US 9,483,644 B1 · Methods for detecting file altering malware in VM based analysis

Abstract

According to one embodiment, a threat detection platform is integrated with at least one virtual machine that automatically performs a dynamic analysis of a received object and monitors the processing during the dynamic analysis for a change to a file system within the virtual machine wherein the change involves a lure file placed in the file system. The file system is configured based on a received configuration file. Upon detection of a change in the file system associated with a lure file, the changes associated with the lure file during processing are compared to known file activity patterns of changes caused by file altering malware to determine whether the object includes file altering malware.

Claims29

Dependent claims

A system comprising:

one or more processors;
and
a storage module communicatively coupled to the one or more processors, the storage module comprising logic that, upon execution by the one or more processors, performs operations comprising:
receiving a configuration file and an object by a virtual machine, the virtual machine including a file system;
placing a lure file within the file system according to information of the configuration file;
selectively modifying a name of the lure file;
processing the object within the virtual machine;
and
determine whether the object exhibits file altering behavior based on a comparison of one or more actions performed while processing the object that are associated with the lure file and one more known file activity patterns.

6 more elements

Dependencies are inferred from the claim text.

Methods for detecting file altering malware in VM based analysis

Life of this patent

Methods for detecting file altering malware in VM based analysis

Life of this patent

Abstract

Claims29