System and method for detecting time-bomb malware

• US 9,536,091 B2
• Filed: 06/24/2013
• Issued: 01/03/2017
• Est. Priority Date: 06/24/2013
• Status: Active Grant

• Current Assignee: Musarubra US LLC (Musarubra US SellCo LLC)
• Original Assignee: FireEye, Inc. (Alphabet Inc.)
• Inventors: Paithane, Sushant, Vincent, Michael, Vashisht, Sai, Kindlund, Darien
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): GUNDRY, STEPHEN T
• Application Number:
  US13/925,737
• Publication Number:
  US 20140380474A1
• Time in Patent Office: 1,289 Days
• US Class Current: 1/1
• CPC Class Codes: B01D 61/06 Energy recovery
• CPC Class Codes: C02F 1/44 by dialysis, osmosis or reverse osmosis general membrane separation processes B01D61/00, membrane modules B01D63/00, electrodialysis C02F1/4693, combination of membrane modules and bioreactors C02F3/1268
• CPC Class Codes: C02F 1/52 by flocculation or precipitation of suspended impurities C02F1/463 takes precedence
• CPC Class Codes: C02F 1/66 by neutralisation; pH adjustment for degassing C02F1/20; using ion-exchange C02F1/42; for flocculation or precipitation of suspended impurities C02F1/52; for removing dissolved compounds C02F1/58
• CPC Class Codes: C02F 1/76 with halogens or compounds of halogens C02F1/4674 takes precedence
• CPC Class Codes: C02F 2103/08 Seawater, e.g. for desalination
• CPC Class Codes: C02F 2303/10 Energy recovery
• CPC Class Codes: C02F 2303/18 Removal of treatment agents after treatment
• CPC Class Codes: C02F 2303/185 The treatment agent being halogen or a halogenated compound
• CPC Class Codes: C02F 3/1273 Submerged membrane bioreactors
• CPC Class Codes: C02F 5/08 Treatment of water with complexing chemicals or other solubilising agents for softening, scale prevention or scale removal, e.g. adding sequestering agents
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: Y02W 10/10 Biological treatment of water, waste water, or sewage
• CPC Class Codes: Y02W 10/30 Wastewater or sewage treatment systems using renewable energies

Abstract

According to one embodiment, a system comprises one or more counters; comparison logic; and one or more hardware processors communicatively coupled to the one or more counters and the comparison logic. The one or more hardware processors are configured to instantiate one or more virtual machines that are adapted to analyze received content, where the one or more virtual machines are configured to monitor a delay caused by one or more events conducted during processing of the content and identify the content as including malware if the delay exceed a first time period.

Claims

1. A system comprising:

an addressable memory; and

one or more hardware processors communicatively coupled to the addressable memory, the one or more hardware processors being configured to instantiate one or more virtual machines that are adapted to analyze received content that has been identified as suspicious by the content having a level of likelihood that at least one characteristic identified during inspection of the content indicates a potential presence of malware, the one or more virtual machines being configured to (i) monitor a delay caused by one or more events including, during processing of the suspicious content, an instruction pointer remaining at a specific address in the addressable memory or within a specific address range in the addressable memory that is less than an entire address range-and (ii) determine the suspicious content includes malware when the delay corresponding to the instruction pointer remaining at the specific address or within the specific address range exceeds a first time period.

2. The system of claim 1, wherein the one or more virtual machines being configured to further monitor time intervals for one or more Sleep request messages initiated during processing of the suspicious content and identifying the suspicious content as including malware if a combined delay for the one or more Sleep request messages exceeds the first time period.

3. The system of claim 1, wherein the one or more virtual machines being configured to further monitor time intervals for one or more Sleep request messages initiated during processing of the suspicious content and identifying the suspicious content as including malware if one of the time intervals exceeds the first time period.

4. The system of claim 1, wherein the one or more virtual machines being configured to further monitor the one or more events being a number of function calls initiated during processing of the suspicious content represented by a value contained in one or more counters accessible to the one or more virtual machines and identifying the suspicious content as including malware if the number of function calls exceeds a threshold value in response to a comparison conducted by comparison logic being processed by the one or more hardware processors.

