US 8,713,680 B2 · Method and apparatus for modeling computer program behaviour for behavioural detection of malicious program

Abstract

A method and apparatus for modeling a behavior of a computer program that is executed in a computer system is described. The method and apparatus for modeling a behavior of a computer program may be used to detect a malicious program based on the behavior of the computer program. A method includes collecting system use information about resources of the computer system the computer program uses; extracting a behavior signature of the computer program from the collected system use information; and encoding the extracted behavior signature to generate a behavior vector. As a result, behaviors of a particular computer program may be modeled to enable a malicious program detection program and to determine whether the computer program is either normal or malicious.

Drawings

Drawings are temporarily unavailable. Open the PDF at USPTO

Drawings

Claims23

Dependent claims

A method of modeling a behavior of a computer program that is executed in a computer system with a hardware processor configured to model the behavior of the computer program, the method comprising:

the processor collecting system use information about resources of the computer system that the computer program is configured to use, wherein the collecting of the system use information includes collecting a plurality of system use information at different times;
extracting the behavior signature includes generating a plurality of operational functions about the computer program based on a correlation between the plurality of collected system use information;
the processor extracting a first and second behavior signature of the computer program from the collected system use information;
and
the processor encoding the extracted first and second behavior signature to generate a first and second behavior vector wherein encoding includes encoding a similarity between the first behavior signature and the second behavior signature that is inversely proportional to a distance between the first behavior vector corresponding to the first behavior signature and the second behavior vector corresponding to the second behavior signature wherein the first behavior signature of the computer program is data used to train a malicious program detection program to discriminate a malicious program from a normal program;
wherein encoding the extracted behavior signature to generate the behavior vector includes encoding a plurality of elements that respectively corresponds to combinations of two random operational functions among the plurality of operational functions, and storing a temporal precedence relation between the two operational functions in each of the elements.

3 more elements

An apparatus configured to model a behavior of a computer program that is executed in a computer system with a hardware processor, the apparatus comprising:

a memory device;
a collector configured to collect system use information about resources of the computer system the computer program uses, wherein the collecting of the system use information includes collecting a plurality of system use information at different times;
extracting the behavior signature includes generating a plurality of operational functions about the computer program based on a correlation between the plurality of collected system use information;
an extractor configured to extract a first and second behavior signature of the computer program from the collected system use information;
and
an encoder configured, using at least one processor, to encode the extracted first and second behavior signature to generate a first and second behavior vector wherein encoding includes encoding a similarity between the first behavior signature and the second behavior signature that is inversely proportional to a distance between the first behavior vector corresponding to the first behavior signature and the second behavior vector corresponding to the second behavior signature wherein the first behavior signature of the computer program is data used to train a malicious program detection program to discriminate a malicious program from a normal program;
wherein the behavior vector includes a plurality of elements that respectively corresponds to combinations of two random operational functions among the plurality of operational functions, and each of the elements stores a temporal precedence relation between the two operational functions.

4 more elements

Dependencies are inferred from the claim text.

Description8,689 words

Summary733 words

#The following description generally relates to a method and apparatus for modeling a behavior of a computer program that is executed in a computer system, and more particularly, to a method and apparatus for modeling a behavior of a computer program that can detect a malicious program based on the behavior of the computer program.

#One conventional malicious program detection technology collects samples of a malicious program available to date, extracts a certain character string that is the signature of the malicious program, and determines whether a particular computer is infected with the malicious program from the existence of the extracted character string in files of the computer and the like.

#Therefore, when a new malicious program is discovered, a detection program must be developed to identify the entity of the new malicious program, extract a predetermined character string that is the signature of the new malicious program, and detect the malicious program. The existing detection program may not detect the new malicious program before information about the malicious program is added; therefore, damages from the new malicious program may not be prevented. Also, the types of character strings that are the signatures of malicious programs increase in proportion to the increase in the types of malicious programs. Therefore, it takes more time for a malicious program detection program to detect the existence of the character string.

Brief description of the drawings8 figures

#FIG. 1 is a flowchart illustrating an exemplary method of detecting a malicious program using a behavior vector of a computer program.

#FIG. 2 is a flowchart illustrating an exemplary method of modeling a behavior of a computer program.

#FIG. 3 illustrates an example of a file system structure of a Symbian OS that is targeted by a Commwarrior worm virus.

Detailed description7,801 words

#Throughout the drawings and the detailed description, like reference numerals refer to the like elements.

#In the following description, the term “computer system” includes a personal computer (PC), a mobile phone, various types of digital electronic devices, and the like. For example, a computer system may be any device that includes a processor and memory, executes programs, and performs actions.

#FIG. 1 is a flowchart illustrating one example of a method of detecting a malicious program using a behavior vector of a computer program. Hereinafter, a malicious program detection method using a modeled computer program is described in detail with reference to FIG. 1.

Facts

Application

12/106,144Filed 18 Apr 2008 · us provisional application

Priority

KR 10 2007 00911177 Sep 2007

Published

US 2009/0019546 A115 Jan 2009

Granted

29 Apr 2014

Term ends

22 Feb 2030

Estimated · how

20 years from earliest known nonprovisional domestic filing plus recorded patent term adjustment, including 675 days of adjustment. Maintenance-fee lapses, terminal disclaimers and statutory extensions have not been checked. The continuity chain may be incomplete; this is not an enforceability determination.

Classification4 codes

G06F 21/55
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: detecting local…
G06F 21/552
Detecting local intrusion or implementing counter-measures: involving long-term monitoring or reporting
G06F 21/57
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: certifying or…
G06F
Computing and data processing

Timeline

10 Jul 2007Priority claimedKR 10 2007 0091117
18 Apr 2008Application filedUS 12/106,144
28 Apr 2008Assigned to Samsung Electronics Co., Ltd, The Regents of the University of Michiganassignment of assignor's interest
15 Jan 2009PublishedUS 2009/0019546 A1
29 Apr 2014GrantedUS 8,713,680 B2
12 Oct 2026TodayWithin its term
22 Feb 2030Term endsEstimated, includes 675 days of adjustment

Method and apparatus for modeling computer program behaviour for behavioural detection of malicious program

Life of this patent

Method and apparatus for modeling computer program behaviour for behavioural detection of malicious program

Life of this patent

Life of this patent

Abstract

Drawings

Drawings

Claims23

Description8,689 words

Drawings

Classification4 codes

Life of this patent

Description8,689 words