US 8,321,941 B2Granted

Malware modeling detection system and method for mobile platforms

AssigneeJuniper Networks, Inc.

InventorsGeorge Tuvell, Deepak Venugopal, Guoning Hu

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system and method for detecting malware by modeling the behavior of malware and comparing a suspect executable with the model. The system and method extracts feature elements from malware-infected applications, groups the feature elements into feature sets, and develops rules describing a malicious probability relationship between the feature elements. Using malware-free and malware-infected applications as training data, the system and method heuristically trains the rules and creates a probability model for identifying malware. To detect malware, the system and method scans the suspect executable for feature sets and applies the results to the probability model to determine the probability that the suspect executable is malware-infected.

Claims44

Dependent claims

A method comprising:

developing a probability model for a plurality of malware, wherein developing comprises:
extracting a feature set from a plurality of predetermined malware-infected applications, the feature set comprising one or more feature elements corresponding to instructions within the predetermined malware-infected applications that import DLLs, and wherein each of the plurality of predetermined malware-infected applications can be executed by mobile devices;
heuristically training one or more rules using a plurality of predetermined malware-free applications and the predetermined malware-infected applications, wherein the rules describe a malicious probability relationship of the feature elements in the feature set and unknown applications that can be executed by the mobile devices;
creating the probability model from the rules and the feature set;
creating a first set of search values comprising a first set of hash values hashed from prefixes of a set of malware signatures derived from the plurality of predetermined malware-infected applications, each of the prefixes having a first-portion-size, wherein at least one of the malware signatures has a length greater than the first-portion-size;
creating a second set of search values comprising a second set of hash values hashed from the set of malware signatures;
and
distributing the probability model, the first set of search values, and the second set of search values to a mobile device to cause the mobile device to determine a probability that an application is malware-infected using at least one of the probability model, the first set of search values, and the second set of search values when the mobile device detects a match with one of the first set of search values.

5 more elements

A method comprising:

determining whether a target application includes a malware signature, comprising:
selecting a first set of hash values hashed from prefixes of a set of malware signatures, each of the prefixes having a first-portion-size, wherein at least one of the malware signatures has a length greater than the first-portion-size;
hashing a plurality of strings of a target application to create a plurality of second hash values, each of the strings having the first-portion-size;
comparing, by a mobile device, the plurality of second hash values to the first hash values to determine if there is a match;
when there is a match between at least one of the plurality of second hash values and at least one of the first hash values:
selecting a first rigorous hash value hashed from one of the malware signatures having a second-portion-size;
selecting a second rigorous hash value from a string of the target application starting at a same location in the target application at which the match occurred, wherein the string of the target application has a length of the second-portion-size;
and
comparing the first rigorous hash value and the second rigorous hash value to determine if there is a rigorous hash match;
and
determining that the target application includes a malware signature when there is a match between the first rigorous hash value and the second rigorous hash value;
and
determining whether the target application includes a feature set indicative of malware, comprising:
selecting a probability model from a set of probability models, each of the probability models comprising one or more rules and one or more feature sets, the feature sets each comprising a set of feature elements corresponding to instructions within predetermined malware-infected applications that import DLLs, and each of the rules describing a malicious probability relationships of the feature elements in one of the feature sets and unknown applications that can be executed by mobile devices;
scanning a target application to determine a presence of one or more feature elements of a feature set to determine a set of present feature elements corresponding to instructions within the target application that import DLLs;
and
applying the present feature elements to the probability model to calculate a probability of malware in the target application;
determining that the target application includes malware in response to determining that the target application includes the malware signature or that the probability of malware in the target application exceeds a threshold reporting probability;
and
in response to determining that the target application includes malware, preventing execution of the target application.

17 more elements

A system comprising:

one or more hardware-based processors configured to develop a probability model for a plurality of malware, wherein the one or more processors are configured to extract a feature set from a plurality of predetermined malware-infected applications, the feature set comprising one or more feature elements corresponding to instructions within the predetermined malware-infected applications that import DLLs, and wherein each of the plurality of predetermined malware-infected applications can be executed by mobile devices, train one or more rules using a plurality of predetermined malware-free and the predetermined malware-infected applications, wherein the rules describe a malicious probability relationship of the feature elements in the feature set and unknown applications that can be executed by the mobile devices, and create the probability model from the rules and the feature set;
and to create a set of search values, the set of search values comprising a first set of hash values hashed from prefixes of a set of malware signatures derived from the plurality of predetermined malware-infected applications, each of the prefixed having a first-portion size, wherein at least one of the malware signatures has a length greater than the first-portion size, and distribute the probability model and the set of search strings to a mobile device to cause the mobile device to determine a probability that an application is malware-infected using the probability model and the set of search strings.