6. The system of claim 1, wherein the one or more virtual machines being configured to further maintain and monitor values of time intervals for Sleep calls per call site, initiated during processing of the suspicious content and identifying the suspicious content as including malware if one of the time intervals exceeds a predetermined time period.

7. The system of claim 1, wherein the one or more virtual machines being configured to further maintain and monitor values of call counters for certain functions per call site, initiated during processing of the suspicious content, and identifying the suspicious content as including malware if one of the call counters exceeds the a predetermined count threshold.

8. The system of claim 1 further comprising a reporting module being configured to differentiate call sites based on module names and assign weights accordingly and identifying the suspicious content as including malware if a higher count is associated with a call site residing in the suspicious content under analysis.

9. The system of claim 1 further comprising a heuristic engine being configured to identify delay hotspots and identifying the suspicious content as including malware if one of a plurality of time intervals associated with the delay exceeds a predetermined time period.

10. The system of claim 1, wherein the one or more hardware processors being further configured to process a reporting module that issues an alert message indicating the presence of malware within the suspicious content.

11. The system of claim 1, wherein the one or more virtual machines being configured to determine the content includes malware when the delay corresponding to the instruction pointer remaining at the specific address or within the specific address range exceeds the first time period and no other malicious activity associated with the suspicious content has been detected by the one or more virtual machines.

5. A system comprising:

an addressable memory; and

one or more hardware processors communicatively coupled to the addressable memory, the one or more hardware processors being configured to instantiate one or more virtual machines that are adapted to analyze received content, the one or more virtual machines being configured to (i) monitor a delay caused by one or more events including, during processing of the content, an instruction pointer remaining at a specific address in the addressable memory or within a specific address range in the addressable memory that is less than an entire address range-and (ii) determine the content includes malware when the delay corresponding to the instruction pointer remaining at the specific address or within the specific address range exceeds a first time period and a level of utilization for the one or more hardware processors is greater than a prescribed operating threshold.

12. The system of claim 5, wherein the first time period has a duration that is dynamically set.

13. The system of claim 5, wherein the one or more virtual machines being configured to determine the content includes malware when the delay corresponding to the instruction pointer remaining at the specific address or within the specific address range exceeds the first time period, the level of utilization for the one or more hardware processors is greater than the prescribed operating threshold, and no other malicious activity associated with the suspicious content has been detected by the one or more virtual machines.

14. A system comprising:

one or more hardware processors;

a memory communicatively coupled to the one or more hardware processors, wherein the one or more hardware processors being configured to instantiate one or more virtual machines that are adapted to analyze received content that has been identified as suspicious by having a level of likelihood that at least one characteristic identified during prior inspection of the content indicates a potential presence of malware and the one or more virtual machines determine if the content includes time-bomb malware by monitoring, during processing of the received content within the one or more virtual machines, whether an instruction pointer is being repeatedly directed to a specific address or a specific address range that is less than an entire address space, and identifying the content as including malware when the instruction pointer is repeatedly directed to the specific address or the specific address range.

15. The system of claim 14, wherein the one or more virtual machines being configured to monitor time intervals for one type of event being one or more Sleep request messages initiated during processing of the received content and identifying the content as including malware if a total delay requested by the one or more Sleep request messages exceeds the second threshold being a first predetermined time period.

16. The system of claim 14, wherein the one or more virtual machines being configured to monitor time intervals for one type of event being one or more Sleep request messages initiated during processing of the content and identifying the content as including malware if one of the time intervals exceeds a first predetermined time period.

17. The system of claim 14, wherein the one or more virtual machines being configured to further monitor the number of events being a number of function calls initiated during processing of the content and identifying the content as including malware if the number of function calls exceeds the first threshold.

18. The system of claim 14, wherein the second threshold has a duration that is dynamically set.

19. The system of claim 14, wherein the one or more virtual machines being configured to maintain and monitor time intervals for Sleep calls per call site, initiated during processing of the content and identifying the content as including malware if one of the time intervals exceeds a predetermined time period.

20. The system of claim 14, wherein the memory further comprises a reporting module being configured to differentiate call sites based on module names and assign weights accordingly and identifying the content.