Systems and methods for identifying potential malware

18 Pages·2014·1.78 MB·English

US008671449B1
(12) Unlted States Patent (10) Patent No.: US 8,671,449 B1
Nachenberg (45) Date of Patent: Mar. 11, 2014
(54) SYSTEMS AND METHODS FOR 2005/0283831 A1 12/2005 Ryu et a1.
IDENTIFYING POTENTIAL MALWARE 2006/0253584 A1 11/2006 Dixon et a1.
2008/0005223 A1* 1/2008 Flake et a1. ................. .. 709/203
2008/0072049 A1* 3/2008 Cross et a1. ...... .. ..
(75) Inventor: Carey 5- Nachenberg, Manhattan 2009/0044024 A1* 2/2009 Oberheide et a1. .......... .. 713/188
Beach, CA (U S)
OTHER PUBLICATIONS
(73) Assignee: Symantec Corporation, Mountain View,
C A (Us) Sourabh Satish et 211.; Social Trust Based Security Model; Mar. 31,
2006; US. Appl. No. 11/394,846.
( * ) Notice: Subject to any disclaimer, the term of this Satish, S0l1fabh;U~S~APP1~ N0~ 13049751, ?led Mal 17, 2008
patent is extended or adjusted under 35 Satish, Sourabh; U.S. Appl. No. 12/056,379, ?led Mar. 27, 2008.
U_S_C_ 154(1)) by 592 days_ Nachenberg, Carey S.; US. Appl. No. 12/415,834, ?led Mar. 31,
2009.
(21) Appl. No.: 12/943,923 _ _
* c1ted by exammer
(22) Filed: Nov. 10, 2010
Primary Examiner * Saleh Najjar
(51) Int. Cl. Assistant Examiner * Feliciano Mejia
G06F 11/00 (200601) (74) Attorney, Agent, or Firm * ALG Intellectual Property,
G06F 12/14 (2006.01) LLC
G06F 13/00 (2006.01)
G06F 17/30 (2006.01) (57) ABSTRACT
GG0I8ICC 273//000 0 ((22000066.0011)) A computer-.l mplemented method for 1. dent1. fy1. ng potent1. al
(52) U 5 Cl malWare may include (1) identifying a ?le that is subject to a
Ulséc I 1726/24, 72601, 72602, 72603, reputation evaluation, (2) identifying at least one client sub
7’26/25. 7’13/187.’713/188’ mission received from at least one computing system that
(58) Field of Classi?cation Search ’ ’ identi?es (a) an instance of the ?le created on the computing
USPC .................................................... .. 726/22425 System and (b) at least one additional ?le Created on the
See application ?le for Complete Search history computing system at substantially the same time as the
instance of the ?le and Within the same ?le path as the
(56) References Cited instance of the ?le, (3) identifying a reputation associated
With the additional ?le(s), and then (4) generating a reputation
U.S. PATENT DOCUMENTS rating for the ?le based at least in part on the reputation
associated With the additional ?le(s). Various other methods,
7,269,851 B2 9/2007 Ackroyd
systems, and computer-readable media are also disclosed.
7,472,420 B1* 12/2008 Pavlyushchik ................ .. 726/24
7,748,038 B2* 6/2010 Olivier et a1. ................. .. 726/24
7,831,412 B1 11/2010 Sobel 20 Claims, 7 Drawing Sheets
200
Server
20.5
Fie Signature
Identi?cation MDdLliB
1.111
ClieRnte pSuubmmniossmiso)n (si
Generation Module
.1115 Reputsl2l4o1n1 Rillng
Network
29.4.
