US 9,178,900 B1Granted

Detection of advanced persistent threat having evasion technology

AssigneeTrend Micro Incorporated

InventorsYuefeng Li, Qiang Huang, Ben Huang

Life of this patent

Estimating the term…

Loading patent…

Abstract

A computer executes a suspicious software sample directly on its CPU in order to detect if the software sample is malicious. The software sample does not execute within a sandbox or virtual machine. Before the sample executes, a memory state of the computer is saved and a virtual disk file is created to bootstrap the computer at a later time. Malicious behavior of the software sample is collected while it executes and a report is generated. Hard disk access requests are redirected to a virtual disk file. The software sample does not detect that it is being analyzed. After execution of the sample, the computer is reverts to a clean state by bootstrapping the computer from the saved virtual disk file and then restoring the computer's volatile and non-volatile virtual memory from the saved memory state. A new software sample may then be executed and analyzed on the clean computer.

Claims5

Dependent claims

A method of detecting malicious software, said method comprising:

receiving a suspicious file in a host computer, said suspicious file suspected of being malware;
before receiving said suspicious file, saving volatile memory of said host computer in a first file of mass storage of said host computer;
before receiving said suspicious file, saving bootstrapping components of said host computer into a second file of said mass storage, said bootstrapping components including information necessary to bootstrap and run said host computer, said second file of said mass storage being inaccessible to said suspicious file;
executing said suspicious file directly on a CPU of said host computer, said suspicious file not being executed within a virtual machine;
detecting malicious behavior of said executing suspicious file;
recording said malicious behavior during said execution of said suspicious file;
and
generating a report using said recorded malicious behavior, said report indicating that said suspicious file is a particular type of malware.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/085,546Filed 20 Nov 2013
Granted: 3 Nov 2015
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…
G06F 21/568
Computer malware detection or handling, e.g. anti-virus arrangements: eliminating virus, restoring damaged files
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/145
Countermeasures against malicious traffic: the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms