, by one or more processors, a second use of a corresponding port by a corresponding group of tasks running on a set of computer systems having a second configuration that matches the first configuration for the first computer system, wherein the corresponding port maps to the first port and the corresponding group of tasks running on the set of computer systems correspond to the group of tasks running in the first computer system;

determining, by one or more processors, whether the difference in port use is present between the first use of the first port and the second use of the corresponding port in the set of computer systems; and

responsive to a determination that the difference in port use is present, determining, by one or more processors, whether the difference in port use by the group of tasks in the first computer system is new based on a history of prior uses for the corresponding port in the set of computer systems.

5. The method of claim 4, wherein the step of determining, by one or more processors, whether the second computer system is using the second port on the second computer system in the non-malicious manner is further responsive to a determination that a time when the first use occurred corresponds to a scheduled time for a change comprising:

responsive to the determination that the difference in port use is new, identifying, by one or more processors, the time when the first use occurred and a set of changes having a scheduled time for each change, wherein the set of changes are for the group of tasks and for a set of networking resources for the first port; and

determining, by one or more processors, whether the time when the first use occurred corresponds to the scheduled time for at least one of the changes in the set of changes.

6. The method of claim 4, further comprising:

responsive to the determination that the difference in port use is new, sending, by one or more processors, a request to a user of the first computer system to indicate whether the difference in port use is the attack.

7. The method of claim 6, wherein the request to the user of the first computer system to indicate whether the difference in port use is the attack includes an additional random question, wherein an incorrect answer to the additional random question indicates that the difference in port use is the attack.

8. The method of claim 1, wherein the step of determining, by one or more processors, that the hidden, running process is present as the characteristic of the attack is further responsive to an identification, by one or more processors, of one or more differences present between performance information generated by a first monitoring program and a second monitoring program comprising:

retrieving, by one or more processors, performance information about the first use of the first port by a group of tasks running in the first computer system by the first monitoring program, wherein the first monitoring program is configured to monitor port use by the group of tasks running in the first computer system;

retrieving, by one or more processors, performance information generated by the second monitoring program in a remote computer system, wherein the second monitoring program is configured to monitor the first use of the first port by the group of tasks running in the first computer system; and

comparing, by one or more processors, the performance information generated by the first monitoring program to the performance information generated by the second monitoring program to identify the one or more differences between the performance information generated by the first monitoring program and the second monitoring program.

9. A computer system for identifying malware, the computer system comprising:

one or more processors, one or more computer-readable tangible storage devices, one or more computer-readable memories, and program instructions stored on at least one the computer-readable tangible storage devices for execution by at least one of the one or more processors via at least one of the computer-readable memories, the program instructions comprising;

first program instructions to identify processes in a running process list on a first computer;

second program instructions to identify ports assigned to the processes in the running process list on the first computer;

third program instructions to identify ports currently in use in the first computer;

fourth program instructions to determine a first use of a first port of the ports currently in use in the first computer but not assigned to any of the processes in the running process list in the first computer; and

fifth program instructions to determine whether a second computer is using a second port on the second computer in a non-malicious manner, wherein the second port on the second computer maps to the first port on the first computer, and if determined that the second computer system is using the second port on the second computer system in the non-malicious manner, determine that the first port is not being used in an attack, and if determined that the second computer system is not using the second port on the second computer system in the non-malicious manner, determine that a hidden, running process is present as a characteristic of the attack.

10. The computer system of claim 9, wherein the first computer is remote from the computer system, and further comprising:

sixth program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to make a record that there is no hidden process attack in the first computer, responsive to a determination that none of the ports are currently in use unassigned to any of the processes in the running process list in the first computer.

11. The computer system of claim 9, wherein the third program instructions to identify ports currently in use in the first computer comprise program instructions to identify a group of open ports on the first computer, wherein the group of open ports includes the ports assigned to the processes in the running process list and the ports currently in use but not assigned to any of the processes in the running process list in the first computer.

12. The computer system of claim 11, wherein the first use of the first port of the ports currently in use but not assigned to any of the processes in the running process list in the first computer is by a group of tasks running in the first computer, and wherein the fifth program instructions to determine whether the second computer is using the second port on the second computer in the non-malicious manner is further responsive to a determination that a difference in port use is not new by sixth program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the sixth program instructions comprising:

program instructions to retrieve a first configuration for the first computer;

program instructions to identify a second use of a corresponding port by a corresponding group of tasks running on a set of computers having a second configuration that matches the first configuration for the first computer, wherein the corresponding port maps to the first port and the corresponding group of tasks running on the set of computers correspond to the group of tasks running in the first computer;

program instructions to determine whether the difference in port use is present between the first use of the first port and the second use of the corresponding port in the set of computers; and

program instructions to determine whether the difference in port use by the group of tasks in the first computer is new based on a history of prior uses for the corresponding port in the set of computers, responsive to a determination that the difference in port use is present.

