Security policy deployment and enforcement system for the detection and control of polymorphic and targeted malware

• US 9,917,864 B2
• Filed: 09/02/2016
• Issued: 03/13/2018
• Est. Priority Date: 10/28/2011
• Status: Active Grant

• Current Assignee: Carbon Black, Inc. (Broadcom, Inc.)
• Original Assignee: Carbon Black, Inc. (Broadcom, Inc.)
• Inventors: Kraemer, Jeffrey Albin
• Primary Examiner(s): HO, DAO Q
• Application Number:
  US15/255,374
• Publication Number:
  US 20160373486A1
• Time in Patent Office: 557 Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present system and method pertain to the detection of malicious software and processes such as malware. A cloud security policy system receives hashes and behavioral information about applications and/or processes executing on user devices. The cloud security policy system records this information and then evaluates the trustworthiness of the hashes based on the information received from the user devices to provide a security policy for the applications and/or processes. The security policy is sent from the cloud security policy system to user devices to be applied by the user devices.

Claims

1. A method for monitoring applications on user devices, the method comprising:

monitoring applications requesting to open files using system dynamic-link libraries;

searching for hashes corresponding to the files requested by the applications in caches of the user devices;

upon locating hashes of the files requested by the applications, searching for security policies associated with the hashes;

upon locating the security policies associated with the hashes, enforcing restrictions of the security policies; and

upon failing to locate the hashes of the files requested by the applications;

scanning contents of the files;

calculating hashes for the files; and

updating the caches of the user devices by adding mappings for the hashes to the caches of the user devices and requesting trust scores and establishing security policies based on the trust scores for the files requested by the applications.

2. The method of claim 1, wherein the restrictions of the security policies include denying the applications to access files.

3. The method of claim 1, wherein the restrictions of the security policies include terminating the applications.

4. The method of claim 1, wherein searching for security policies associated with the hashes comprises executing lookups of security policies for the hashes in the caches of the user devices.

5. The method of claim 1, wherein searching for security policies associated with the hashes comprises searching local databases within the user devices for the security policies for the hashes.

6. The method of claim 1, further comprising:

upon failing to locate the security policies associated with the hashes, enforcing default security policies.

7. The method of claim 1, further comprising:

upon locating the security policies associated with the hashes, enforcing security policy enforcement actions of the security policies in addition to enforcing restrictions of the security policies.