System and methods for control of applications using preliminary file filtering

• US 9,043,907 B1
• Filed: 06/10/2014
• Issued: 05/26/2015
• Est. Priority Date: 04/18/2014
• Status: Active Grant

• Current Assignee: Kaspersky Lab ZAO
• Original Assignee: Kaspersky Lab ZAO
• Inventors: Levchenko, Vyacheslav I., Yudin, Maxim V., Polozov, Pavel L.
• Primary Examiner(s): Gee, Jaosn K.
• Assistant Examiner(s): BUCKNOR, OLANREWAJU J
• Application Number:
  US14/300,878
• Time in Patent Office: 350 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Disclosed are systems, methods and computer program products for control of applications using preliminary file filtering. An example method includes intercepting, by a processor, an operation on a file performed by an application; selecting at least a part of the file; applying one or more file filters to the selected part of the file; determining a set of file characteristics based on outcomes of the file filters; determining a decision, based on the set of file characteristics, whether to exclude the file from further analysis by a client of an application control system; and based on the decision, excluding the file from the further analysis by the client of the application control system or providing the file to the client of the application control system for further analysis whether to allow or prohibit the operation on the file.

Claims

1. A method of application control using file filtering, comprising:

intercepting, by a processor, an operation on a file performed by an application;

selecting at least a part of the file;

applying one or more file filters to the selected part of the file, wherein each of the one or more file filters comprises a bit mask including a sequence of bits;

determining a set of file characteristics based on outcomes of applying the one or more file filters by at least performing an AND operation between the selected part of the file and the bit mask, wherein the AND operation is performed on the selected part of the file and starting from an offset, wherein the offset is included in a file filter corresponding to the bit mask;

determining a decision, based on the set of file characteristics, whether to exclude the file from further analysis by a client of an application control system; and

based on the decision, excluding the file from the further analysis by the client of the application control system or providing the file to the client of the application control system for further analysis whether to allow or prohibit the operation on the file.

2. The method of claim 1, further comprising:

storing the decision and a file identifier of the file in a decision database;

retrieving the decision from the decision database based on the file identifier;

performing the analysis of the file by the client upon detecting that the decision indicates not to exclude the file from the analysis by the client or upon detecting that there is no decision stored in the decision database for the file identifier; and

skipping the analysis of the file by the client upon detecting that the decision indicates to exclude the file from the analysis by the client.

3. The method of claim 1, wherein intercepting the operation on the file is performed by using a driver filter of a file system.

4. The method of claim 1, further comprising:

prior to applying the one or more file filters to the selected part of the file, retrieving each of the one or more file filters from a filter database based on a file identifier of the file.

5. The method of claim 1, further comprising:

determining a file type of the file based on an outcome of the AND operation.

6. A system of application control using file filtering, comprising:

a hardware processor configured to;

intercept an operation on a file performed by an application;

select at least a part of the file;

apply one or more file filters to the selected part of the file, wherein each of the one or more file filters comprises a bit mask including a sequence of bits;

determine a set of file characteristics based on outcomes of applying the one or more file filters by at least performing an AND operation between the selected part of the file and the bit mask, wherein the AND operation is performed on the selected part of the file and starting from an offset, wherein the offset is included in a file filter corresponding to the bit mask;

determine a decision, based on the set of file characteristics, whether to exclude the file from further analysis by a client of an application control system; and

based on the decision, exclude the file from the further analysis by the client of the application control system or provide the file to the client of the application control system for further analysis whether to allow or prohibit the operation on the file.

7. The system of claim 6, wherein the processor is further configured to:

store the decision and a file identifier of the file in a decision database;

retrieve the decision from the decision database based on the file identifier;

perform the analysis of the file by the client upon detecting that the decision indicates not to exclude the file from the analysis by the client or upon detecting that there is no decision stored in the decision database for the file identifier; and

skip the analysis of the file by the client upon detecting that the decision indicates to exclude the file from the analysis by the client.

8. The system of claim 6, wherein the processor is configured to intercept the operation on the file by using a driver filter of a file system.

9. The system of claim 6, wherein the processor is further configured to:

prior to applying the file filters to the selected part of the file, retrieve the one or more file filters from a filter database based on a file identifier of the file.

10. The system of claim 6, wherein the processor is further configured to:

determine a file type of the file based on an outcome of the AND operation.

11. A computer program product stored on a non-transitory computer-readable storage medium, the computer program product comprising computer-executable instructions for application control using file filtering, including instructions for:

intercepting an operation on a file performed by an application;

identifying a selected part of the file;

applying one or more file filters to the selected part of the file, wherein each of the one or more file filters comprises a bit mask including a sequence of bits;

determining a set of file characteristics based on outcomes of applying the one or more file filters by at least performing an AND operation between the selected part of the file and the bit mask, wherein the AND operation is performed on the selected part of the file and starting from an offset, wherein the offset is included in a file filter corresponding to the bit mask;

determining a decision, based on the set of file characteristics, whether to exclude the file from further analysis by a client of an application control system; and

based on the decision, excluding the file from the further analysis by the client of the application control system or providing the file to the client of the application control system for further analysis whether to allow or prohibit the operation on the file.

12. The computer program product of claim 11, further comprising instructions for:

storing the decision and a file identifier of the file in a decision database;

retrieving the decision from the decision database based on the file identifier;

performing the analysis of the file by the client upon detecting that the decision indicates not to exclude the file from the analysis by the client or upon detecting that there is no decision stored in the decision database for the file identifier; and

skipping the analysis of the file by the client upon detecting that the decision indicates to exclude the file from the analysis by the client.

13. The computer program product of claim 11, wherein intercepting the operation on the file is performed by using a driver filter of a file system.

14. The computer program product of claim 11, further comprising instructions for:

prior to applying the file filters to the selected part of the file, retrieving the one or more file filters from a filter database based on a file identifier of the file.

15. The computer program product of claim 11, further comprising instructions for:

determining a file type of the file based on an outcome of the AND operation.