System and method for local protection against malicious software

• US 8,925,101 B2
• Filed: 07/28/2010
• Issued: 12/30/2014
• Est. Priority Date: 07/28/2010
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Bhargava, Rishi, Reese, David P. Jr.
• Primary Examiner(s): Traore, Fatoumata
• Application Number:
  US12/844,892
• Publication Number:
  US 20120030731A1
• Time in Patent Office: 1,616 Days
• Field of Search: None
• US Class Current: 726/27
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method in one example implementation includes intercepting a network access attempt on a computing device and determining a software program file associated with the network access attempt. The method also includes evaluating a first criterion to determine whether the network access attempt is permitted and blocking the network access attempt if it is not permitted. The first criterion includes a trust status of the software program file. In specific embodiments, the trust status is defined as trusted if the software program file is included in a whitelist of trustworthy program files and untrusted if the software program file is not included in a whitelist. In more specific embodiments, the method includes blocking the network access attempt if the software program file has an untrusted status. In further embodiments, an event is logged if the software program file associated with the network access attempt has an untrusted status.

Claims

1. A method comprising:

intercepting, on a computing device, one or more packets of an outbound network access attempt initiated by a process executing on the computing device, wherein the packets include a requested destination address in a network;

determining the process mapped to the packets;

querying a process traffic mapping element of the computing device to determine each software program file of a plurality of software program files mapped to the process in the process traffic mapping element, wherein at least one software program file of the plurality of software program files is an executable file and at least one other software program file of the plurality of software program files is a library module loaded by the process;

determining a trust status of each software program file of the plurality of software program files;

determining whether the network access attempt is permitted based on at least a first criterion, wherein the first criterion includes the trust status of each software program file of the plurality of software program files; and

blocking the network access attempt on the computing device if the network access attempt is not permitted.

2. The method of claim 1, further comprising:

searching a whitelist identifying trustworthy software program files to determine whether the plurality of software program files are each identified in the whitelist.

3. The method of claim 2, wherein a trust status of a particular software program file of the plurality of software program files is defined as trusted if the particular software program file is included in the whitelist.

4. The method of claim 2, wherein a trust status of a particular software program file of the plurality of software program files is defined as untrusted if the particular software program file is not identified in the whitelist.

5. The method of claim 4, wherein the network access attempt is blocked if the trust status of any one of the software program files of the plurality of software program files is defined as untrusted.

6. The method of claim 2, further comprising:

searching a cache for a predetermined checksum associated with a particular software program file of the plurality of software program files; and

computing a new checksum for the particular software program file if a predetermined checksum for the particular software program file is not found in the cache.

7. The method of claim 2, wherein the whitelist includes one or more global whitelists.

8. The method of claim 2, wherein the whitelist includes one or more internal whitelists.

9. The method of claim 1, wherein the process was initiated by the executable file on the computing device.

10. The method of claim 1, wherein the process is determined to be mapped to the packets based on the querying the process traffic mapping element.

11. The method of claim 1, further comprising:

evaluating a second criterion to determine whether the second criterion overrides the first criterion, wherein the second criterion includes a network access policy for one or more software program files having a trust status defined as untrusted.

12. The method of claim 11, wherein the network access policy includes a set of allowed destination addresses, wherein the second criterion overrides the first criterion such that the network access attempt is permitted if the requested destination address is included within the set of allowed destination addresses.

13. The method of claim 12, wherein the set of allowed destination addresses is a subnet of network addresses on a local area network or a subnet of Internet Protocol (IP) addresses on a wide area network (WAN).

14. The method of claim 11, wherein the network access policy is selected from a group of network access policies, the group consisting of:

blocking all inbound network access attempts to the computing device and all outbound network access attempts from the computing device;

blocking all inbound network access attempts to the computing device;

blocking all outbound network access attempts from the computing device;

blocking all outbound network access attempts from the computing device to a specified network subnet;

blocking all outbound network access attempts from the computing device to the Internet and allowing all outbound network access attempts from the computing device to a specified subnet;

blocking all outbound network access attempts to domain name system (DNS) servers;

blocking all outbound network access attempts using simple mail transfer protocol (SMTP); and

blocking all outbound network access attempts to an Internet Relay Chat (IRC) server.

15. The method of claim 1, further comprising:

evaluating a third criterion to determine whether the third criterion overrides the first criterion, wherein the third criterion includes a predefined condition selected from a group of predefined conditions, the group consisting of;

an owner privilege of one or more of the plurality of software program files;

a file attribute of one or more of the plurality of software program files;

a creation date of one or more of the plurality of software program files; and

a modification date of one or more of the plurality of software program files.

