Malware detector

• US 8,935,773 B2
• Filed: 04/09/2010
• Issued: 01/13/2015
• Est. Priority Date: 04/09/2009
• Status: Active Grant

• Current Assignee: George Mason Research Foundation Inc.
• Original Assignee: George Mason Research Foundation Inc.
• Inventors: Stavrou, Angelos, Jajodia, Sushil, Ghosh, Anup, Martin, Rhandi, Andrianakis, Charalampos
• Primary Examiner(s): BROWN, CHRISTOPHER J
• Application Number:
  US12/757,675
• Publication Number:
  US 20110099620A1
• Time in Patent Office: 1,740 Days
• Field of Search: 726/12, 726/14
• US Class Current: 726/12
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A transparent proxy for malware detection includes a monitor module, a protocol determination module, a challenge generation module, a response determination module, and a data control module. The monitor module examines data originating from an application towards a remote server. The protocol determination module identifies the protocol type used for the data. The challenge generation module produces a challenge for the application based upon the protocol type, sends the challenge to the application, and maintains a state related to the data and the challenge. The response determination module makes a determination if an automatic non-interactive application response is received in response to the challenge from the application. The data control module allows the first data to continue to the remote server when the determination is valid. The data control module reports malware detection and blocks the data to continue to the remote server when the determination is invalid.

Claims

1. An apparatus, comprising:

a) a monitor module implemented in at least one of a memory or a processing device, the monitor module configured to examine a datum originating from at least one application running on a computing machine and being sent towards a remote server;

b) a protocol determination module configured to identify a network protocol type used for said datum generated from said at least one application;

c) a challenge generation module configured to;

i) produce an active content challenge for said at least one application based upon said network protocol type; and

ii) send said active content challenge to said at least one application;

d) a response determination module configured to make a determination if an automatic non-user-interactive application response is received in response to said active content challenge from said at least one application; and

e) a data control module configured to;

i) send said datum to said remote server when the automatic non-user-interactive application response is a valid automatic non-user-interactive application response; and

ii) block said datum from being sent to said remote server when the automatic non-user-interactive application response is an invalid automatic non-user-interactive application response.

2. The apparatus of claim 1, wherein said data control module is further configured to:

a) send a server response from said remote server to said at least one application when the automatic non-user-interactive application response indicates legitimate behavior by the at least one application; and

b) block said server response from said remote server from being received by said at least one application when the automatic non-user-interactive application response indicates illegitimate behavior by the at least one application.

3. The apparatus of claim 1, further comprising a malware classification module configured to identify a malicious software running on said computing machine, based on said determination.

4. The apparatus of claim 3, wherein said malicious software is identified using at least one of the following:

a) said datum;

b) said at least one application; and

c) said automatic non-user-interactive application response.

5. The apparatus of claim 1, further comprising a reporting module configured to report if said determination is an invalid non-user-interactive application response.

6. The apparatus of claim 1, wherein said monitor module is located on a network edge and examines outgoing traffic.

7. The apparatus of claim 1, wherein said protocol determination module uses protocol fingerprinting to identify said network protocol type.

8. The apparatus of claim 1, wherein said active content challenge generated by the challenge generation module is further based upon an application state of said at least one application when transmitting said datum.

9. The apparatus of claim 1, wherein said active content challenge is non-disruptive to said at least one application and is transparent to a user.

10. The apparatus of claim 1, wherein said at least one application is one of the following:

a) a Web browser;

b) a VOIP application;

c) a peer-to-peer application;

d) a database client; and

e) a database server.

11. The apparatus of claim 1, wherein, said network protocol type is one of the following:

a) a HTTP;

b) a VOIP protocol;

c) a Session Description Protocol;

d) a Session Initiation Protocol; and

e) a Real Time Transport Control Protocol.

12. The apparatus of claim 1, wherein said at least one application is a Web browser, said remote server is a Web browser engine, and said active content challenge is an encoded redirect request that is triggered after a page is processed by said Web browser engine.

13. The apparatus of claim 1, wherein (1) the valid automatic non-user-interactive application response indicates that said at least one application has a legitimate behavior, and (2) the invalid automatic non-user-interactive application response indicates that said at least one application has an illegitimate behavior.

14. The apparatus of claim 1, wherein said active content challenge is configured to test an expected function of said at least one application.

22. The apparatus of claim 1, wherein the active content challenge is configured to test inherent capabilities of the at least one application based on the network protocol type.

15. An apparatus, comprising:

a) a monitor module implemented in at least one of a memory or a processing device, the monitor module configured to examine a datum originating from at least one application running on a computing machine and being sent towards a remote server, said at least one application expecting a server response from said remote server;

b) a protocol determination module configured to identify a network protocol type used for said datum generated from said at least one application;

c) a challenge generation module configured to;

i) produce an active content challenge for said at least one application based upon said network protocol type; and

ii) send said active content challenge to said at least one application

d) a response determination module configured to make a determination if an automatic non-user-interactive application response is received in response to said active content challenge from said at least one application; and

e) a data control module configured to;

i) send said server response from said remote server to said at least one application when the automatic non-user-interactive application response indicates legitimate behavior by said at least one application; and

ii) block said server response from said remote server from being received by said at least one application when the automatic non-user-interactive application response indicates illegitimate behavior by said at least one application.

16. The apparatus of claim 15, wherein said data control module is further configured to:

a) send said datum to said remote server when the automatic non-user-interactive application response indicates legitimate behavior by said at least one application; and

b) block said datum from being sent to said remote server when the automaticnon-user-interactive application response indicates illegitimate behavior by said at least one application.

17. The apparatus of claim 15, wherein (1) the legitimate behavior by said at least one application is associated with an expected function of said at least one application, and (2) the illegitimate behavior by said at least one application is associated with an unexpected function of said at least one application.

18. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

examine a datum originating from at least one application running on a computing machine and being sent towards a remote server to identify a network protocol type used for said datum generated from said at least one application;

produce a non-user-involved active content challenge for said at least one application based upon said network protocol type, the non-user-involved active content challenge configured to test an expected function of said at least one application;

send said non-user-involved active content challenge to said at least one application;

determine if an automatic non-user-interactive application response is received in response to said non-user-involved active content challenge from said at least one application;

send said datum to said remote server when the automatic non-user-interactive application response indicates an expected function by said at least one application; and

block said datum from being sent to said remote server when the automatic non-user-interactive application response indicates an unexpected function by said at least one application.

19. The non-transitory processor-readable medium of claim 18, further comprising code representing instructions to cause the processor to:

send a server response from said remote server to said at least one application when the automatic non-user-interactive application response indicates an expected function by said at least one application; and

block said server response from said remote server from being received by said at least one application when the automatic non-user-interactive application response indicates an unexpected function by said at least one application.

20. The non-transitory processor-readable medium of claim 18, further comprising code representing instructions to cause the processor to:

identify a malicious software running on said computing machine, based on said determination.

21. The non-transitory processor-readable medium of claim 18, further comprising code representing instructions to cause the processor to:

send a report if the automatic non-user-interactive application response indicates an unexpected function by said at least one application.

23. The apparatus of claim 18, wherein (1) the expected function of said at least one application is associated with the automatic non-user-interactive application response being valid, and (2) the unexpected function by said at least one application is associated with the automatic non-user-interactive application response being invalid.