Detecting delayed activation malware using a primary controller and plural time controllers

A computer-implemented method to detect delayed activation malware comprising:

• providing a first time controller operating as part of a user mode layer and a second time controller different and separate from the first time controller and operating as part of a kernel mode layer, each of the first time controller and the second time controller including a monitoring agent and time-dilation action logic in communication with the monitoring agent;
• processing a specimen, which potentially includes the delayed activation malware, by a run-time environment including (i) an application, (ii) an operating system in communication with the application, and (iii) a plurality of monitors including the monitoring agents of the first time controller and the second time controller, wherein the application and the operating system comprising components of the run-time environment and each of the monitoring agents being configured so as to be operable in association with a different one of the components of the run-time environment;
• hooking, by at least one of the monitoring agents, a time-related check by the run-time environment at the associated component;
• responding to the time-related check by each time-dilation action logic of the first time controller and the second time controller with a false time to indicate a greater length of time has transpired than has actually transpired;
• and
• wherein the application, stored within a non-transitory storage medium and during execution, is configured to process the specimen based at least in part on the false time, and the monitoring agents of the run-time environment are configured to monitor activity of the application during execution to detect, when the delayed activation malware is included in the specimen, anomalous activity associated with the malware.

A non-transitory storage medium forming a software stack including software that, upon execution by a processor, performs operations to detect delayed activation malware, the non-transitory storage medium comprising:

• a first layer of the software stack corresponding to a user mode layer of a run-time environment, the first layer comprises an application instance configured to process one or more specimens which potentially include delayed activation malware, the first layer further comprises at least in part, a first time controller including at least a first monitoring agent;
• and
• a second layer of the software stack corresponding to either a kernel mode layer or a hypervisor layer of the run-time environment, the second layer comprises, at least in part, a second time controller including at least a second monitoring agent,
• wherein a time-dilation action logic being configured to respond to a time-related check with a false time to indicate that a greater length of time has transpired than has actually transpired, the time-related check being hooked by either the first monitoring agent being operable with a first software application instance or the second monitoring agent being operable with either an operating system when the second layer corresponds to the kernel mode layer or a hypervisor when the second layer corresponds to the hypervisor layer, and
• wherein the application, during execution, is configured to process the one or more specimens based at least in part on the false time, and at least the first monitoring agent of the run-time environment is configured to monitor activity of the application during execution to detect, when the delayed activation malware is included in the one or more specimens, anomalous activity associated with the delay activated malware.