Monitoring executed script for zero-day attack of malware

• US 9,898,605 B2
• Filed: 12/24/2015
• Issued: 02/20/2018
• Est. Priority Date: 12/24/2015
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Sahita, Ravi, Li, Xiaoning, Lu, Lixin, Deng, Lu, Shepsen, Alexander, Xu, Xiang, Huang, Liangjun, Liu, Hua, Huang, Kai
• Primary Examiner(s): Tsang, Henry
• Application Number:
  US14/757,979
• Publication Number:
  US 20170185774A1
• Time in Patent Office: 789 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

Embodiments are directed to hooking a call for a malware monitoring logic into a JavaScript API engine interpreter. Upon JavaScript being placed into heap memory, the malware monitoring logic can initiate an evaluation or analysis of the heap spray to determine whether the JavaScript includes malware or other malicious agents prior to execution of the JavaScript shell code. Upon execution of the JavaScript within the sandbox, the malware monitoring logic can initiate monitoring of the JavaScript using malware analysis and/or execution profiling techniques. Inferences can be made of the presence of malware based on a start and end time of the JavaScript execution.

Claims

1. A computer program product tangibly embodied on non-transient computer readable media, the computer program product comprising instructions operable when executed to:

execute script code by a script application programming interface (API);

detect, by a decoder, an event in the script code, the event comprising an indirect branch call;

redirect an instruction pointer to a predetermined memory location pointer based on the detection of the indirect branch call, the predetermined memory location comprising malware monitoring code;

execute the malware monitoring code in a sandbox upon execution of the redirection of the instruction pointer to the predetermined memory location;

identify, in a heap memory by the malware monitoring code, the script code loaded into the heap memory; and

evaluate, by the malware monitoring code, the script code in the heap memory for malicious code prior to execution of the script code;

wherein the instructions are further operable to;

identify a start of an execution of the script code in the sandbox;

identify an end of the execution of the script code in the sandbox; and

determine that the script code contains malicious code based on a time difference from the start of the execution to the end of the execution of the script code.

2. The computer program product of claim 1, wherein the instructions are further operable to determine the presence or absence of malware based on execution profiling.

3. The computer program product of claim 1, wherein the instructions are further operable to:

determine that one or more application versions are compatible with the script code; and

execute the script code in the sandbox based on the determination that one or more application versions are compatible with the script code.

4. The computer program product of claim 1, wherein the instructions are further operable when executed to hook into the script API to implant code into the script API that calls the malware monitoring code upon execution of the script API.

5. A computer implemented method comprising:

identifying one or more commands that when called trigger an instruction pointer redirection to a predetermined memory address;

identifying the memory address to be redirected to if the one or more commands are called, the memory address comprising malware monitoring code;

executing script code by a script application programming interface (API);

detecting, by a decoder, an event in the script code, the event comprising an indirect branch call;

redirecting an instruction pointer to a predetermined memory location pointer based on the detection of the indirect branch call, the predetermined memory location comprising malware monitoring code;

executing, by a hardware processor, the malware monitoring code in a sandbox upon execution of the redirection of the instruction pointer to the predetermined memory location;

identifying, by the malware monitoring code, the script code in a heap memory, the script code loaded into the heap memory by the script API; and

evaluating, by the malware monitoring code, the script code in the heap memory for malicious code prior to execution of the script code;

the method further comprising;

identifying, by the malware monitoring code, a start of an execution of the script code in the sandbox;

identifying, by the malware monitoring code, an end of the execution of the script code in the sandbox; and

determining, by the malware monitoring code, that the script code contains malicious code based on a time difference from the start of the execution to the end of the execution of the script code.

6. The computer implemented method of claim 5, wherein the malware monitoring code comprises an execution profiler implemented at least partially in hardware, the method further comprising determining, by the execution profiler, the presence or absence of malware.

7. The computer implemented method of claim 6, wherein determining the presence or absence of malware comprises executing one or more branches of the script code;

and determining whether the script code contains malware based on the results of executing each of the one or more branches of the script code.

8. The computer implemented method of claim 5, further comprising:

determining, by an interpreter implemented at least partially in hardware, that one or more application versions are compatible with the script code; and

executing, by the malware monitoring code, the script code in the sandbox based on the determination that one or more application versions are compatible with the script code.

9. The computer implemented method of claim 5 further comprising hooking, by a hooking module, into the script API to call the malware monitoring code at a start of an execution and an end of the execution of the script code.

10. The computer implemented method of claim 5, further comprising hooking into the script API to implant code into the script API that calls the malware monitoring code upon execution of the script API.

11. The computer implemented method of claim 10, wherein execution profiling comprises executing one or more indirect branches of the script code;

evaluating a result from the one or more branches, and determining the presence or absence of malware based on the result from each of the one or more branch executions.

12. A computing system for zero-day malware detection comprising:

a script application programming interface (API) module implemented at least partially in hardware to load a script code into heap memory for execution;

a decoder implemented at least partially in hardware to identify one or more commands comprising an indirect branch call and redirect an execution pointer to point to a predetermined memory location pointer based on the detection of the indirect branch call, the predetermined memory location pre-loaded with malware monitoring logic;

a heap memory to dynamically store the script code;

the malware monitoring logic preloaded into the predetermined memory location to identify the script code in the heap memory and evaluate the script code for malware prior to execution of the script code;

a processor implemented at least partially in hardware, the processor configured to;

execute the malware monitoring logic in a sandbox upon execution of the redirection of the instruction pointer to the predetermined memory location;

identify, in the heap memory by the malware monitoring logic, script code loaded into the heap memory; and

evaluate, by the malware monitoring logic, the script code in the heap memory for malicious code prior to execution of the script code

identify, by the malware monitoring logic, an execution start time of the script code in the sandbox;

identify, by the malware monitoring logic, an execution end time of the script code in the sandbox;

determine a time period between the execution start time and the execution end time of the script code; and

determine, based on the time period, that the script code contains malware.

13. The computing system of claim 12, wherein the script API module is configured to:

identify embedded script code in a document;

call the malware monitor logic upon identifying the script code; and

store the script code in the heap memory.

14. The computing system of claim 13, wherein the script API module is configured to determine that one or more applications with compatible versions for the execution of the script code are present and execute the script code based on the determination.

15. The computing system of claim 12, wherein the malware monitor logic is configured to determine the presence of absence or malware based on execution profiling of the script code.

16. The computing system of claim 15, wherein execution profiling comprises executing one or more indirect branches of the script code;

evaluating a result from the one or more branches, and determining the presence or absence of malware based on the result from each of the one or more branch executions.

17. The computing system of claim 12, further comprising a hooking logic to hook into an interpreter module to implant code to call a sandbox upon execution of the script code.