Method and apparatus for determination of the non-replicative behavior of a malicious program

• US 7,103,913 B2
• Filed: 05/08/2002
• Issued: 09/05/2006
• Est. Priority Date: 05/08/2002
• Status: Active Grant

• Current Assignee: Barracuda Networks Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Whalley, Ian N., Morar, John F., Arnold, William C., Segal, Alla, Chess, David M., White, Steve R.
• Primary Examiner(s): Song, Hosuk
• Assistant Examiner(s): TO, BAOTRAN N
• Application Number:
  US10/141,896
• Publication Number:
  US 20030212906A1
• Time in Patent Office: 1,581 Days
• Field of Search: 714/3, 714/38, 726/24, 726/26, 726/22, 726/23, 726/25, 717/188, 713/188
• US Class Current: 726/22
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

Disclosed is a method, a computer system and a computer readable media product that contains a set of computer executable software instructions for directing the computer system to execute a process for determining a non-replicative behavior of a program that is suspected of containing an undesirable software entity. The process causes execution of the program in at least one known environment and automatically examines the at least one known environment to detect if a change has occurred in the environment as a result of the execution of the program. If a change is detected, the process automatically analyzes the detected change (i.e., the process performs a side effects analysis) to determine if the change resulted from execution of the program or from execution of the undesirable software entity. The process then uses the result of the analysis at least for undoing a detected change that results from execution of the undesirable software entity. The result of the analysis can also be used for informing a user of an anti-virus system of the non-replicative changes made to the environment.

Claims

1. A computer executed method for processing a suspect executable file, comprising:

attempting to infect a known file using the suspect executable file and, if the attempt is successful, providing the infected known file as a sample, executing the sample in a controlled environment;

determining a record of side effects that occur in the environment as a result of a non-replicative behavior of the sample during its execution;

comparing the record to a stored record of side effects that occur in the environment as a result of a non-replicative behavior of the known file during its execution and deriving a set of characteristic side effects; and

undoing a detected change that results from execution of an undesirable software entity and/or informing a user of the side effects;

if the attempt to infect the known file is not successful, the method further includes;

attempting to repair the suspect executable file and, if the attempt is successful, providing the repaired file as the sample;

executing the sample in the controlled environment;

determining a first record of side effects that occur in the environment as a result of a non-replicative behavior of the sample during its execution;

executing the suspect executable file in the controlled environment;

determining a second record of side effects that occur in the environment as a result of a non-replicative behavior of the suspect executable file during its execution;

comparing the first record to the second record and deriving the set of characteristic side effects; and

undoing a detected change that results from execution of an undesirable software entity and/or informing a user of the side effects.

2. A method as in claim 1, where if the attempt to repair the suspect executable file is not successful, the method further includes:

executing the suspect executable file in the controlled environment;

determining the second record of side effects that occur in the environment as a result of a non-replicative behavior of the suspect executable file during its execution; and

comparing the second record to a third record of side effects that occur in the environment as a result of a non-replicative behavior of at least one known program, and deriving the set of characteristic side effects.

3. A method as in claim 2, where the third record comprises side effects of a program determined by a graphical user interface analyzer.

4. A method as in claim 1, where the first record and the second record comprise a content of a registry.

5. A method as in claim 1, where the first record and the second record comprise a content of system initialization files.

6. A method as in claim 1, where set of characteristic side effects comprise a definition output from a side effects analyzer means.

7. A method as in claim 2, where a total number of iterations of the method is a function of at least a type of the determined side effects.

8. A method as in claim 2, where a total number of iterations of the method is a function of at least a consistency of the determined side effects from one iteration to the next.