Statistical fingerprinting for malware detection and classification

• US 9,135,440 B2
• Filed: 07/31/2013
• Issued: 09/15/2015
• Est. Priority Date: 08/01/2012
• Status: Active Grant

• Current Assignee: UT-Battelle LLC
• Original Assignee: UT-Battelle LLC
• Inventors: Prowell, Stacy J., Rathgeb, Christopher T.
• Primary Examiner(s): Rahman, Mohammad L
• Application Number:
  US13/955,784
• Publication Number:
  US 20140041031A1
• Time in Patent Office: 776 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

A system detects malware in a computing architecture with an unknown pedigree. The system includes a first computing device having a known pedigree and operating free of malware. The first computing device executes a series of instrumented functions that, when executed, provide a statistical baseline that is representative of the time it takes the software application to run on a computing device having a known pedigree. A second computing device executes a second series of instrumented functions that, when executed, provides an actual time that is representative of the time the known software application runs on the second computing device. The system detects malware when there is a difference in execution times between the first and the second computing devices.

Claims

1. A system that determines if malware exists in a computing architecture with an unknown pedigree comprising:

a first computing device having a known pedigree and operating free of malware, the first computing device operating a known software application that comprises a series of instrumented functions that, when executed, provide a statistical baseline time that is representative of the time it takes the software application to run on a computing device having a known pedigree and operating free of malware; and

a second computing device having an unknown pedigree and with the potential of operating with malware, the second computing device operating the known software application that further comprises a series of instrumented functions that, when executed, provides an actual time that is representative of the time the known software application runs on the second computing device having an unknown pedigree and operating with the potential of operating with malware;

where the instrumented functions are injected into the known software application through a code injection that facilitates accessing a plurality of subroutines that is shared by a plurality of software applications; and

where the difference in times between the statistical baseline time and the actual time identifies a malware status of the second machine.

2. The system of claim 1 where the identification comprises an automatic detection.

3. The system of claim 2 where the executed functions are injected into the known software application.

4. The system of claim 3 where the injection changes the sequence of execution of the known software.

5. The system of claim 4 where the injection comprises introducing software code into the known software application when the known software application is invoked.

6. The system of claim 5 where statistical baseline time is based on a plurality of executions of the known software application.

7. The system of claim 6 where the statistical baseline time is stored in a cloud storage system.

8. A method for determining if malware exists in a computing device with unknown pedigree and with the potential of operating with malware comprising:

a. identifying one or more functions in a software application;

b. instrumenting the functions by injecting code into the software application to that measures the execution time of the functions;

c. executing the software application on a first computing device with a known pedigree and that is known to be free of malware;

d. establishing a statistical baseline time that the software application takes to execute on a computing device with a known pedigree and that is known to be free of malware;

e. executing the software application on a second computing device that does not have a known pedigree and with the potential of having malware;

f. measuring the actual time that the software application takes to execute; and

g. comparing the actual time of execution with the statistical baseline time of execution where the injecting code facilitates accessing a plurality of subroutines that is shared by a plurality of software applications.

9. The method of claim 8 where the acts of measuring and comparing are executed by a processor remote from the execution of the software.