Computing System Computing System
gym) 2 2 n
' CiianlSubmissinn I Client Submission
I 22011) I 22 n
Security Module Security Module
1115 111B
US. Patent
Mar. 11, 2014 Sheet 1 of7 US 8,671,449 B1
System
@
Modules Databases
E E
Identification Module Submission Database
M Q
Generation Module Reputation Database
@ E
Security Module
E
FIG. 1
US. Patent
Mar. 11,2014 Sheet 2 0f 7 US 8,671,449 B1
200
Server
E
File Signature
Identification Module m
M
Client Submission(s)
E
Re putation(s)
E
Generation Module
10-6 ‘ Reputation Rating
' E
Network
M
V V
Computing System Computing System
202(11 202(n)
I Client Submission I Client Submission
I 220(11 I 220(n)
o 0 0
Security Module Security Module
M M
FIG. 2
US. Patent Mar. 11,2014 Sheet 3 of7 US 8,671,449 B1
300
Identify a file that is subject to a reputation evaluation
E
V
Identify at least one client submission received from at least one computing system, the
client submission identifying (1) an instance of the file created on the computing system
and (2) at least one additional file created on the computing system at substantially the
same time as, and within the same file path as, the instance of the file
304
Identify a reputation associated with the additional file
E
V
Generate a reputation rating for the file based at least in part on the reputation
associated with the additional file
M
End
FIG. 3
US. Patent Mar. 11, 2014 Sheet 4 017 US 8,671,449 B1
US. Patent Mar. 11,2014 Sheet 5 017 US 8,671,449 B1
500
Start
Identify a file that is subject to a reputation evaluation
Q
Request a reputation rating for the file from a reputation server
E
V
Receive a reputation rating for the file from the reputation server, the reputation rating
derived at least in part from a reputation associated with at least one additional file
created on at least one additional computing system, the additional file having been
created on the additional computing system at substantially the same time as an
instance of the file and within the same file path as the instance of the file
1011
Evaluating the trustworthiness ofthe file based at least in part on the reputation rating
assigned to the file
E
End
FIG. 5

US 8,671,449 B1
1 2
SYSTEMS AND METHODS FOR The systems described herein may generate the reputation
IDENTIFYING POTENTIAL MALWARE rating for the ?le using a variety of formulas. In some
examples, if the client submission identi?ed a plurality of
BACKGROUND additional ?les created within the same ?le path (and during
the same time period) as an instance of the ?le, the systems
In recent years, authors of malicious software (“malware”) described herein may generate the reputation rating for the
have attempted to proliferate malware by generating thou ?le based on an aggregation of the reputations associated with
sands or potentially millions of variations of a malicious the plurality of additional ?les. In one example, this aggrega
tion of reputations may be based in part on the number of
program or ?le. For example, a malware author may create a
trusted ?les within the plurality of additional ?les and/or the
unique variant of a malicious ?le for each intended target by
number of untrusted ?les within the plurality of additional
repacking, compressing, encrypting, and/or otherwise obfus
?les. Additionally or alternatively, this aggregation of repu
cating the ?le before distributing (or redistributing) the same.
tations may be based in part on the percentage of trusted
Unfortunately, because many existing antivirus technologies
and/or the percentage of untrusted ?les within the plurality of
detect malware by detecting or identifying unique digital
additional ?les. This aggregation of reputations may also be
signatures or ?ngerprints associated with known-malicious
based in part on the percentage of trusted and/or the percent
?les, malware authors may avoid detection by such technolo
age of untrusted ?les within each client submission.
gies by only distributing new (i.e., unique) variants of their
In some examples, the ?le path may refer to the same
malicious ?les. directory, folder, or other hierarchical unit of a ?le system.
In an attempt to combat this problem, at least one security 20 Additionally or alternatively, this ?le path may include a
software vendor has attempted to implement a reputation truncated ?le path (thereby identifying ?les as within the
based security system. In a reputation-based security system, same ?le path if, e.g., they share the same truncated ?le path).
a security-software vendor may attempt to determine the In one example, the systems described herein may provide
trustworthiness of a ?le by collecting, aggregating, and ana the reputation rating assigned to the ?le in question to at least
lyZing data from potentially millions of user devices within a 25 one additional computing system, such as a client device, in
community, such as the security-software vendor’s user base. order to enable the client device to evaluate the trustworthi
For example, by determining a ?le’s origin, age, and preva ness of the ?le in question. In this example, a client device
lence within the community (such as whether the ?le is pre may evaluate the trustworthiness of a ?le by (1) identifying a
dominantly found on at-ri sk or “unhealthy” machines within ?le that is subject to a reputation evaluation, (2) requesting a
the vendor’s user base), among other details, a security-soft 30 reputation rating for the ?le from a reputation server, and (3)
ware vendor may gain a fairly accurate understanding as to receiving the reputation rating for the ?le from the reputation
the trustworthiness of the ?le. server, and then (4) evaluating the trustworthiness of the ?le
Current reputation-based security systems often face based at least in part on the reputation rating assigned to the
tradeoffs between the number of false negatives (i.e., how ?le.
many malicious ?les are missed) and the number of false 35 As detailed above, this reputation rating may be derived at
positives (i.e., how many benign ?les are misidenti?ed as least in part from a reputation associated with at least one
malicious). As such, the instant disclosure identi?es a need additional ?le created on at least one additional computing
for additional and improved systems and methods for identi system (1) at the same time as an instance of the ?le and (2)
fying potential malware using reputation information. within the same ?le path as the instance of the ?le. In some
40 examples, the systems described herein may also perform a
SUMMARY security action on the ?le based at least in part on the reputa
tion rating.
