Methods and apparatus for control and detection of malicious content using a sandbox environment

• US 9,081,959 B2
• Filed: 11/30/2012
• Issued: 07/14/2015
• Est. Priority Date: 12/02/2011
• Status: Active Grant

• Current Assignee: Invincea, Inc. (Sophos Group Ltd.)
• Original Assignee: Invincea, Inc. (Sophos Group Ltd.)
• Inventors: Ghosh, Anup, Cosby, Scott, Keister, Alan, Bryant, Benjamin, Taylor, Stephen
• Primary Examiner(s): Darrow, Justin T
• Assistant Examiner(s): SONG, HEE K
• Application Number:
  US13/690,452
• Publication Number:
  US 20130145463A1
• Time in Patent Office: 956 Days
• Field of Search: 726/14, 726 22- 25, 717124-135
• US Class Current: 1/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

A non-transitory processor-readable medium storing code representing instructions to cause a processor to perform a process includes code to cause the processor to receive a set of indications of allowed behavior associated with an application. The processor is also caused to initiate an instance of the application within a sandbox environment. The processor is further caused to receive, from a monitor module associated with the sandbox environment, a set of indications of actual behavior of the instance of the application in response to initiating the instance of the application within the sandbox environment. The processor is also caused to send an indication associated with an anomalous behavior if at least one indication from the set of indications of actual behavior does not correspond to an indication from the set of indications of allowed behavior.

Claims

1. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

receive a set of indications of predetermined allowed behavior specific to an application;

initiate an instance of the application within a sandbox environment;

receive, from a monitor module associated with the sandbox environment, a set of indications of actual behavior of the instance of the application in response to initiating the instance of the application within the sandbox environment;

define an indication associated with an anomalous behavior in response to at least one indication from the set of indications of actual behavior not corresponding to an indication from the set of indications of predetermined allowed behavior, the indication associated with the anomalous behavior includes a trace associated with a source of the anomalous behavior;

define, based on the set of indications of actual behavior and the indication associated with the anomalous behavior, an evaluation tree to include (1) a node associated with the instance of the application and (2) a node associated with the source of the anomalous behavior as a child of the node associated with the instance of the application; and

send a report based on the evaluation tree.

2. The non-transitory processor-readable medium of claim 1, wherein the code to cause the processor to send includes code to cause the processor to send the report such that the sandbox environment is terminated.

3. The non-transitory processor-readable medium of claim 1, further comprising code to cause the processor to:

store the evaluation tree as associated with the application.

4. The non-transitory processor-readable medium of claim 1, wherein the monitor module is configured to monitor at least one of process events of the instance of the application, file events of the instance of the application, registry events of the instance of the application, network events of the instance of the application or thread injection events of the instance of the application.

5. The non-transitory processor-readable medium of claim 1, further comprising code to cause the processor to:

revise the set of indications of predetermined allowed behavior specific to the application in response to the anomalous behavior.

6. The non-transitory processor-readable medium of claim 1, wherein the set of indications of predetermined allowed behavior specific to the application is based at least in part on a trust level associated with the application.

7. The non-transitory processor-readable medium of claim 1, wherein the set of indications of predetermined allowed behavior specific to the application includes an identifier of a trusted process associated with the application.

8. The non-transitory processor-readable medium of claim 1, wherein the monitor module is configured to collect at least one of a trace of network activity of the instance of the application or an executable file of the instance of the application.

9. The non-transitory processor-readable medium of claim 1, wherein the application is from a plurality of independent applications executable within the sandbox environment.

10. The non-transitory processor-readable medium of claim 1, wherein the code to cause the processor to define the evaluation tree includes code to cause the processor to:

associate the indication associated with the anomalous behavior with the node associated with the instance of the application as an attribute of the node associated with the instance of the application.

11. The non-transitory processor-readable medium of claim 1, further comprising code to cause the processor to:

denote, in the evaluation tree and based on the indication associated with the anomalous behavior, that the at least one indication from the set of indications of actual behavior does not correspond to an indication from the set of indications of predetermined allowed behavior.

