Identifying malicious threads

• US 9,135,443 B2
• Filed: 05/06/2010
• Issued: 09/15/2015
• Est. Priority Date: 05/06/2010
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Ramchetty, Harinath Vishwanath, Kapoor, Aditya, Giri, Babu Nath
• Primary Examiner(s): Holder, Bradley
• Assistant Examiner(s): MOHAMMADI, FAHIMEH M
• Application Number:
  US12/774,870
• Publication Number:
  US 20110277033A1
• Time in Patent Office: 1,958 Days
• Field of Search: 726/1, 726/10, 726 22- 30, 713164-167, 709/205, 709223-225, 705/38, 370/328
• US Class Current: 1/1
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for identifying and processing malicious threads In one aspect, a method includes identifying a memory heap block; identifying threads that reside in the memory heap block; determining whether at least one of the identified threads in the memory heap block is a malicious thread; and in response to determining that at least one of the identified threads is a malicious thread, terminating each of the identified threads.

Claims

1. A computer-implemented method to terminate a malicious thread, the method executed by a data processing apparatus and comprising:

identifying, in computer memory, a memory heap assigned to a particular computer process, the memory heap comprising a plurality of memory heap blocks;

determining that a particular one of the plurality of memory heap blocks is a malicious memory heap block added by a malicious source to the memory block assigned to the particular computer process;

identifying that one or more threads have a start address that resides within the malicious memory heap block, the one or more threads comprising a subset of a plurality of threads;

performing an analysis on each thread in the subset of threads based on each thread in the subset having a start address within the malicious memory heap block, to determine, for each of the threads in the subset, whether the thread is a malicious thread injected into the particular computer process by malware, the analysis comprising, for each of the threads in the subset, identifying a signature for the thread and comparing the signature for the thread to signatures of known malicious threads, the particular computer process comprising a non-malicious process, and at least one of the subset of threads is a non-malicious thread of the particular computer process; and

terminating threads in the subset of threads determined through the analysis to be malicious, where the at least one non-malicious thread is preserved.

2. The computer-implemented method of claim 1, wherein identifying threads that reside in the memory heap block comprises identifying threads which have a start address within an address range of the memory heap block.

3. The computer-implemented method of claim 1, wherein determining whether at least one of the identified threads in the memory heap block is a malicious thread comprises:

analyzing the memory heap block for the presence of malicious threads only in response to determining that at least one of the threads resides in the memory heap block.

4. At least one non-transitory computer storage medium encoded with instructions to terminate a malicious thread, where the instructions, when executed by data processing apparatus, cause the data processing apparatus to:

identify, in memory, a memory heap assigned to a particular computer process, the memory heap to comprise a plurality of memory heap blocks;

determine that a particular one of the plurality of memory heap blocks is a malicious memory heap block added by a malicious source to the memory block assigned to the particular computer process;

identify that one or more threads have a start address that resides within the malicious memory heap block, the one or more threads to comprise a subset of a plurality of threads;

perform an analysis on each thread in the subset of threads based on each thread in the subset having a start address within the malicious memory heap block, to determine, for each of the threads in the subset, whether the thread is a malicious thread injected into the particular computer process by malware, the analysis comprising, for each of the threads in the subset, identifying a signature for the thread and comparing the signature for the thread to signatures of known malicious threads, where the particular computer process is a non-malicious process, and at least one of the subset of threads is a non-malicious thread of the particular computer process; and

terminate threads in the subset of threads determined through the analysis to be malicious, where the at least one non-malicious thread is to be preserved.

5. The computer storage medium of claim 4, wherein identifying threads that reside in the memory heap block comprises identifying threads which have a start address within an address range of the memory heap block.

6. The computer storage medium of claim 4, wherein determining whether at least one of the identified threads in the memory heap block is a malicious thread comprises:

analyzing the memory heap block for the presence of malicious threads only in response to determining that at least one of the threads resides in the memory heap block.

7. A system comprising:

at least one data processing apparatus;

at least one computer memory device; and

protection code to terminate a malicious thread, the protection code executable by the at least one data processing apparatus to;

identify, in memory, a memory heap assigned to a particular computer process, the memory heap comprising a plurality of memory heap blocks;

determine that a particular one of the plurality of memory heap blocks is a malicious memory heap block added by a malicious source to the memory block assigned to the particular computer process;

identify that one or more threads have a start address that resides within the malicious memory heap block, the one or more threads comprising a subset of a plurality of threads;

perform an analysis on each thread in the subset of threads based on each thread in the subset having a start address within the malicious memory heap block, to determine, for each of the threads in the subset, whether the thread is a malicious thread injected into the particular computer process by malware, the analysis comprising, for each of the threads in the subset, identifying a signature for the thread and comparing the signature for the thread to signatures of known malicious threads, where the particular computer process is a non-malicious process, and at least one of the subset of threads is a non-malicious thread of the particular computer process; and

terminate threads in the subset of threads determined through the analysis to be malicious, where the at least one non-malicious thread is to be preserved.