As will be described in greater detail below, the instant As will be described in greater detail below, by imputing
disclosure generally relates to systems and methods for iden the reputation information of one or more ?les created at
tifying potential malware by imputing the reputations of 45 substantially the same time and within the same ?le path as
known ?les to unknown ?les that were created within the instances of a ?le to evaluate, the systems and methods
same ?le paths (and during substantially the same time described herein may improve the quality of reputation
period) as instances of the known ?les. In one example, a assessments, thereby improving malware detection rates rela
server-side computing device may accomplish such a task by tive to false positives.
(1) identifying a ?le that is subject to a reputation evaluation, 50 Features from any of the above-mentioned embodiments
(2) identifying at least one client submission received from at may be used in combination with one another in accordance
least one computing system that identi?es at least one addi with the general principles described herein. These and other
tional ?le that was created at the same time as, and within the embodiments, features, and advantages will be more fully
same ?le path as, an instance of the ?le in question, (3) understood upon reading the following detailed description in
identifying the reputation of the additional ?le(s), and then (4) 55 conjunction with the accompanying drawings and claims.
generating a reputation rating for the ?le based at least in part
on the reputations of the additional ?le(s). BRIEF DESCRIPTION OF THE DRAWINGS
In some examples, each identi?ed client submission may
include identi?cation information that uniquely identi?es The accompanying drawings illustrate a number of exem
(by, e. g., ?le name, ?le hash, and/ or ?le path) ?les created on 60 plary embodiments and are a part of the speci?cation.
the computing system in question within a certain time period Together with the following description, these drawings dem
(e. g., the last 24 hours) and/ or since the computing system’s onstrate and explain various principles of the instant disclo
previous client submission. In one example, the systems sure.
described herein may identify a client submission upon FIG. 1 is a block diagram of an exemplary system for
receiving the same from a computing system. In other 65 identifying potential malware.
examples, the systems described herein may identify a client FIG. 2 is a block diagram of an exemplary system for
submission by querying a submission database for the same. identifying potential malware.
US 8,671,449 B1
3 4
FIG. 3 is a ?ow diagram of an exemplary method for cause the computing device to perform one or more tasks. For
identifying potential malware. example, and as will be described in greater detail below, one
FIG. 4 is a block diagram of an exemplary system for or more of modules 102 may represent software modules
identifying potential malware. stored and con?gured to run on one or more computing
FIG. 5 is a ?ow diagram of an exemplary method for devices, such as the devices illustrated in FIG. 2 (e.g., com
identifying potential malware. puting systems 202(1)-(n) and/or server 206), computing sys
FIG. 6 is a block diagram of an exemplary computing tem 610 in FIG. 6, and/or portions of exemplary network
system capable of implementing one or more of the embodi architecture 700 in FIG. 7. One or more of modules 102 in
ments described and/or illustrated herein. FIG. 1 may also represent all or portions of one or more
FIG. 7 is a block diagram of an exemplary computing special-purpose computers con?gured to perform one or
network capable of implementing one or more of the embodi more tasks.
ments described and/or illustrated herein. As illustrated in FIG. 1, exemplary system 100 may also
Throughout the drawings, identical reference characters include one or more databases 120, such as submission data
and descriptions indicate similar, but not necessarily identi base 122 and reputation database 124. In one example, and as
cal, elements. While the exemplary embodiments described will be explained in greater detail below, submission database
herein are susceptible to various modi?cations and alternative 122 may house client-submission data received from client
forms, speci?c embodiments have been shown by way of devices within a user community (such as an enterprise or
example in the drawings and will be described in detail user base). In addition, reputation database 124 may contain
herein. However, the exemplary embodiments described information that identi?es the reputation or prevalence of one
herein are not intended to be limited to the particular forms 20 or more ?les within the user community.