24. The apparatus of claim 1, wherein the set of indications of allowed behavior associated with the first application is based at least in part on a trust level associated with the first application.

12. An apparatus, comprising:

a control module implemented in at least one of a memory or a processing device, the control module configured to initiate an instance of a first application and an instance of a second application within a sandbox environment,

the control module configured to receive, from a monitor module associated with the sandbox environment, a set of indications of actual behavior of the instance of the first application and a set of indications of actual behavior of the instance of the second application, an indication of a behavior being within both the set of indications of actual behavior of the instance of the first application and the set of indications of actual behavior of the instance of the second application,

the control module configured to classify the behavior as an anomalous behavior for the first application based on the indication of the behavior not being within a predetermined allowed behavior set for the first application, the control module configured to not classify the behavior as an anomalous behavior for the second application based on the indication of the behavior being within a predetermined allowed behavior set for the second application,

the control module configured to send a signal in response to classifying the behavior as an anomalous behavior for the first application such that the sandbox environment is terminated; and

an event engine module operatively coupled to the control module and implemented in at least one of the memory or the processing device, the event engine module configured to add a representation of the behavior to an evaluation tree including (1) node associated with the instance of the first application and (2) a node associated with a source of the anomalous behavior as a child of the node associated with the instance of the first application.

13. The apparatus of claim 12, further comprising the sandbox environment.

14. The apparatus of claim 12, wherein the control module is operatively coupled to the sandbox environment via a network.

15. The apparatus of claim 12, wherein the set of indications of actual behavior of the instance of the first application includes at least one of a process event identifier of the instance of the first application, a file event identifier of the instance of the first application, a registry event identifier of the instance of the first application or a network event identifier of the instance of the first application.

16. The apparatus of claim 12, wherein the first application and the second application are from a plurality of independent applications executable within the sandbox environment.

17. The apparatus of claim 12, wherein the predetermined allowed behavior set for the first application is specific to the first application.

18. An apparatus, comprising:

a control module implemented in at least one of a memory or a processing device, the control module configured to receive a set of indications of allowed behavior associated with a first application, the control module configured to initiate an instance of the first application within a sandbox environment such that the instance of the first application initiates an instance of a second application within the sandbox environment, the first application and the second application are from a plurality of independent applications executable within the sandbox environment,

the control module configured to receive, from a monitor module associated with the sandbox environment, a set of indications of actual behavior of the instance of the second application in response to the instance of the first application initiating the instance of the second application,

the control module configured to send an indication associated with an anomalous behavior in response to at least one indication from the set of indications of actual behavior of the instance of the second application not corresponding to an indication from the set of indications of allowed behavior associated with the first application;

an event engine module operatively coupled to the control module and implemented in at least one of the memory or the processing device, the event engine module configured to add a representation of the anomalous behavior to an evaluation tree as an attribute of a node (1) associated with the second application and (2) defined in the evaluation tree as a child of a node associated with the first application; and

a rule generation module implemented in at least one of the memory or the processing device, the rule generation module configured to generate a revised set of indications of allowed behavior associated with the first application based on the evaluation tree.

19. The apparatus of claim 18, further comprising the sandbox environment.

20. The apparatus of claim 18, wherein the control module is operatively coupled to the sandbox environment via a network.

21. The apparatus of claim 18, wherein the control module is configured to send the indication associated with the anomalous behavior such that the sandbox environment is terminated.

22. The apparatus of claim 18, wherein the control module is configured to revise the set of indications of allowed behavior associated with the first application in response to the anomalous behavior.

23. The apparatus of claim 18, wherein the second application is a web browser application, the indication associated with the anomalous behavior includes a uniform resource locator (URL) trace associated with the web browser application.

25. The apparatus of claim 18, wherein the set of indications of allowed behavior associated with the first application is specific to the first application.