16. The method of claim 1, further comprising:

logging information related to the network access attempt in a memory element if the trust status of one or more of the plurality of software program files is determined to be untrusted.

17. Logic encoded in one or more non-transitory tangible media that includes code for execution and when executed by one or more processors is operable to perform operations comprising:

intercepting, on a computing device, one or more packets of an outbound network access attempt initiated by a process executing on the computing device, wherein the packets include a requested destination address in a network;

determining the process mapped to the packets;

querying a process traffic mapping element of the computing device to determine each software program file of a plurality of software program files mapped to the process in the process traffic mapping element, wherein at least one software program file of the plurality of software program files is an executable file and at least one other software program file of the plurality of software program files is a library module loaded by the process;

determining a trust status of each software program file of the plurality of software program files;

determining whether the network access attempt is permitted based on at least a first criterion, wherein the first criterion includes the trust status of each software program file of the plurality of software program files; and

blocking the network access attempt on the computing device if the network access attempt is not permitted.

18. The logic of claim 17, the one or more processors being operable to perform further operations comprising:

searching a whitelist identifying trustworthy software program files to determine whether the plurality of software program files are each identified in the whitelist.

19. The logic of claim 18, wherein the whitelist includes one or more global whitelists.

20. The logic of claim 18, wherein a trust status of a particular software program file of the plurality of software program files is defined as untrusted if the particular software program file is not identified in the whitelist.

21. The logic of claim 20, wherein the network access attempt is blocked if the trust status of the particular software program file is defined as untrusted.

22. The logic of claim 17, wherein the process was initiated by the executable file on the computing device.

23. The logic of claim 17, wherein the process is determined to be mapped to the packets based on the querying the process traffic mapping element.

24. The logic of claim 17, the one or more processors being operable to perform further operations comprising:

evaluating a second criterion to determine whether the second criterion overrides the first criterion, wherein the second criterion includes a network access policy for one or more software program files having a trust status defined as untrusted.

25. The logic of claim 24, wherein the network access policy includes a set of allowed destination addresses, wherein the second criterion overrides the first criterion such that the network access attempt is permitted if the requested destination address is included within the set of allowed destination addresses.

26. The logic of claim 25, wherein the set of allowed destination addresses is a subnet of network addresses on a local area network or a subnet of Internet Protocol (IP) addresses on a wide area network (WAN).

27. The logic of claim 24, wherein the network access policy is selected from a group of network access policies, the group consisting of:

blocking all inbound network access attempts to the computing device and all outbound network access attempts from the computing device;

blocking all inbound network access attempts to the computing device;

blocking all outbound network access attempts from the computing device;

blocking all outbound network access attempts from the computing device to a specified network subnet;

blocking all outbound network access attempts from the computing device to the Internet and allowing all outbound network access attempts from the computing device to a specified subnet;

blocking all outbound network access attempts to domain name system (DNS) servers;

blocking all outbound network access attempts using simple mail transfer protocol (SMTP); and

blocking all outbound network access attempts to an Internet Relay Chat (IRC) server.

28. An apparatus, comprising:

a protection module;

one or more processors operable to execute instructions associated with the protection module, to cause the one or more processors to;

intercept, on a computing device, one or more packets of an outbound network access attempt initiated by a process executing on the computing device, wherein the packets include a requested destination address in a network;

determine the process mapped to the packets;

query a process traffic mapping element of the computing device to determine each software program file of a plurality of software program files mapped to the process in the process traffic mapping element, wherein at least one software program file of the plurality of software program files is an executable file and at least one other software program file of the plurality of software program files is a library module loaded by the process;

determine a trust status of each software program file of the plurality of software program files;

determine whether the network access attempt is permitted based on at least a first criterion, wherein the first criterion includes the trust status of each software program file of the plurality of software program files; and

block the network access attempt on the computing device if the network access attempt is not permitted.

29. The apparatus of claim 28, wherein a trust status of a particular software program file of the plurality of software program files is defined as untrusted if the particular software program file is not included in a whitelist identifying trustworthy software program files.

30. The apparatus of claim 29, wherein the whitelist includes one or more global whitelists.

31. The apparatus of claim 29, wherein the whitelist includes one or more internal whitelists maintained within one or more local area networks linked to the computing device.

32. The apparatus of claim 28, wherein the process was initiated by the executable file on the computing device.

33. The apparatus of claim 28, wherein the process is determined to be mapped to the packets based on the querying the process traffic mapping element.

34. The apparatus of claim 28, the one or more processors operable to execute further instructions comprising:

evaluating a second criterion to determine whether the second criterion overrides the first criterion, wherein the second criterion includes a network access policy for one or more software program files having a trust status defined as untrusted.

