DETECTING UNAUTHORIZED USE OF COMPUTING DEVICES BASED ON BEHAVIORAL PATTERNS

• US 20090199296A1
• Filed: 02/04/2008
• Published: 08/06/2009
• Est. Priority Date: 02/04/2008
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Xie, Liang, Aciicmez, Onur, Seifert, Jean-Pierre, Zhang, Xinwen, Latifi, Afshin
• Granted Patent: US 8,595,834 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Techniques for detecting unauthorized use (e.g., malicious attacks) of the computing systems (e.g., computing devices) are disclosed. Unauthorized use can be detected based on patterns of use (e.g., behavioral patterns of use typically associated with a human being) of the computing systems. Acceptable behavioral pattern data can be generated for a computing system by monitoring the use of a support system (e.g., an operating system, a virtual environment) operating on the computing system. For example, a plurality of system support provider components of a support system (e.g., system calls, device drivers) can be monitored in order to generate the acceptable behavioral pattern data in a form which effectively defines an acceptable pattern of use (usage pattern) for the monitored system support provider components, thereby allowing detection of unauthorized use of a computing system by detecting any deviation from the acceptable pattern of use of the monitored system support provider components.

Claims

1. A computing system which effectively provides a support system that can support one or more application programs on said computing system, wherein said computing system is adapted for and/or capable of:

obtaining current pattern usage data indicating the current use of one or more system support provider components of said support system effectively provided by said computing system, wherein each of said system support provider components provides one or more services and/or resources that can be effectively requested and used by one or more application programs operating on said computing system;

obtaining acceptable behavioral pattern data for said one or more system support provider components of said support system, wherein said acceptable behavioral pattern data effectively defines an acceptable pattern of use for using said one or more system support provider components of said support system; and

determining, based on said acceptable pattern of use of said one or more system support provider components which is effectively defined by said acceptable behavioral pattern data, whether said current use of said one or more system support provider components is unauthorized.

2. A computing system as recited in claim 1, wherein said computing system is further adapted for and/or capable of:

monitoring a plurality of system support provider components of said support system when said computing system is operational; and

generating, based on said monitoring of said plurality of system support provider components, said acceptable behavioral pattern data in form which effectively defines an acceptable pattern of use for using said plurality of system support provider components, thereby allowing detection of unauthorized use of said computing system by detecting a deviation from said acceptable pattern of use for using said plurality of system support provider components.

3. A computing system as recited in claim 1, wherein said computing system is further adapted for and/or capable of:

detecting that said one or more application programs have effectively requested to use said one or more system support provider components.

4. A computing system as recited in claim 1, wherein said computing system is further adapted for and/or capable of:

generating an unauthorized use indication when said determining determines that said current use of said one or more system support provider components is unauthorized, thereby allowing remedial action to be taken; and

taking remedial action based on said unauthorized use indication.

5. A computing system as recited in claim 4, wherein said remedial action includes one or more of the following:

not allowing said one or more system support provider components to be used by said one or more application programs,

issuing a warning and/or error message, and

initiating and/or performing diagnostics based on said current pattern usage data.

6. A computing system as recited in claim 1, wherein said support system includes an operating system and said system support provider components include a plurality of system calls supported by said operating system.

7. A computing system as recited in claim 6, wherein said computing system includes a mobile device.

8. A computing system as recited in claim 7, wherein said mobile device is capable of communicating with one or more other devices and includes one or more of the following:

a cell phone, a mobile phone, and a Smartphone.

9. A computing system as recited in claim 1, wherein said acceptable behavioral pattern data further includes a system provider pattern of use which effectively indicates a pattern for using a plurality of system provider components including said one or more system provider components.

10. A computing system as recited in claim 7, wherein said acceptable behavioral pattern data further includes one or more of the following:

transition data associated with transitioning to, from, and/or between two or more system support provider components of said support system,

transition data associated with input and/or output provided in connection with transitioning to, from and/or between two or more system support provider components of said support system,

transition data that effectively indicates the manner in which input and/or output has been provided in connection with transitioning to and/or from said one or more system support provider components, and

transition data that effectively indicates the manner in which input and/or output has been provided in connection with transitioning between two or more system support provider components.

