Systems and methods for securing computing devices against imposter processes

• US 9,489,513 B1
• Filed: 06/25/2013
• Issued: 11/08/2016
• Est. Priority Date: 06/25/2013
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Mesropian, Haik
• Primary Examiner(s): Tolentino, Roderick
• Application Number:
  US13/926,050
• Time in Patent Office: 1,232 Days
• Field of Search: 726 22- 25
• US Class Current: 1/1
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

A computer-implemented method for securing computing devices against imposter processes may include (1) identifying a process that is subject to a security assessment, (2) determining, based on comparing an attribute of the process to an attribute of a legitimate process, that the process comprises an imposter process of the legitimate process, (3) determining that a file may have been created by the imposter process, and (4) determining a security action for the file in response to determining that the file has been created by the imposter process. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for securing computing devices against imposter processes, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying, by the computing device, a process executing on the computing device that is subject to a security assessment;

determining, by the computing device initiating a query, based on comparing an attribute of the process to an attribute of a legitimate process, that a similarity between the process and the legitimate process meets a predetermined match threshold based at least in part on a similarity of a name of the process with a name of the legitimate process;

identifying the legitimate process in response to determining that the similarity between the process and the legitimate process meets the predetermined match threshold;

determining, by the computing device, in response to identifying the legitimate process, that the process is not the legitimate process at least in part by determining that at least one of;

the process does not comprise a digital signature that matches a digital signature of the legitimate process; and

a hash of the process does not match a hash of the legitimate process;

determining, based at least in part on the similarity between the process and the legitimate process meeting the predetermined match threshold and at least in part on determining that the process is not the legitimate process, that the process comprises an imposter process of the legitimate process;

determining, by the computing device, that a file has been created on the computing device by the imposter process;

determining, by the computing device, a security action for the file on the computing device in response to determining that the file has been created by the imposter process;

performing, by the computing device, the security action on the computing device for the file in response to determining the security action and thereby improving security on the computing device.

2. The computer-implemented method of claim 1, wherein comparing the attribute of the process to the attribute of the legitimate process comprises comparing a path of the process to an expected path of the legitimate process.

3. The computer-implemented method of claim 1, wherein determining that the process is not the legitimate process comprises determining that the process does not comprise the digital signature of the legitimate process.

4. The computer-implemented method of claim 1, wherein determining that the process is not the legitimate process comprises determining that the hash of the process does not match the hash of the legitimate process.

5. The computer-implemented method of claim 1, wherein determining that the process comprises an imposter process comprises determining that the process comprises an instance of the legitimate process that has loaded a malicious module, wherein the malicious module is not present in a trusted instance of the legitimate process.

6. The computer-implemented method of claim 5, further comprising removing the malicious module from the instance of the legitimate process.

7. The computer-implemented method of claim 1, wherein determining the security action for the file in response to determining that the file has been created by the imposter process comprises lowering a conviction threshold for the file.

8. The computer-implemented method of claim 1, wherein determining the security action for the file in response to determining that the file has been created by the imposter process comprises increasing a level of computing resources used to scan the file.

9. The computer-implemented method of claim 1, wherein the security action comprises at least one of:

notifying a user about the file;

deleting the file;

quarantining the file;

moving the file.

10. The computer-implemented method of claim 1, wherein the security action comprises at least one of:

blocking the imposter process from creating an additional file;

quarantining an additional file created by the imposter process.

11. A system for securing computing devices against imposter processes, the system comprising:

a memory that stores executable modules;

a process identification module, stored in the memory on a computing device, that identifies a process executing on the computing device that is subject to a security assessment;

an imposter determination module, stored in the memory on the computing device, that;

initiates a query to determine, based on comparing an attribute of the process to an attribute of a legitimate process, that a similarity between the process and the legitimate process meets a predetermined match threshold based at least in part on a similarity of a name of the process with a name of the legitimate process;

identifying the legitimate process in response to determining that the similarity between the process and the legitimate process meets the predetermined match threshold;

determines, in response to identifying the legitimate process, that the process is not the legitimate process at least in part by determining that at least one of;

the process does not comprise a digital signature that matches a digital signature of the legitimate process; and

a hash of the process does not match a hash of the legitimate process;

determines, based at least in part on the similarity between the process and the legitimate process meeting the predetermined match threshold and at least in part on determining that the process is not the legitimate process, that the process comprises an imposter process of the legitimate process;

a file determination module, stored in the memory on the computing device, that determines that a file has been created on the computing device by the imposter process;

a security determination module, stored in the memory on the computing device, that;

determines a security action for the file on the computing device in response to determining that the file has been created by the imposter process;

performs the security action on the computing device for the file in response to determining the security action and thereby improving security on the computing device;

at least one hardware processor that executes the process identification module, the imposter determination module, the file determination module and the security determination module.

12. The system of claim 11, wherein a comparing module compares the attribute of the process to the attribute of the legitimate process by comparing a path of the process to an expected path of the legitimate process.

13. The system of claim 11, wherein the imposter determination module determines that the process is not the legitimate process by determining that the process does not comprise the digital signature of the legitimate process.

14. The system of claim 11, wherein the imposter determination module determines that the process is not the legitimate process by determining that the hash of the process does not match the hash of the legitimate process.

15. The system of claim 11, wherein the imposter determination module determines that the process comprises an imposter process by determining that the process comprises an instance of the legitimate process that has loaded a malicious module, wherein the malicious module is not present in a trusted instance of the legitimate process.

16. The system of claim 15, further comprising a removing module that removes the malicious module from the instance of the legitimate process.

17. The system of claim 11, wherein the security determination module determines the security action for the file in response to determining that the file has been created by the imposter process by lowering a conviction threshold for the file.

18. A non-transitory computer-readable-storage medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify, by the computing device, a process executing on the computing device that is subject to a security assessment;

determine, by the computing device initiating a query, based on comparing an attribute of the process to an attribute of a legitimate process, that a similarity between the process and the legitimate process meets a predetermined match threshold based at least in part on a similarity of a name of the process with a name of the legitimate process;

identifying the legitimate process in response to determining that the similarity between the process and the legitimate process meets the predetermined match threshold;

determine, by the computing device, in response to identifying the legitimate process, that the process is not the legitimate process at least in part by determining that at least one of;

the process does not comprise a digital signature that matches a digital signature of the legitimate process; and

a hash of the process does not match a hash of the legitimate process;

determine, based at least in part on the similarity between the process and the legitimate process meeting the predetermined match threshold and at least in part on determining that the process is not the legitimate process, that the process comprises an imposter process of the legitimate process;

determine, by the computing device, that a file has been created on the computing device by the imposter process;

determine, by the computing device, a security action for the file on the computing device in response to determining that the file has been created by the imposter process;

perform, by the computing device, the security action on the computing device for the file in response to determining the security action and thereby improving security on the computing device.

19. The non-transitory computer-readable-storage medium of claim 18, wherein comparing the attribute of the process to the attribute of the legitimate process comprises comparing a path of the process to an expected path of the legitimate process.

20. The non-transitory computer-readable-storage medium of claim 18, wherein determining that the process comprises an imposter process comprises determining that the process comprises an instance of the legitimate process that has loaded a malicious module, wherein the malicious module is not present in a trusted instance of the legitimate process.