SYSTEM AND METHOD FOR SECURING AN INPUT/OUTPUT PATH OF AN APPLICATION AGAINST MALWARE WITH A BELOW-OPERATING SYSTEM SECURITY AGENT

• US 20120255021A1
• Filed: 03/31/2011
• Published: 10/04/2012
• Est. Priority Date: 03/31/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Sallam, Ahmed Said
• Granted Patent: US 8,966,624 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

A system for securing an electronic device may include a memory, a processor, one or more operating systems residing in the memory for execution by the processor, an input-output (I/O) device of the electronic device coupled to the operating system; and a security agent configured to execute on the electronic device at a level below all of the operating systems of the electronic device accessing the I/O device. The security agent may be further configured to: (i) trap, at a level below all of the operating systems of the electronic device accessing an input/output (I/O) device, an attempted access of a facility for I/O operation with the I/O device; and (ii) using one or more security rules, analyze the attempted access to determine whether the attempted access is indicative of malware.

Claims

1. A method for securing an electronic device, comprising:

trapping, at a level below all of the operating systems of the electronic device accessing an input/output (I/O) device, an I/O operation to the I/O device by an application;

in response to trapping the I/O operation, intercepting, at a level below all of the operating systems of the electronic device accessing the I/O device, original content of the I/O operation;

modifying and replacing, at a level below all of the operating systems of the electronic device accessing the I/O device, the original content of the I/O operation with modified content for transmission via an application I/O path of the I/O operation;

intercepting, at a level below all of the operating systems of the electronic device accessing the I/O device, the modified content after transmission via the application I/O path; and

analyzing, at a level below all of the operating systems of the electronic device accessing the I/O device, the intercepted modified content to determine if the modified content was affected by malware during transmission via the application I/O path.

2. A method according to claim 1, further comprising:

replacing, at a level below all of the operating systems of the electronic device accessing the I/O device, intercepted modified content transmitted via the application I/O path with the original content; and

transmitting, at a level below all of the operating systems of the electronic device accessing the I/O device, the original content of the I/O operation to the I/O device without transmission via the I/O path.

3. A method according to claim 1, further comprising initiating, at a level below all of the operating systems of the electronic device accessing the I/O device, corrective action in response to determining that the modified content was affected by malware during transmission via the application I/O path.

4. A method according to claim 3, wherein initiating corrective action comprises communicating forensic evidence to a protection server.

5. A method according to claim 3, wherein initiating corrective action comprises at least one of removing, quarantining, and neutralizing the malware.

6. A method according to claim 1, further comprising:

determining, if the application I/O path is vulnerable to malware attack; and

performing the trapping, intercepting, modifying, and analyzing steps in response to a determination that application I/O path is vulnerable to malware attack.

7. A method according to claim 1, further comprising:

spoofing access to an electronic device accessible via a network using the modified content for transmission via the application I/O path; and

analyzing, by the electronic device, actions taken during spoofed access to the electronic device to determine if a second electronic device including the application I/O path is infected by malware.

8. A system for securing an electronic device, comprising:

a memory;

a processor;

one or more operating systems residing in the memory for execution by the processor;

an input-output (I/O) device of the electronic device coupled to the operating system; and

a security agent configured to execute on the electronic device at a level below all of the operating systems of the electronic device accessing the I/O device, the security agent further configured to;

trap an I/O operation to a device by an application;

in response to trapping the I/O operation, intercept original content of the I/O operation;

modify and replace the original content of the I/O operation with modified content for transmission via an application I/O path of the I/O operation;

intercept the modified content after transmission via the application I/O path; and

analyze the intercepted modified content to determine if the modified content was affected by malware during transmission via the application I/O path.

9. A system according to claim 8, the security agent further configured to:

replace intercepted modified content transmitted via the application I/O path with the original content; and

transmit the original content of the I/O operation to the I/O device without transmission via the I/O path.

10. A system according to claim 8, the security agent further configured to initiate corrective action in response to determining that the modified content was affected by malware during transmission via the application I/O path.

11. A system according to claim 10, the security agent further configured to communicate forensic evidence to a protection server in order to initiate corrective action.

12. A system according to claim 10, the security agent further configured to perform at least one of removing, quarantining, and neutralizing the malware in order to initiate corrective action.

13. A system according to claim 8, the security agent further configured to:

determine if the application I/O path is vulnerable to malware attack; and

trap, intercept, modify, and analyze in response to a determination that application I/O path is vulnerable to malware attack.