disclosed. Rather, the instant disclosure covers all modi?ca Databases 120 may represent portions of a single database
tions, equivalents, and alternatives falling within the scope of or computing device or a plurality of databases or computing
the appended claims. devices. For example, databases 120 may represent a portion
of server 206 in FIG. 2, computing system 610 in FIG. 6,
DETAILED DESCRIPTION OF EXEMPLARY 25 and/or portions of exemplary network architecture 700 in
EMBODIMENTS FIG. 7. Alternatively, databases 120 in FIG. 1 may represent
one or more physically separate devices (such as, e. g., a
The following will provide, with reference to FIGS. 1, 2, database maintained by a reputation service) capable of being
and 4, detailed descriptions of exemplary systems for identi accessed by a computing device, such as server 206 in FIG. 2,
fying potential malware. Detailed descriptions of corre 30 computing system 610 in FIG. 6, and/or portions of exem
sponding computer-implemented methods will also be pro plary network architecture 700 in FIG. 7.
vided in connection with FIGS. 3 and 5. In addition, detailed Exemplary system 100 in FIG. 1 may be deployed in a
descriptions of an exemplary computing system and network variety of ways. For example, all or a portion of exemplary
architecture capable of implementing one or more of the system 100 may represent portions of exemplary system 200
embodiments described herein will be provided in connection 35 in FIG. 2. As shown in FIG. 2, system 200 may include a
with FIGS. 6 and 7, respectively. plurality of computing systems 202(1)-(n) in communication
FIG. 1 is a block diagram of an exemplary system 100 for with a server 206 via a network 204.
identifying potential malware. As illustrated in this ?gure, In one embodiment, and as will be described in greater
exemplary system 100 may include one or more modules 102 detail below, one or more of modules 102 from FIG. 1 may
for performing one or more tasks. For example, and as will be 40 program server 206 and/or computing systems 202(1)-(n) to
explained in greater detail below, exemplary system 100 may perform various server-side and/or client-side services. For
include an identi?cation module 104 programmed to identify example, modules 102 may program server 206 to assign
a ?le that is subject to a reputation evaluation. Identi?cation reputation ratings to ?les by (1) identifying a ?le that is
module 104 may also be programmed to identify at least one subject to a reputation evaluation, (2) identifying at least one
client submission received from at least one computing sys 45 client submission (e. g., client submission(s) 220) received
tem within a user community (such as the user base of a from at least one computing system (e.g., one or more of
security-software publisher) that identi?es, for each comput computing systems 202(l)-202(n)) that identi?es (a) an
ing system in question, (a) an instance of the ?le created on instance of the ?le created on the computing system and (b) at
the computing system and (b) at least one additional ?le least one additional ?le created on the computing system at
created on the computing system at substantially the same 50 the same time as the instance of the ?le and within the same
time as the instance of the ?le and within the same ?le path as ?le path as the instance of the ?le, (3) identifying a reputation
the instance of the ?le. The identi?cation module may addi associated with each additional ?le (e.g., reputation(s) 230),
tionally be programmed to identify a reputation associated and then (4) generating a reputation rating (e.g., reputation
with each additional ?le. rating 240) for the ?le based at least in part on the reputation
In addition, and as will be described in greater detail below, 55 of each additional ?le.
exemplary system 100 may include a generation module 106 Similarly, in some examples one or more of modules 102
programmed to generate a reputation rating for the ?le based may program computing system 202(1) to evaluate the trust
at least in part on the reputation associated with each addi worthiness of a ?le by (1) identifying a ?le that is subject to a
tional ?le. Exemplary system 100 may also include a security reputation evaluation (by, e.g., detecting a ?le downloaded or
module 108 programmed to evaluate the trustworthiness of a 60 otherwise encountered by computing system 202(1)), (2)
?le based at least in part on a reputation rating assigned to the requesting a reputation rating for the ?le from a reputation
?le by generation module 106. Although illustrated as sepa server (e.g., server 206), (3) receiving a reputation rating for
rate elements, one or more of modules 102 in FIG. 1 may the ?le from the reputation server, and then (4) evaluating the
represent portions of a single module or application. trustworthiness of the ?le based at least in part on the repu
In certain embodiments, one or more of modules 102 in 65 tation rating assigned to the ?le. In this example, the reputa
FIG. 1 may represent one or more software applications or tion rating may be derived at least in part from the reputation
programs that, when executed by a computing device, may of at least one additional ?le created on at least one additional