Systems and methods for computer worm defense

• US 9,516,057 B2
• Filed: 04/04/2016
• Issued: 12/06/2016
• Est. Priority Date: 04/01/2004
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Aziz, Ashar
• Primary Examiner(s): CHEN, SHIN HON
• Application Number:
  US15/090,563
• Publication Number:
  US 20160301703A1
• Time in Patent Office: 246 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/45537 Provision of facilities of other operating environments, e.g. WINE I/O emulation G06F13/105
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 : using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A computer worm defense system comprises multiple containment systems tied together by a management system. Each containment system is deployed on a separate communication network and contains a worm sensor and a blocking system. In various embodiments, the computer worm may be transported from a production network, where the computer worm is not readily identifiable, to an alternate network in the worm sensor where the computer worm may be readily identifiable. Computer worm identifiers generated by a worm sensor of one containment system can be provided not only to the blocking system of the same containment system, but can also be distributed by the management system to blocking systems of other containment systems.

Claims

1. A system comprising:

one or more traffic analysis devices that are configured to perform an analysis of network traffic propagating over a communication network, the analysis includes identifying network communications characteristics associated with potential malware; and

a malicious traffic sensor implemented as part of a computing device and communicatively coupled to the one or more traffic analysis devices, the malicious traffic sensor to receive a portion of the analyzed network traffic, the malicious traffic sensor comprises

one or more virtual machines that perform activities in response to a processing of the received portion of the analyzed network traffic, and

a controller communicatively coupled to the one or more virtual machines, the controller to select software profiles for the one or more virtual machines and determine whether the received portion of the analyzed network traffic comprises malware by at least (i) monitoring behaviors of the one or more virtual machines during processing of the portion of the analyzed network traffic, (ii) determining whether the monitored behaviors denote a presence of malware by at least determining that a probability of the portion of the analyzed network traffic including malware exceeds a predetermined threshold, and (iii) responsive to the probability of the portion of the analyzed network traffic including malware exceeds a predetermined threshold, generating an identifier for the portion of the analyzed network traffic, the identifier operating as a signature for use in detecting the malware in at least a second computing device that is different from the computing device and communicatively coupled to the computing device via the communication network.

2. The system of claim 1, wherein the malicious traffic sensor is configured to copy at least the portion of the analyzed network traffic and provide the portion of the analyzed network traffic to the one or more virtual machines.

3. The system of claim 2, wherein the one or more virtual machines are part of a virtual computer network that is transparent to and separate from the communication network.

4. The system of claim 1 further comprising:

a malicious traffic blocking system in communication with the malicious traffic sensor over the communication network and configured to receive the identifier from the malicious traffic sensor to block the propagation of the malicious traffic within the communication network.

5. The system of claim 4, wherein the signature includes a Transfer Control Protocol (TCP) or a User Datagram Protocol (UDP) port number.

6. The system of claim 1, further comprising:

a management system in communication with the malicious traffic sensor, the management system to distribute the identifier to a malicious traffic blocking system of a second system that is separate from the first system.

7. The system of claim 6, wherein the management system automatically distributes the identifier to the malicious traffic blocking system of the second system.

8. The system of claim 7, wherein the management system distributes a software update to the malicious traffic sensor in response to payment of a subscription fee or refrains from distributing the software update to the malicious traffic sensor in response to non-payment of the subscription fee.

9. The system of claim 1, wherein the signature comprises a universal resource locator (URL) and the malicious traffic blocking system is capable of filtering by one or more URLs.

10. The system of claim 1, wherein the signature is for use by an inline signature based intrusion detection system, the signature being shared with the inline signature based intrusion detection system.

11. The system of claim 1, wherein the malware is a passive computer worm propagating within the communication network.

12. The system of claim 1, wherein the received portion of the analyzed network data comprises data from the network traffic propagating over the communication network.

13. The system of claim 1, wherein the signature is based on the monitored behaviors corresponding to one or more anomalous behaviors.

14. The system of claim 1, wherein the signature is based on the portion of the analyzed network traffic when the probability of the portion of the analyzed network traffic including malware exceeds the predetermined threshold.

15. A method comprising:

monitoring communications traffic from a communication network;

filtering the communications traffic from the communication network, the filtered communications traffic comprises one or more suspicious characteristics associated with malicious traffic, wherein the one or more suspicious characteristics indicating that the filtered communication traffic should be analyzed to determine whether or not the filtered communications traffic comprises malware;

determining whether the filtered communications traffic comprises malware by analyzing the filtered communications traffic, the analyzing of the filtered communications traffic comprises (i) monitoring behaviors of one or more virtual machines during processing of at least a portion of the filtered communications traffic and (ii) determining whether the monitored behaviors denote a presence of malware within the filtered communications traffic by at least determining that a probability of the portion of the filtered communications traffic including malware exceeds a predetermined threshold; and

responsive to the probability of the portion of the filtered communications traffic exceeding a predetermined threshold, generating an identifier for the portion of the filtered communications traffic, the identifier operating as a signature for use in detecting the malware in other communications traffic that is different from the communications traffic and propagating over the communication network.

16. The method of claim 15, wherein the one or more virtual machines correspond to virtual computer system using machine virtualization technologies to analyze the processing of the filtered communications traffic in an alternate computer network.

17. The method of claim 16, wherein

the filtering the communications traffic comprises copying at least the portion of filtered communications traffic from the communications traffic;

and

the monitoring of the behaviors of the one or more virtual machines comprises analyzing processing of the portion of filtered communications traffic to a virtual destination device in the alternate computer network.

18. The method of claim 15, wherein the monitoring of the one or more virtual machines during analyzing of the filtered communications traffic comprises:

executing the one or more virtual machines; and

identifying one or more anomalous behaviors performed by the one or more virtual machines during processing of the portion of filtered communications traffic.

19. The method of claim 15 further comprising distributing the identifier to an unauthorized activity detection system different from an unauthorized activity detection system that is determining whether the filtered communications traffic comprises malware and the generating of the identifier for the portion of the filtered communications traffic.

20. The method of claim 19 further comprising blocking the communications traffic including the malware from further propagating over the communication network.

21. A non-transitory machine readable medium having embodied thereon executable code, the executable code being executable by a processor to perform an unauthorized activity defense method comprising:

monitoring communications traffic from a communication network;

filtering the communications traffic from the communication network, the filtered communications traffic comprises one or more suspicious characteristics of malicious traffic, wherein the one or more suspicious characteristics identifying whether the filtered communication traffic should be analyzed to determine whether or not the filtered communications traffic comprises malware;

determining whether the filtered communications traffic comprises malware by analyzing the filtered communications traffic, the analyzing comprising (i) monitoring behaviors of one or more virtual machines during processing of at least a portion of the filtered communications traffic and (ii) determining whether the monitored behaviors denote a presence of malware within the filtered communications traffic by at least determining that a probability of the portion of the filtered communications traffic including malware exceeds a predetermined threshold; and

responsive to the probability of the portion of the filtered communications traffic exceeding a predetermined threshold, generating an identifier for the portion of the filtered communications traffic, the identifier operating as a signature for use in detecting the malware in other communications traffic that is different from the communications traffic and propagating over the communication network.