Analysing operating system configurations
AssigneesPeridot Print LLC, Nanyang Technological University
InventorsAdrian John Baldwin, Jonathan Griffin, Jakub Pruzinec, Quynh Anh Nguyen
Life of this patent
Estimating the term…
Abstract
At least in some examples, a non-transitory machine-readable storage medium can be encoded with instructions for analysing an operating system configuration, the instructions executable by a processor of a system, whereby to cause the system to generate a set of malware samples, each malware sample defined by a set of actions forming an attack chain representing a sequence of procedures, execute each of the malware samples on an instance of the operating system configuration to generate a set of logs, and using the set of logs, determine a set of actions detected by an anti-malware process of the operating system configuration.
Claims19
A non-transitory machine-readable storage medium storing instructions executable by a processor of a system to cause the system to perform processing comprising:
- generating a plurality of malware samples based on a plurality of modules and a plurality of attack descriptors, wherein the modules respectively describe and implement a plurality of known attack techniques, and
- each attack descriptor, of the plurality of attack descriptors, defines a sequence of attack tactics, where each attack tactic in the sequence is one of the known attack techniques described and implemented by the modules;
- executing each malware sample, of the plurality of malware samples, on one or more instances of an operating system configuration to generate a plurality of logs;
- and
- using the plurality of logs, determining a plurality of actions detected by an anti-malware process of the operating system configuration.
An apparatus comprising:
- a processor;
- a storage device storing a plurality of modules and a plurality of attack descriptors, wherein
- the modules respectively describe and implement a plurality of known attack techniques, and
- each attack descriptor, of the plurality of attack descriptors, defines a sequence of attack tactics, where each attack tactic in the sequence is one of the known attack techniques described and implemented by the modules;
- a memory storing instructions executable by the processor to perform processing comprising:
- generating a plurality of malware samples based on the modules and the attack descriptors;
- executing each malware sample, of the plurality of malware samples, on one or more instances of an operating system configuration to generate a plurality of logs;
- and
- using the plurality of logs, detecting which of the malware samples have successfully executed on the instances of the operating system configuration.
A method comprising:
- generating, by a processor, a plurality of malware samples based on a plurality of modules and a plurality of attack descriptors, wherein
- the modules respectively describe and implement a plurality of known attack techniques, and
- each attack descriptor, of the plurality of attack descriptors, defines a sequence of attack tactics, where each attack tactic in the sequence is one of the known attack techniques described and implemented by the modules;
- executing, by the processor, each malware sample, of the plurality of malware samples, on one or more instances of an operating system configuration to generate a plurality of logs;
- and
- using the plurality of logs, detecting, by the processor, which of the malware samples have successfully executed on the instances of the operating system configuration.
Dependencies are inferred from the claim text.