Back to results
US 8,555,392 B2Granted
System and method for detecting unknown packers and cryptors
AssigneeKaspersky Lab ZAO
InventorMaxim Y. Golovkin
Life of this patent
Estimating the term…
Abstract
Disclosed are systems, methods and computer program products for detecting unknown packers and cryptors. An example method comprises emulating execution of a software object modified by an unknown packer or cryptor; collecting information about memory operations performed during the emulation; combining information about a plurality of related memory operations into at least one sequential set of memory operations; identifying from the at least one sequential set of related memory operations one or more high-level operations associated with unpacking or decryption of the emulated object; and generating based on the one or more high-level operations a record of the unknown packer or cryptor to be used for detecting the unknown packer or cryptor.
Claims20
A computer-implemented method for detecting unknown packers and cryptors, the method comprising:
- emulating, by a computer processor, a software object modified by an unknown packer or cryptor;
- collecting information about memory operations performed during the emulation;
- combining information about related memory operations into one or more sets of related memory operations, wherein each set includes memory operations being related at least in their address spaces;
- comparing, by the computer processor, the one or more sets of related memory operations with high-level memory operations commonly associated with unpacking or decryption to identify at least one set of related memory operations that performs said high-level operations on the emulated object;
- generating, by the computer processor, based on at least one of the identified sets of related memory operations that perform unpacking or decryption of the emulated object, a new antivirus record that describes specific behavior of the unknown packer or cryptor that performs the unpacking or decryption of the emulated object,
- wherein the generated new antivirus record includes an ordered sequence of one or more expressions showing an order of the identified high-level operations with each expression identifying at least a high-level operation performed on the emulated object, and generic address space parameters of each high-level operation;
- and
- using the generated new antivirus record, by the computer processor, to detect another software object modified by said unknown packer or cryptor, including:
- obtaining information about high-level operations for said another software object;
- and
- comparing the ordered sequence of expressions contained in the new antivirus record with the obtained information about high-level operations irrespective of associated memory addresses of said high-level operations to determine whether said another software object is modified by said unknown packer or cryptor.
8 more elements
A computer-implemented system for detecting unknown packers and cryptors, the system comprising:
- a memory storing a software object;
- and
- a processor coupled to the memory and being configured to:
- emulate a software object modified by an unknown packer or cryptor;
- collect information about memory operations performed during the emulation;
- combine information about related memory operations into one or more sets of related memory operations, wherein each set includes memory operations being related at least in their address spaces;
- compare the one or more sets of related memory operations with high-level memory operations commonly associated with unpacking or decryption to identify at least one set of related memory operations that performs said high-level operations on the emulated object;
- generate based on at least one of the identified sets of related memory operations that perform unpacking or decryption of the emulated object, a new antivirus record that describes specific behavior of the unknown packer or cryptor that performs the unpacking or decryption of the emulated object,
- wherein the generated new antivirus record includes an ordered sequence of one or more expressions showing an order of the identified high-level operations with each expression identifying at least a high-level operation performed on the emulated object, and generic address space parameters of each high-level operation;
- and
- using the new generated antivirus record to detect another software object modified by said unknown packer or cryptor, including:
- obtain information about high-level operations for said another software object;
- and
- compare the ordered sequence of expressions contained in the new antivirus record with the obtained information about high-level operations irrespective of associated memory addresses of said high-level operations to determine whether said another software object is modified by said unknown packer or cryptor.
11 more elements
A computer program product embedded in a non-transitory computer-readable storage medium, the computer-readable storage medium comprising computer-executable instructions for detecting unknown packers and cryptors, the medium comprising instructions for:
- emulating a software object modified by an unknown packer or cryptor;
- collecting information about memory operations performed during the emulation;
- combining information about related memory operations into one or more sets of related memory operations, wherein each set includes memory operations being related at least in their address spaces;
- comparing the one or more sets of related memory operations with high-level memory operations commonly associated with unpacking or decryption to identify at least one set of related memory operations that performs said high-level operations on the emulated object;
- generating based on at least one of the identified sets of related memory operations that perform unpacking or decryption of the emulated object, a new antivirus record that describes specific behavior of the unknown packer or cryptor that performs the unpacking or decryption of the emulated object,
- wherein the generated new antivirus record includes an ordered sequence of one or more expressions showing an order of the identified high-level operations with each expression identifying at least a high-level operation performed on the emulated object, and generic address space parameters of each high-level operation;
- and
- using the new generated antivirus record to detect another software object modified by said unknown packer or cryptor, including:
- obtaining information about high-level operations for said another software object;
- and
- comparing the ordered sequence of expressions contained in the new antivirus record with the obtained information about high-level operations irrespective of associated memory addresses of said high-level operations to determine whether said another software object is modified by said unknown packer or cryptor.
8 more elements
Dependencies are inferred from the claim text.