System and method of malware sample collection on mobile networks

• US 8,881,283 B2
• Filed: 10/09/2007
• Issued: 11/04/2014
• Est. Priority Date: 10/06/2006
• Status: Active Grant

• Current Assignee: Pulse Secure, LLC (Ivanti Software, Inc.)
• Original Assignee: Juniper Networks Incorporated
• Inventors: Tuvell, George, Venugopal, Deepak, Hu, Guoning
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): VU, PHY ANH TRAN
• Application Number:
  US11/869,719
• Publication Number:
  US 20080086776A1
• Time in Patent Office: 2,583 Days
• Field of Search: 713/188, 726 22- 25, 725 62- 63, 380/200, 380/210
• US Class Current: 726/24
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A collection agent monitors a mobile network for data samples containing executable code. The collection agent accepts executables and forwards them to a sample collection center for further analysis, reporting, or in some instances initiating one or more mitigating actions. Depending on the network protocol being monitored, the collection agent responds to connection attempts from nearby mobile devices.

Claims

1. A collection agent network device, comprising:

a first network interface communicatively coupled to a mobile network comprising a plurality of mobile devices, wherein the first network interface is operably adapted for intercepting a network data sample destined for one of the mobile devices of the plurality of mobile devices of the mobile network before the network data sample arrives at the one of the mobile devices, wherein the collection agent network device is separate from the one of the mobile devices;

a protocol handler processing unit operably adapted to receive the network data sample from the first network interface, determine whether the network data sample includes executable code that is executable by the one of the mobile devices, and to extract the executable code from the network data sample when the network data sample is determined to include the executable code; and

a second network interface operably adapted for receiving the executable code from the protocol handler processing unit and for sending the executable code to a sample collection center when the protocol handler processing unit determines that the network data sample includes executable code that is executable by the one of the mobile devices, wherein the sample collection center is separate from the collection agent network device and the plurality of mobile devices of the mobile network.

2. The collection agent network device of claim 1, wherein the first network interface and the second network interface are the same physical interface.

3. The collection agent network device of claim 1, wherein the protocol handler processing unit is operably adapted to scan the executable code, to detect if the executable code contains a malware, and to provide an indication of the malware in the executable code to the sample collection center.

4. The collection agent network device of claim 1, wherein the first interface is selected from a group consisting of:

a wireless interface, a Bluetooth wireless interface, a WiFi wireless interface, an IEEE 802.x wireless interface, a data networking interface, a TCP/IP capable data networking interface, and an Internet capable data networking interface, and wherein the second interface is selected from the group consisting of;

a wireless interface, a WiFi wireless interface, an IEEE 802.x wireless interface, a data networking interface, a TCP/IP capable data networking interface, an Internet capable data networking interface, a telephony interface, a plain old telephone interface, an ISDN interface, an xDSL interface, and a fiber interface.

5. The collection agent network device of claim 1, wherein the one of the mobile devices comprises a first mobile device of the plurality of mobile devices, and wherein the first network interface is configured to intercept the network data sample from a second, different mobile device of the plurality of mobile devices of the mobile network.

6. A method of detecting malware for use in a mobile environment, the method comprising:

intercepting network communications destined for mobile devices in the mobile environment, wherein the network communications conform to a wireless protocol;

determining whether a sample of the network communications destined for one of the mobile devices contains executable code;

when the sample is determined to include executable code;

accepting the executable code;

verifying the executable code is executable by the one of the mobile devices; and

when the executable code is verified to be executable by the one of the mobile devices, sending, by a collection agent network device comprising a processing unit and separate from the mobile devices, the executable code to a sample collection center, wherein the collection agent network device is communicatively coupled to the mobile network.

7. The method of claim 6, wherein the wireless protocol is selected from a group consisting of:

Bluetooth, WiFi, IEEE 802.x, and TCP/IP.

8. The method of claim 6, wherein the one of the mobile devices comprises a first mobile device, wherein the wireless protocol is selected from a group consisting of:

Bluetooth, WiFi, and 802.x, and wherein accepting the executable code further comprises;

receiving a broadcast connection message from a second mobile device;

in response to the broadcast connection message, sending a connection response message to the second mobile device; and

after sending the connection response message, receiving the executable code from the second mobile device.

9. The method of claim 6, further comprising:

scanning the executable code for a malware; and

sending an indication to the sample collection center when malware is detected in the executable code.

10. The method of claim 9, further comprising:

blocking further transmission of the executable code containing the malware when malware is detected in the executable code.

11. The method of claim 9, wherein the one of the mobile devices comprises a first mobile device, the method further comprising:

alerting a second mobile device that the executable code contains malware when malware is detected in the executable code.

12. The method of claim 9, further comprising:

preventing the executable code containing the malware from being executed on a mobile device.

13. A wireless sample collection system, comprising:

A processor and a computer-readable storage medium having stored thereon instructions that, when executed by the processor, cause the processor to;

intercept network communications destined for mobile devices in a mobile environment, wherein the network communications conform to a wireless network protocol;

determine whether a sample of the network communications destined for one of the mobile devices contains executable code;

accept the executable code when the sample includes the executable code;

verify that the executable code is executable by the one of the mobile devices when the sample includes the executable code; and

send, when the sample includes the executable code and when the executable code is verified to be executable by the one of the mobile devices, the executable code to a network management system, wherein the wireless sample collection system is communicatively coupled to the mobile network, and wherein the wireless sample collection system is separate from the mobile devices.

14. The wireless sample collection system of claim 13, wherein the instructions to accept comprise instructions that cause the processor to:

receive a broadcast connection message; and

send a connection response message.

15. The wireless sample collection system of claim 13, wherein the computer-readable storage medium further includes instructions that, when executed by the processor, cause the processor to:

scan the executable code to detect when the executable code contains a malware; and

report that the executable code contains the malware when the malware is detected in scanning.

16. The wireless sample collection system of claim 15, wherein the computer-readable storage medium further includes instructions that, when executed by the processor, cause the processor to:

block further transmission of the executable code containing the malware.

17. The wireless sample collection system of claim 15, wherein the computer-readable storage medium further includes instructions that, when executed by the processor, cause the processor to:

prevent the executable code containing the malware from being executed on a mobile device.

18. The wireless sample collection system of claim 15, wherein the computer-readable storage medium further includes instructions that, when executed by the processor, cause the processor to:

alert a mobile device that the executable code contains the malware.

19. The collection agent network device of claim 13, wherein the protocol handler processing unit is operably adapted to block further transmission of the executable code containing the malware when malware is detected in the executable code.

20. A non-transitory computer-readable storage medium comprising instructions that, when executed, cause a processor of a collection agent network device to:

intercept network communications destined for mobile devices in a mobile environment, wherein the network communications conform to a wireless protocol;

determine whether a sample of the network communications destined for one of the mobile devices contains executable code;

when the sample is determined to include executable code;

verify that the executable code is executable by the one of the mobile devices; and

when the executable code is verified to be executable by the one of the mobile devices, send the executable code to a sample collection center, wherein the collection agent network device is communicatively coupled to the mobile network, and wherein the collection agent network device is separate from the mobile devices.