DETECTING AND RESPONDING TO MALWARE USING LINK FILES

• US 20110093952A1
• Filed: 10/15/2009
• Published: 04/21/2011
• Est. Priority Date: 10/15/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Ramchetty, Harinath Vishwanath, Kumar, Lokesh, Kulkarni, Girish R.
• Granted Patent: US 8,863,282 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for monitoring the generation of link files by processes on a computer and performing protection processes based on whether the link files target malicious objects or are generated by malicious processes. In one aspect, a method includes monitoring for a generation of a first file that includes a target path that points to an object; in response to monitoring the generation of the first file: determining whether the target path is a uniform resource locator; in response to determining that the target path is a uniform resource locator, identifying a process that caused the first file to be generated; determining whether the process is a prohibited process; in response to determining that the process is a prohibited process, performing one or more protection processes on the process and the first file; in response to determining that the process is not a prohibited process, determining whether the uniform resource locator is a prohibited uniform resource locator; in response to determining that the uniform resource locator is a prohibited uniform resource locator, performing one or more protection processes on the process and the first file.

Claims

1. A computer-implemented method, comprising:

monitoring, by a first computer, a generation of a first file that includes a target path that points to an object;

in response to monitoring the generation of the first file;

identifying, by the first computer, a process that caused the first file to be generated;

determining, by the first computer, whether the process is a prohibited process;

in response to determining that the process is a prohibited process, performing, by the first computer, one or more protection processes on the process and the first file;

in response to determining that the process is not a prohibited process, determining, by the first computer, whether the target path is a uniform resource locator;

in response to determining that the target path is a uniform resource locator, determining, by the first computer, whether the uniform resource locator is a prohibited uniform resource locator;

in response to determining that the uniform resource locator is a prohibited uniform resource locator, performing, by the first computer, one or more protection processes on the first file.

2. The computer-implemented method of claim 1, wherein determining, by the first computer, whether the process is a prohibited process comprises:

generating, by the first computer, data descriptive of the process;

sending, by the first computer, the data descriptive of the process to a second computer;

receiving, by the first computer, data indicative of whether the process is a prohibited process from the second computer; and

determining, by the first computer, in response to the data received from the second computer, whether the process is a prohibited process.

3. The computer-implemented method of claim 2, wherein data descriptive of the process comprises a signature associated with the first process.

4. The computer-implemented method of claim 1, wherein determining, by the first computer, whether the uniform resource locator is a prohibited uniform resource locator comprises:

generating, by the first computer, data descriptive of the uniform resource locator;

sending, by the first computer, the data descriptive of the uniform resource locator to a second computer;

receiving, by the first computer, data indicative of whether the uniform resource locator is a prohibited uniform resource locator from the second computer; and

determining, by the first computer, in response to the data received from the second computer, whether the uniform resource locator is a prohibited uniform resource locator.

5. The computer-implemented method of claim 1, wherein the one or more protection processes performed on the process comprise one or more of the following:

terminating, by the first computer, the process;

deleting, by the first computer, one or more files associated with the process;

renaming, by the first computer, one or more files associated with the process;

quarantining, by the first computer, one or more files associated with the process; and

sending, by the first computer, one or more files associated with the process to a second computer for analysis.

6. The computer-implemented method of claim 1, wherein the one or more protection processes performed on the first file comprise one or more of the following:

deleting, by the first computer, one or more files associated with the first file;

renaming, by the first computer, one or more files associated with the first file; and

quarantining, by the first computer, one or more files associated with the first file.

7. The computer-implemented method of claim 1, wherein the first file is a link file.

8. A computer-implemented method, comprising:

monitoring, by a first computer, a generation of a first file that includes a target path that points to an object;

in response to monitoring the generation of the first file;

determining, by the first computer, whether the target path is a uniform resource locator;

in response to determining that the target path is a uniform resource locator, identifying, by the first computer, a process that caused the first file to be generated;

determining, by the first computer, whether the process is a prohibited process;

in response to determining that the process is a prohibited process, performing, by the first computer, one or more protection processes on the process and the first file;

in response to determining that the process is not a prohibited process, determining, by the first computer, whether the uniform resource locator is a prohibited uniform resource locator;

in response to determining that the uniform resource locator is a prohibited uniform resource locator, performing, by the first computer, one or more protection processes on the process and the first file.