11. A mobile computing device, wherein said mobile computing device is adapted for and/or capable of:

detecting that a first system call has been made to one of a plurality of designated system calls of an operating system when said operating system is operating on said mobile computing device, wherein said operating system includes a plurality of system calls that effectively provide one or more resources and/or services to one or more application programs that can call said plurality of system calls in order to request said one or more resources and/or services from said operating system;

capturing information regarding said first system call as first system call information when said detecting detects that said first system call has been made;

detecting that a second system call that has been made to one of said plurality of designated system calls;

capturing information regarding said second system call as second system call information when said detecting detects that said second system call has been made;

converting said first and second system call information into system call pattern data representation, wherein said system call pattern data representation is in a form that allows extraction of one or more call patterns for calling said system calls based on one or more pattern extraction techniques;

extracting one or more call patterns from said system call pattern data representation based on said one or more pattern extraction techniques; and

storing said one or more call patterns as an acceptable system call profile for calling said first and/or second system calls, thereby allowing detection of unauthorized use of said computing device by detecting a deviation from said acceptable system call pattern for calling said first and/or second system calls.

12. A mobile computing device as recited in claim 11,

wherein said first and second system calls are not the same system call;

and

wherein said acceptable system call profile includes one or more of the following;

a system call sequence indicating the order in which said first and second system calls have been called,

transition data associated with transitioning to, from, and/between one or more system calls corresponding to said first and second system calls,

input and/or output associated with said first and/or second system calls, and

transition data that effectively indicates the manner in which input and/or output has been provided in connection with transitioning to, form and/or between said first and/or second system calls.

13. A mobile computing device as recited in claim 12,

wherein said capturing of information regarding said first and/or second system calls captures information based on one or more information capturing policies;

and

wherein said converting comprises;

filtering and/or preprocessing said first and second system call information based on one or more conversion policies.

14. A mobile computing device as recited in claim 13, wherein said one or more capturing and/or conversion policies are determined and/or changed dynamically based on said one or more application programs.

15. A mobile computing device as recited in claim 13, wherein said one or more capturing and/or conversion policies are determined and/or changed dynamically as a result of execution of said one or more application programs.

16. A mobile computing device as recited in claim 11, wherein said mobile computing device is further adapted for and/or capable of:

storing said acceptable system call profile in secured memory.

17. A mobile computing device as recited in claim 16, wherein said storing said acceptable system call usage profile comprises:

hashing said acceptable system call usage profile to kernel memory space.

18. A mobile computing device as recited in claim 11, wherein said acceptable system call profile includes one or more of the following:

a user profile for a user of said computing system, and

an application profile for said one or more application programs.

19. A mobile computing device as recited in claim 11, wherein said first and/or second system calls include one or more hook functions for monitoring calls made to said first and/or second system calls.

20. A mobile computing device as recited in claim 11, wherein said computing device is further adapted for and/or capable of:

detecting that a third system call has been made to one of said plurality of designated system calls;

obtaining said acceptable system call profile when said detecting detects that said third system call has been made, wherein said acceptable call profile effectively defines an acceptable call pattern for calling a first corresponding one of said plurality of system calls;

obtaining a first current system call pattern indicating a current call pattern used to call said first corresponding one of said plurality of system calls;

comparing said first current system call pattern to said acceptable system call profile;

(a) determining based on said comparing whether said first current system call pattern is within an acceptable range of said acceptable system call profile;

(b) determining that said third system call is an unauthorized system call when said determining (a) determines that said first current system call pattern is not within said acceptable range; and

generate an unauthorized use indication indicating that said third system call is unauthorized when said determining (b) determines that said third system call is an unauthorized system call.

21. A mobile computing device as recited in claim 20, wherein said third system call has been made using an authorized process that has been effectively controlled by an unauthorized component.

22. A mobile computing device as recited in claim 12, wherein said plurality of system calls include a selected group of system calls that are likely to be called in order to launch a malicious attack.

23. A mobile computing device as recited in claim 22,

wherein said one or more applications include one or more messaging applications;

wherein said selected group of system calls include one or more system calls that are likely to be used by messaging applications.

24. A method for generating acceptable behavioral pattern data that can be used to detect unauthorized use of a mobile computing device, said method comprising:

capturing information regarding said first system call as first system call information when said detecting detects that said first system call has been made;

detecting that a second system call that has been made to one of said plurality of designated system calls;

capturing information regarding said second system call as second system call information when said detecting detects that said second system call has been made;

converting said first and second system call information into system call pattern data representation, wherein said system call pattern data representation is in a form that allows extraction of one or more call patterns for calling said system calls based on one or more pattern extraction techniques;

extracting one or more call patterns from said system call pattern data representation based on said one or more pattern extraction techniques; and

storing said one or more call patterns as an acceptable system call profile for calling said first and/or second system calls, thereby allowing detection of unauthorized use of said computing device by detecting a deviation from said acceptable system call pattern for calling said first and/or second system calls.