13. The computer system of claim 12, wherein the fifth program instructions to determine whether the second computer is using the second port on the second computer in the non-malicious manner is further responsive to a determination that a time when the first use occurred corresponds to a scheduled time for a change by seventh program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, the seventh program instructions comprising:

program instructions to identify the time when the first use occurred and a set of changes having a scheduled time for each change, wherein the set of changes are for the group of tasks and for a set of networking resources for the first port, responsive to the determination that the difference in port use is new; and

program instructions to determine whether the time when the first use occurred corresponds to the scheduled time for at least one of the changes in the set of changes.

14. The computer system of claim 12, further comprising:

seventh program instructions, stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to send a request to a user of the first computer to indicate whether the difference in port use is the attack, responsive to the determination that a difference in port use is new, the request to the user of the first computer to indicate whether the difference in port use is the attack includes an additional random question, wherein an incorrect answer to the additional random question indicates the difference in port use is the attack.

15. A computer program product for identifying malware, the computer program product comprising:

one or more computer-readable tangible storage devices, one or more processors, and program instructions stored on at least one of the computer-readable tangible storage devices for execution by at least one of the one or more processors, the program instructions comprising;

program instructions to identify processes in a running process list on a first computer system;

program instructions to identify ports assigned to the processes in the running process list on the first computer system;

program instructions to identify ports currently in use in the first computer system;

program instructions to determine a first use of a first port of the ports currently in use in the first computer system but not assigned to any of the processes in the running process list in the first computer system; and

program instructions to determine whether a second computer system is using a second port on the second computer system in a non-malicious manner, wherein the second port on the second computer system maps to the first port on the first computer system, and if determined that the second computer system is using the second port on the second computer system in the non-malicious manner, determine that the first port is not being used in an attack, and if determined that the second computer system is not using the second port on the second computer system in the non-malicious manner, determine that a hidden, running process is present as a characteristic of the attack.

16. The computer program product of claim 15, wherein the first computer system is remote from the one or more processors, and further comprising:

program instructions, stored on at least one of the one or more computer-readable tangible storage devices, to make a record that there is no hidden process attack in the first computer system, responsive to a determination that none of the ports are currently in use unassigned to any of the processes in the running process list in the first computer system.

17. The computer program product of claim 15, wherein the program instructions to identify ports currently in use in the first computer system comprises program instructions to identify a group of open ports on the first computer system, wherein the group of open ports includes the ports assigned to the processes in the running process list and the ports currently in use but not assigned to any of the processes in the running process list in the first computer system.

18. The computer program product of claim 17, wherein the first use of the first port of the ports currently in use but not assigned to any of the processes in the running process list in the first computer system is by a group of tasks running in the first computer system, and wherein the program instructions to determine whether the second computer is using the second port on the second computer in the non-malicious manner is further responsive to a determination that a difference in port use is not new by program instructions, stored on at least one of the one or more computer-readable tangible storage devices, comprising:

program instructions to retrieve a first configuration for the first computer system;

program instructions to identify a second use of a corresponding port by a corresponding group of tasks running on a set of computer systems having a second configuration that matches the first configuration for the first computer system, wherein the corresponding port maps to the first port and the corresponding group of tasks running on the set of computer systems correspond to the group of tasks running in the first computer system;

program instructions to determine whether the difference in port use is present between the first use of the first port and the second use of the corresponding port in the set of computer systems; and

program instructions to determine whether the difference in port use by the group of tasks in the first computer system is new based on a history of prior uses for the corresponding port in the set of computer systems, responsive to a determination that the difference in port use is present.

19. The computer program product of claim 18, wherein the program instructions to determine whether the second computer is using the second port on the second computer in the non-malicious manner is further responsive to a determination that a time when the first use occurred corresponds to a scheduled time for a change by program instructions, stored on at least one of the one or more computer-readable tangible storage devices, comprising:

program instructions to identify the time when the first use occurred and a set of changes having a scheduled time for each change, wherein the set of changes are for the group of tasks and for a set of networking resources for the first port, responsive to the determination that the difference in port use is new; and

program instructions to determine whether the time when the first use occurred corresponds to the scheduled time for at least one of the changes in the set of changes.

20. The computer program product of claim 18, further comprising:

program instructions, stored on at least one of the one or more computer-readable tangible storage devices, to send a request to a user of the first computer system to indicate whether the difference in port use is the attack, responsive to the determination that the difference in port use is new, wherein the request to the user of the first computer system to indicate whether the difference in port use is the attack includes an additional random question, and wherein an incorrect answer to the additional random question indicates the difference in port use is the attack.