9. The computer-implemented method of claim 8, wherein determining, by the first computer, whether the process is a prohibited process comprises:

generating, by the first computer, data descriptive of the process;

sending, by the first computer, the data descriptive of the process to a second computer;

receiving, by the first computer, data indicative of whether the process is a prohibited process from the second computer; and

determining, by the first computer, in response to the data received from the second computer, whether the process is a prohibited process.

10. The computer-implemented method of claim 9, wherein data descriptive of the process comprises a signature associated with the process.

11. The computer-implemented method of claim 8 wherein determining, by the first computer, whether the uniform resource locator is a prohibited uniform resource locator comprises:

generating, by the first computer, data descriptive of the uniform resource locator;

sending, by the first computer, the data descriptive of the uniform resource locator to a second computer;

receiving, by the first computer, data indicative of whether the uniform resource locator is a prohibited uniform resource locator from the second computer; and

determining, by the first computer, in response to the data received from the second computer, whether the uniform resource locator is a prohibited uniform resource locator.

12. The computer-implemented method of claim 8, wherein the one or more protection processes performed on the process comprise one or more of the following:

terminating, by the first computer, the process;

deleting, by the first computer, one or more files associated with the process;

renaming, by the first computer, one or more files associated with the process;

quarantining, by the first computer, one or more files associated with the process; and

sending, by the first computer, one or more files associated with the process to a second computer for analysis.

13. The computer-implemented method of claim 8, wherein the one or more protection processes performed on the first file comprise one or more of the following:

deleting, by the first computer, one or more files associated with the first file;

renaming, by the first computer, one or more files associated with the first file; and

quarantining, by the first computer, one or more files associated with the first file.

14. The computer-implemented method of claim 8, wherein the first file is a link file.

15. A computer storage medium encoded with a computer program, the program comprising instructions that when executed by data processing apparatus cause the data processing apparatus to perform operations comprising:

monitoring a generation of a first file that generates a request based on a uniform resource locator;

in response to monitoring the generation of the first file;

identifying a process that caused the first file to be generated;

determining whether the process is a prohibited process;

in response to determining that the process is a prohibited process, performing one or more protection processes on the process and the first file;

in response to determining that the process is not a prohibited process, determining whether the uniform resource locator is a prohibited uniform resource locator;

in response to determining that the uniform resource locator is a prohibited uniform resource locator, performing one or more protection processes on the process and the first file.

16. The computer storage medium of claim 15, wherein the instructions that cause the data processing apparatus to perform operations comprising determining whether the process is a prohibited process, further comprise instructions that cause the data apparatus to perform operations comprising:

generating data descriptive of the process;

sending the data descriptive of the process to a second computer;

receiving data indicative of whether the process is a prohibited process from the second computer; and

determining, in response to the data received from the second computer, whether the process is a prohibited process.

17. The computer storage medium of claim 16, wherein data descriptive of the process comprises a signature associated with the process.

18. The computer storage medium of claim 15, wherein the instructions that cause the data processing apparatus to perform operations comprising determining whether the uniform resource locator is a prohibited uniform resource locator, further comprise instructions that cause the data apparatus to perform operations comprising:

generating data descriptive of the uniform resource locator;

sending the data descriptive of the uniform resource locator to a second computer;

receiving data indicative of whether the uniform resource locator is a prohibited uniform resource locator from the second computer; and

determining, in response to the data received from the second computer, whether the uniform resource locator is a prohibited uniform resource locator.

19. The computer storage medium of claim 15, wherein the one or more protection processes performed on the process comprise one or more of the following:

terminating the process;

deleting one or more files associated with the process;

renaming one or more files associated with the process;

quarantining one or more files associated with the process; and

sending one or more files associated with the process to a second computer for analysis.

20. The computer storage medium of claim 15, wherein the one or more protection processes performed on the first file comprise one or more of the following:

deleting one or more files associated with the first file;

renaming one or more files associated with the first file; and

quarantining one or more files associated with the first file.

21. The computer storage medium of claim 15, wherein the first file is a link file.