25. A Method for detecting unauthorized use of a mobile computing device which effectively provides an operating system including a plurality of system calls that effectively provide one or more resources and/or services to one or more application programs that can call said of system calls in order to request said one or more resources and/or services, said method comprising

detecting that a first system call has been made to one of said plurality of designated system calls;

obtaining an acceptable system call usage profile when said detecting detects that said third system call has been made, wherein said acceptable usage profile effectively defines an acceptable call pattern for calling a corresponding one of said plurality of system calls which has been called by said first system call;

obtaining a first current system call pattern indicating a current call pattern used to make said first system call to said corresponding one of said plurality of designated system calls;

comparing said first current system call pattern to said acceptable system call usage profile;

(a) determining based on said comparing whether said first current system call pattern is within an acceptable range effectively defined by said acceptable system call usage profile;

(b) determining that said first system call is an unauthorized system call when said determining (a) determines that said first current system call pattern is not within said acceptable range;

generate an unauthorized use indication indicating that said third system call is unauthorized when said determining (b) determines that said first system call is an unauthorized system call.

26. A method of determining an acceptable pattern of use for a computing system which effectively provides a support system for supporting one or more application programs, wherein said acceptable pattern of use can be used to detect unauthorized use of said computing system, said method comprising:

monitoring a plurality of system support provider components of a support system operating on said computing system when said computing system is being used, wherein each of said system support provider components support provide one or more services and/or resources and can be effectively requested and used by one or more application programs operating on said computing system; and

generating, based on said monitoring a plurality of system support provider components, acceptable usage pattern data which effectively defines an acceptable pattern for using said plurality of system support provider components, thereby allowing detection of unauthorized use of said computing system by detecting a deviation from said acceptable pattern of use for using said plurality of system support provider components.

27. A method for detecting unauthorized use of a computing system which effectively provides a support system for supporting one or more application programs, said method comprising:

obtaining current pattern usage data indicating the current use of one or more of said plurality of system support provider components of said support system, wherein each of said system support provider components provide one or more services and/or resources that can be effectively requested and used by one or more application programs operating on said computing device;

obtaining acceptable behavioral pattern data for said one or more system support provider components of said system support, wherein said acceptable behavioral pattern data effectively defines an acceptable pattern for using said one or more system support provider components of said support system; and

determining, based on said acceptable usage pattern effectively defined by acceptable behavioral pattern data, whether said current use of said one or more system support provider components is unauthorized.

28. A computer readable medium including computer program code for detecting unauthorized use of a computing system which effectively provides a support system for supporting one or more application programs, wherein said computer readable includes:

computer program code for obtaining current pattern usage data indicating the current use of one or more of said plurality of system support provider components of said support system, wherein each of said system support provider components provide one or more services and/or resources that can be effectively requested and used by one or more application programs operating on said computing device;

computer program code for obtaining acceptable behavioral pattern data for said one or more system support provider components of said support system, wherein said acceptable behavioral pattern data effectively defines an acceptable pattern for using said one or more system support provider components of said support system; and

computer program code for determining, based on said acceptable usage pattern effectively defined by acceptable behavioral pattern data, whether said current use of said one or more system support provider components is unauthorized.

29. A computer readable medium including computer program code for determining an acceptable pattern of use for a computing system which effectively provides a support system for supporting one or more application programs, wherein said acceptable pattern of use can be used to detect unauthorized use of said computing system, wherein said computer readable medium includes:

computer program code for monitoring a plurality of system support provider components of a support system operating on said computing system when said computing system is being used, wherein each of said system support provider components support provide one or more services and/or resources and can be effectively requested and used by one or more application programs operating on said computing system; and

computer program code for generating, based on said monitoring a plurality of system support provider components, acceptable usage pattern data which effectively defines an acceptable pattern for using said plurality of system support provider components, thereby allowing detection of unauthorized use of said computing system by detecting a deviation from said acceptable pattern of use for using said plurality of system support provider components.