File-modifying malware detection
AssigneeCrowdStrike, Inc.
InventorDaniel W. Brown
Life of this patent
Estimating the term…
Abstract
A security agent implemented on a computing device is described herein. The security agent is configured to detect file-modifying malware by detecting that a process is traversing a directory of the memory of the computing device and detecting that the process is accessing files in the memory according to specified file access patterns. The security agent can also be configured to correlate actions of multiple processes that correspond to a specified file access pattern and detect that one or more of the multiple processes are malware by correlating their behavior.
Claims20
A system including:
- a processor;
- a memory, the memory being cataloged by a directory and the memory having stored thereon computer-executable instructions that, when executed by the processor, configure the system to perform operations including:
- detecting that a process executed by the processor is conducting a traversal of the directory;
- detecting that the process is accessing one or more files according to a defined file access pattern;
- and
- committing a preventative action upon the process based at least in part on detecting that the process is conducting a traversal of the directory and accessing one or more files according to the defined file access pattern.
A computer-implemented method comprising:
- monitoring actions taken by processes executed by a computing device, the computing device including a memory organized by a file system comprising a directory;
- responsive to the monitoring, receiving first event information specifying that a first process is traversing the directory;
- responsive to the monitoring, receiving second event information specifying that the first process or a second process is accessing one or more files in a manner consistent with a file access pattern, the second process being called by the first process;
- determining, based at least in part on the first process traversing the directory and the first process or the second process accessing the one or more files in the manner, that the first process is a security exploit;
- and
- causing commitment of a preventative action towards the first process based at least on the determining.
A computing device including:
- a processor;
- a memory;
- a directory specifying a file system configuration for accessing the memory;
- a security agent configured to be executed on the computing device by the processor to at least detect execution of malware by the processor, the security agent comprising:
- an event generation module configured to:
- observe actions taken by processes executed by the processor;
- generate a first event if an action of a first process executed by the processor includes traversing the directory;
- generate a second event if an action of the first process or an action of a second process executed by the processor includes accessing a file according to at least one of a plurality of defined file access patterns, the second process being associated with the first process;
- and
- an event analysis module configured to:
- determine from the generation of at least the first event and the second event that at least the first process is malicious.
Dependencies are inferred from the claim text.