Behavior profiling for malware detection

• US 9,734,332 B2
• Filed: 03/16/2015
• Issued: 08/15/2017
• Est. Priority Date: 03/17/2014
• Status: Active Grant

• Current Assignee: Proofpoint Incorporated
• Original Assignee: Proofpoint Incorporated
• Inventors: Huang, Wayne, Idle, M. James
• Primary Examiner(s): Zhao, Don
• Application Number:
  US14/659,272
• Publication Number:
  US 20150261955A1
• Time in Patent Office: 883 Days
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Provided herein are systems and methods for behavior profiling of targets to determine malware presence. The method includes, in various embodiments, applying a domain specific language to a target, observing a set of temporal sequences and events of the target; determining presence of markers within the set of temporal sequences and events indicative of malware, and identifying the target as being associated with malware based on the markers. In some embodiments, a malware detection system is provided for creating a behavioral sandbox environment where a target is inspected for malware. The behavioral sandbox environment can include forensic collectors. Each of the collectors may be configured to apply a domain specific language to a target; observe a set of temporal sequences and events of the target; determine presence of markers within the set of temporal sequences and events indicative of malware; and detect malware presence based on the markers.

Claims

1. A method for behavior profiling for malware detection, comprising:

applying, via executable instructions stored in memory and executed by one or more processors coupled to a computer network, a domain specific language to a target accessible via the computer network, the domain specific language utilized to detect malware associated with the target, the domain specific language having a set of rules which includes;

detecting a set of temporal sequences and temporal events of the target;

determining a presence of one or more markers within the set of temporal sequences and temporal events that are indicative of the malware; and

identifying the target as being associated with the malware based on the presence of the one or more markers.

2. The method of claim 1, further comprising creating a behavior profile for the target based on the set of temporal sequences and temporal events.

3. The method of claim 1, wherein the target comprises any of an HTTP conversation, a URL, a starting URL, an advertisement tag, a document file, an executable file, and combinations thereof.

4. The method of claim 1, further comprising, in response to the malware being detected, determining a maliciousness, an identification, and behavior of the target.

5. The method of claim 1, further comprising:

determining if the malware is configured to protect itself from a monitored lab environment;

in response to the determining the malware is configured to protect itself from the monitored lab environment, provoking the malware to attack; and

in response to the provoking, recording activities of the malware.

6. The method of claim 1, further comprising creating one or more scenes from malicious behavior of the malware.

7. The method of claim 6, wherein each of the one or more scenes comprises a plurality of evidences, and further wherein each of the one or more scenes comprises an aggregated set of proofs and interpretations.

8. The method of claim 6, wherein each of the one or more scenes comprises any of a URL opening, a document opening, and an execution of an executable file.

9. The method of claim 6, wherein each of the one or more scenes comprises one or more sub-scenes that are based on an initiating scene.

10. The method of claim 6, further comprising executing a plurality of forensic collectors to gather evidence from the malware, wherein the evidence comprises activities of the malware that occur within the one or more scenes.

11. The method of claim 10, wherein the activities comprise any of HTTP requests and responses, exploitation efforts, file creation and modification, process creation, registry changes, foreign memory manipulation, and combinations thereof.

12. The method of claim 10, wherein each of the activities comprises a time stamp such that the activities can be arranged in a chronological order.

13. The method of claim 10, wherein each of the plurality of forensic collectors is configured to generate a forensic report comprising proofs, exhibits, interpretations, and correlations.

14. The method of claim 13, wherein the proofs comprise a predefined set of facts, the predefined set of facts being such that an analyzer tries to prove existence of the predefined set of facts within the one or more scenes.

15. The method of claim 14, wherein the proofs are derived from the exhibits.

16. The method of claim 15, wherein each of the exhibits comprise a section of evidence having a special meaning used to infer presence of the malware.

17. The method of claim 13, wherein each of the interpretations comprises a judgment of one of the forensic collectors relative to one of the scenes and based on a derived set of the proofs.

18. The method of claim 13, wherein each of the correlations comprises a causal relationship between instances of the evidence.

19. The method of claim 18, further comprising displaying each of the causal relationships in a tree representation.

20. A malware detection system, comprising:

a processor; and

a memory for storing executable instructions, the instructions being executed by the processor to create a behavioral sandbox environment where a target is inspected for malware, the behavioral sandbox environment using a plurality of forensic analyzers that are each configured to;

apply a domain specific language to the target;

detect a set of temporal sequences and temporal events of the target;

determine a presence of one or more markers within the set of temporal sequences and temporal events that are indicative of the malware; and

detect malware presence based on the presence of the one or more markers.

21. The system of claim 20, wherein each of the plurality of forensic analyzers is further configured to:

allow the target to execute therein; and

collect evidence from the malware using a plurality of collector modules, wherein the evidence comprises activities of the malware.

22. The system of claim 20, further comprising an Internet Protocol (IP) randomizer configured to:

cause network traffic to be routed via multiple geographic locations so as to leverage a larger IP address pool; and

switch IP addresses at a frequency such that the same IP address is not used for a predetermined period of time.

23. The system of claim 20, wherein each of the plurality of forensics analyzers is further configured to:

determine malicious behavior from the set of temporal sequences and temporal events; and

log the target in response to the malicious behavior being determined or suspected.

24. The system of claim 23, further comprising a static analysis configured to:

evaluate the target if the target is logged; and

create a rule set based on the malicious behavior of the target.