35. The apparatus of claim 34, wherein the network access policy includes a set of allowed destination addresses, wherein the second criterion overrides the first criterion such that the network access attempt is permitted if the requested destination address is included within the set of allowed destination addresses.

36. The apparatus of claim 35, wherein the set of allowed destination addresses is a subnet of network addresses on a local area network or a subnet of Internet Protocol (IP) addresses on a wide area network (WAN).

37. A method, comprising:

intercepting, on a computing device, one or more packets of an outbound network access attempt initiated by a process executing on the computing device, wherein the packets include a requested destination address in a network;

determining the process mapped to the packets;

querying a process traffic mapping element of the computing device to determine each software program file of a plurality of software program files mapped to the process in the process traffic mapping element, wherein at least one software program file of the plurality of software program files is an executable file and at least one other software program file of the plurality of software program files is a library module loaded by the process;

determining a trust status of each software program file of the plurality of software program files;

determining whether the network access attempt is permitted based on at least a first criterion, wherein the first criterion includes the trust status of each software program file of the plurality of software program files; and

logging the information related to the network access attempt in a memory element if the first criterion indicates one or more of the trust statuses are defined as untrusted.

38. The method of claim 37, further comprising searching a whitelist identifying trustworthy software program files to determine whether the plurality of software program files are each identified in the whitelist, wherein a trust status of a particular software program file of the plurality of software program files is defined as untrusted if the particular software program file is not identified in the whitelist.

39. The method of claim 37, wherein the logged information includes data identifying one of the plurality of software program files.

40. The method of claim 39, wherein the logged information includes data identifying the computing device.

41. The method of claim 39, wherein the process was initiated by the executable file on the computing device.

42. The method of claim 39, wherein the logged information includes data identifying one or more other software program files associated with the network access attempt.

43. Logic encoded in one or more non-transitory tangible media that includes code for execution and when executed by one or more processors is operable to perform operations comprising:

intercepting, on a computing device, one or more packets of an outbound network access attempt initiated by a process executing on the computing device, wherein the packets include a requested destination address in a network;

determining the process mapped to the packets;

querying a process traffic mapping element of the computing device to determine each software program file of a plurality of software program files mapped to the process in the process traffic mapping element, wherein at least one software program file of the plurality of software program files is an executable file and at least one other software program file of the plurality of software program files is a library module loaded by the process;

determining a trust status of each software program file of the plurality of software program files;

determining whether the network access attempt is permitted based on at least a first criterion, wherein the first criterion includes the trust status of each software program file of the plurality of software program files; and

logging the information related to the network access attempt in a memory element if the first criterion indicates one or more of the trust statuses are defined as untrusted.

44. The logic of claim 43, the one or more processors operable to perform further operations comprising searching a whitelist identifying trustworthy software program files to determine whether the plurality of software program files are each identified in the whitelist, wherein a trust status of a particular software program file of the plurality of software program files is defined as untrusted if the particular software program file is not identified in the whitelist.

45. The logic of claim 43, wherein the logged information includes data identifying one of the plurality of software program files.

46. The logic of claim 45, wherein the process was initiated by the executable file on the computing device.

47. The logic of claim 45, wherein the logged information includes data identifying one or more other software program files associated with the network access attempt.

48. An apparatus, comprising:

a protection module;

one or more processors operable to execute instructions associated with the protection module, to cause the one or more processors to;

intercept, on a computing device, one or more packets of an outbound network access attempt initiated by a process executing on the computing device, wherein the packets include a requested destination address in a network;

determine the process mapped to the packets;

query a process traffic mapping element of the computing device to determine each software program file of a plurality of software program files mapped to the process in the process traffic mapping element, wherein at least one software program file of the plurality of software program files is an executable file and at least one other software program file of the plurality of software program files is a library module loaded by the process;

determine a trust status of each software program file of the plurality of software program files;

determine whether the network access attempt is permitted based on at least a first criterion, wherein the first criterion includes the trust status of each software program file of the plurality of software program files; and

provide the information related to the network access attempt to be logged in a memory element if the first criterion indicates one or more of the trust statuses are defined as untrusted.

49. The apparatus of claim 48, the one or more processors operable to execute further instructions including searching a whitelist identifying trustworthy software program files to determine whether the plurality of software program files are each identified in the whitelist, wherein a trust status of a particular software program file of the plurality of software program files is defined as untrusted if the particular software program file is not identified in the whitelist.

50. The apparatus of claim 48 wherein the information to be logged includes data identifying one of the plurality of software program files.

51. The apparatus of claim 50, wherein the process was initiated by the executable file on the computing device.

52. The apparatus of claim 50, wherein the information to be logged includes data identifying one or more other software program files associated with the network access attempt.