System and method for automatic apx signatures generation
AssigneeAcronis International GmbH
InventorsVladimir Strogov, Aliaksei Dodz, Serg Bell, Stanislav Protasov
Life of this patent
Estimating the term…
Abstract
Systems and methods for automatically updating a code-signature library to allow for matching of malware based on generating alternative signatures based on disassembly of instructions found in compiled malware binary programs. Alternatively, systems and methods include platform-neutral, embedded, and distributed systems. Malware identified by way of the alternative signatures is then blocked or quarantined.
Claims20
A computer-implemented method for automatically extending an antimalware signature library to address variations, the method comprising:
- identifying an executable code pattern within at least one existing signature in
- the antimalware signature library compiled for a first CPU architecture by:
- partially disassembling the executable code patterns into opcode sequences, and
- verifying the likelihood that the opcode sequences represent valid executable code;
- generating alternative code signatures for a second CPU architecture by:
- disassembling the opcode sequences into corresponding assembly instructions,
- searching for alternative representations of the corresponding assembly instructions introduced by an instruction set of the second CPU architecture, and
- deriving alternative opcode sequences corresponding to the alternative representations of the assembly instructions;
- extending an antimalware signature library by:
- traversing the signatures in the antimalware signature library to identify a sub-pattern matching the alternative opcode sequences,
- appending one or more alternative opcode sequences as additional sub-patterns to corresponding existing signatures in the antimalware signature library;
- and
- blocking execution of a binary program in a computer system when the one or more alternative opcode sequences is detected in the binary program.
A method for protecting an endpoint in a computer system, the method comprising:
- monitoring the endpoint with a security scanner;
- detecting an unknown binary program associated with the endpoint;
- extracting a code signature of the unknown binary program;
- checking for a match between the extracted code signature and a code signature database comprising code signatures corresponding to binary programs compiled with instructions of a first CPU architecture;
- updating the code signature database if no match is found, wherein updating the code signature database comprising adding an alternative code signature corresponding to a binary program compiled with instructions of a second CPU architecture;
- checking for a match between the extracted code signature and the updated signature database;
- and
- blocking execution of the binary program at the endpoint if the extracted code signature matches the alternative code signature.
A system for protecting an endpoint in a computer system, the system comprising:
- a processor coupled to a memory and a nonvolatile storage;
- a first code signature database in the nonvolatile storage comprising code signatures corresponding to binary programs compiled with instructions of a first CPU architecture;
- a signature scanner for detecting unknown binary programs at the endpoint and extracting code signatures from the unknown binary programs;
- wherein the first code signature database is configured to receive updates and wherein the security scanner and first code signature database are under program control of the processor;
- wherein the first code signature database is further configured to receive updates comprising alternative code signatures corresponding to binary programs compiled with instructions of a second CPU architecture;
- and
- wherein the processor is configured to block execution of an unknown binary program when an extracted code signature of the unknown binary program matches an alternative code signature corresponding to binary programs compiled with instructions of a second CPU architecture.
Dependencies are inferred from the claim text.