14. A system according to claim 8, wherein:

the security agent is further configured to spoof access to an electronic device accessible via a network using the modified content for transmission via the application I/O path; and

the electronic device is configured to analyze actions taken during spoofed access to the electronic device to determine if a second electronic device including the application I/O path is infected by malware.

15. An article of manufacture, comprising:

a computer readable medium; and

computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to, at a level below all of the operating systems of the electronic device accessing an input/output (I/O) device;

trap an I/O operation to the I/O device by an application;

in response to trapping the I/O operation, intercept original content of the I/O operation;

modify and replace the original content of the I/O operation with modified content for transmission via an application I/O path of the I/O operation;

intercept the modified content after transmission via the application I/O path; and

analyze the intercepted modified content to determine if the modified content was affected by malware during transmission via the application I/O path.

16. An article according to claim 15, wherein the processor is further caused to:

replace intercepted modified content transmitted via the application I/O path with the original content; and

transmit the original content of the I/O operation to the I/O device without transmission via the I/O path.

17. An article according to claim 15, wherein the processor is further caused to initiate corrective action in response to determining that the modified content was affected by malware during transmission via the application I/O path.

18. An article according to claim 17, wherein the processor is further caused to communicate forensic evidence to a protection server in order to initiate corrective action.

19. An article according to claim 17, wherein the processor is further caused to perform at least one of removing, quarantining, and neutralizing the malware in order to initiate corrective action.

20. An article according to claim 15, wherein the processor is further caused to:

determine if the application I/O path is vulnerable to malware attack; and

trap, intercept, modify, and analyze in response to a determination that application I/O path is vulnerable to malware attack.

21. An article according to claim 15, wherein the processor is further caused to:

spoof access to an electronic device accessible via a network using the modified content for transmission via the application I/O path; and

analyze actions taken during spoofed access to the electronic device to determine if a second electronic device including the application I/O path is infected by malware.

22. A method for securing an electronic device, comprising:

trapping, at a level below all of the operating systems of the electronic device accessing an input/output (I/O) device, an attempted access of a facility for I/O operation with the I/O device; and

using one or more security rules, analyzing the attempted access to determine whether the attempted access is indicative of malware.

23. The method of claim 22, further comprising determining the identity of an entity that made the attempted access, wherein:

the facility for I/O operation includes a function for I/O operation; and

determining whether the attempted access is indicative of malware includes determining whether the entity is authorized to make the access.

24. The method of claim 22, further comprising:

determining the identity of an entity that made the attempted access;

wherein;

the facility for I/O operation includes a data structure for I/O operation; and

determining whether the attempted access is indicative of malware includes determining whether the entity is authorized to make the access.

25. An article of manufacture, comprising:

a computer readable medium; and

computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to, at a level below all of the operating systems of the electronic device accessing an input/output (I/O) device;

trap, at a level below all of the operating systems of the electronic device accessing the input/output (I/O) device, an attempted access of a facility for I/O operation with the I/O device; and

using one or more security rules, analyze the attempted access to determine whether the attempted access is indicative of malware.

26. The article of claim 25, wherein:

the processor is further caused to determine the identity of an entity that made the attempted access;

the facility for I/O operation includes a function for I/O operation; and

determining whether the attempted access is indicative of malware includes determining whether the entity is authorized to make the access.

27. The article of claim 25, wherein:

the process is further caused to determine the identity of an entity that made the attempted access;

the facility for I/O operation includes a data structure for I/O operation; and

determining whether the attempted access is indicative of malware includes determining whether the entity is authorized to make the access.

28. A system for securing an electronic device, comprising:

a memory;

a processor;

one or more operating systems residing in the memory for execution by the processor;

an input-output (I/O) device of the electronic device coupled to the operating system; and

a security agent configured to execute on the electronic device at a level below all of the operating systems of the electronic device accessing the I/O device, the security agent further configured to;

trap, at a level below all of the operating systems of the electronic device accessing an input/output (I/O) device, an attempted access of a facility for I/O operation with the I/O device; and

using one or more security rules, analyze the attempted access to determine whether the attempted access is indicative of malware.

29. The system of claim 28, wherein:

the security agent is further caused to determine the identity of an entity that made the attempted access;

the facility for I/O operation includes a function for I/O operation; and

determining whether the attempted access is indicative of malware includes determining whether the entity is authorized to make the access.

30. The system of claim 28, wherein:

the security agent is further caused to determine the identity of an entity that made the attempted access;

the facility for I/O operation includes a data structure for I/O operation; and

determining whether the attempted access is indicative of malware includes determining whether the entity is authorized to make the access.