A system comprising:

one or more probability models, each of the probability models comprising one or more rules and one or more feature sets, the feature sets each comprising a set of feature elements corresponding to instructions within predetermined malware-infected applications that import DLLs, and each of the rules describing a malicious probability relationships of the feature elements in one of the feature sets and unknown applications that can be executed by mobile devices;
and
a first set of hash values hashed from prefixes of a set of malware signatures, each of the prefixes having a first-portion-size, wherein at least one of the malware signatures has a length greater than the first-portion-size;
one or more hardware-based processors configured to select a probability model from the one or more probability models, scan a target application to determine a presence of one or more feature elements of a feature set associated with the probability model to determine a set of present feature elements corresponding to instructions within the target application that import DLLs, apply the present feature elements to the probability model to calculate a probability of malware in the target application, hash a plurality of strings of the target application to create a plurality of second hash values, each of the strings having the first-portion-size, compare the plurality of second hash values to the first hash values to determine if there is a match, when there is a match between at least one of the plurality of second hash values and at least one of the first hash values, select a first rigorous hash value hashed from one of the malware signatures having a second-portion size, select a second rigorous hash value from a string of the target application starting at a same location in the target application at which the match occurred, wherein the string of the target application has a length of the second-portion-size, compare the first rigorous hash value and the second rigorous hash value to determine if there is a rigorous hash match, determine that the target application includes a malware signature when there is a match between the first rigorous hash value and the second rigorous hash value, determine that the target application includes malware in response to determining that the target application includes the malware signature or that the probability of malware in the target application exceeds a threshold reporting probability, and in response determining that the target application includes malware, prevent execution of the target application.

1 more element

A non-transitory computer-readable storage medium comprising instructions that, when executed, cause one or more processors of a mobile computing device to:

determine whether a target application contains malware, comprising instructions that cause the processor to:
determine whether the target application includes a malware signature, comprising instructions that cause the processor to:
select a first set of hash values hashed from prefixes of a set of malware signatures, each of the prefixes having a first-portion-size, wherein at least one of the malware signatures has a length greater than the first-portion-size;
hash a plurality of strings of the target application to create a plurality of second hash values, each of the strings having the first-portion-size;
compare, by a mobile device, the plurality of second hash values to the first hash values to determine if there is a match;
when there is a match between at least one of the plurality of second hash values and at least one of the first hash values:
select a first rigorous hash value hashed from one of the malware signatures having a second-portion-size;
select a second rigorous hash value from a string of the target application starting at a same location in the target application at which the match occurred, wherein the string of the target application has a length of the second-portion-size;
and
compare the first rigorous hash value and the second rigorous hash value to determine if there is a rigorous hash match;
and
determine that the target application includes a malware signature when there is a match between the first rigorous hash value and the second rigorous hash value;
and
determine whether the application includes a feature set indicative of malware, comprising instructions that cause the processor to:
select a probability model from a set of probability models, each of the probability models comprising one or more rules and one or more feature sets, the feature sets each comprising a set of feature elements corresponding to instructions within predetermined malware-infected applications that import DLLs, and each of the rules describing a malicious probability relationships of the feature elements in one of the feature sets and unknown applications that can be executed by mobile devices;
scan the target application to determine a presence of one or more feature elements of a feature set to determine a set of present feature elements corresponding to instructions within the target application that import DLLs;
and
apply the present feature elements to the probability model to calculate a probability of malware in the target application;
determine that the target application includes malware in response to determining that the target application includes the malware signature or that the probability of malware in the target application exceeds a threshold reporting probability and;
in response to determining that the target application includes malware, prevent execution of the target application.

17 more elements

Dependencies are inferred from the claim text.

Facts

Application: 11/697,642Filed 6 Apr 2007 · us provisional application
Priority: 6 Apr 2006
Published: US 2007/0240217 A111 Oct 2007
Granted: 27 Nov 2012
Term ends: Not estimatedThe source records don’t support an estimate.

Classification16 codes

G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…
G06F 16/245
Querying: query processing
G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements
G06F 21/562
Computer malware detection or handling, e.g. anti-virus arrangements: static detection

Family

Application60/789,766Us provisional application · filed 6 Apr 2006
Application60/789,958Us provisional application · filed 6 Apr 2006
Application60/789,743Us provisional application · filed 6 Apr 2006
Application60/789,745Us provisional application · filed 6 Apr 2006
Application60/789,744Us provisional application · filed 6 Apr 2006
Application60/789,746Us provisional application · filed 6 Apr 2006
Application60/789,749Us provisional application · filed 6 Apr 2006
Application60/789,748Us provisional application · filed 6 Apr 2006
Application60/824,649Us provisional application · filed 6 Sep 2006
Application60/828,491Us provisional application · filed 6 Oct 2006
US 2007/0240217 A1Pre-grant publication · published 11 Oct 2007
US 8,321,941 B2This patent

From the US filing history. Foreign family members aren’t listed.