US 7,743,418 B2 · Identifying malware that employs stealth techniques

Abstract

A method, software system, and computer-readable medium are provided for determining whether a malware that implements stealth techniques is resident on a computer. In one exemplary embodiment, a method is provided that obtains a first set of data that describes the processes that are reported as being active on the computer in a non-interrupt environment. Then, the method causes program execution to be interrupted at runtime so that an analysis of the active processes on the computer may be performed. After program execution is interrupted, a second set data that describes the processes that are reported as being active on the computer in a interrupt environment is obtained. By performing a comparison between the first and second sets of data, a determination may be made regarding whether the collected data contains inconsistencies that are characteristic of malware.

Claims20

Dependent claims

In a computer that includes a central processing unit for executing program code and a system for interrupting program execution, a method of determining whether a malware that performs stealth techniques to prevent detection of a malware process is resident on the computer, the method comprising:

(a) obtaining a first set of data that describes the processes that are reported as being active on the computer in a non-interrupt environment;
(b) interrupting program execution at runtime;
(c) obtaining a second set of data that describes the processes that are reported as being active on the computer in an interrupt environment;
and
(d) determining whether the first and second sets of data contain inconsistencies that are characteristic of malware.

2 more elements

A system comprising a processor and memory that implement a software system for determining whether a malware that performs stealth techniques to prevent detection of a malware process is resident on a computer, the software system comprising:

(a) a scanner module operative to obtain a first set of data that describes the processes that are reported as being active on the computer in a non-interrupt environment;
(b) an interrupt system that randomly interrupts program execution at runtime and causes the flow of program execution to be directed to the interrupt service routine;
and
(c) an interrupt service routine that:
(i) obtains a second set of data that describes the processes reported as being active on the computer in a interrupt environment;
and
(ii) determines whether the first set of data obtained by the scanner module and the second set of data have inconsistencies that are characteristic of malware.

4 more elements

A computer readable medium storing computer-readable instructions which, when executed in a computer that includes a central processing unit for executing program code and a system for interrupting program execution, performs a method of determining whether a malware that performs stealth techniques to prevent detection of a malware process is resident on the computer, the method comprising:

(a) obtaining a first set of data that describes the processes that are reported as being active on the computer in a non-interrupt environment;
(b) interrupting program execution at runtime;
(c) obtaining a second set of data that describes the processes that are reported as being active on the computer in an interrupt environment;
and
(d) determining whether the first and second set of data contain inconsistencies that are characteristic of malware.

2 more elements

Dependencies are inferred from the claim text.

Identifying malware that employs stealth techniques

Life of this patent

Identifying malware that employs stealth techniques

Life of this patent

Abstract

Claims20