US 9,489,516 B1Granted

Detection of malware using an instrumented virtual machine environment

AssigneePalo Alto Networks, Inc.

InventorsChienHua Lu, Bo Qu

Life of this patent

Estimating the term…

Loading patent…

Abstract

Various techniques for detection of malware using an instrumented virtual machine environment are disclosed. In some embodiments, detection of malware using an instrumented virtual machine environment includes instantiating a first virtual machine in the instrumented virtual machine environment, in which the first virtual machine is configured to support installation of two or more versions of a resource; installing a first version of the resource on the first virtual machine and monitoring the instrumented virtual machine environment while executing the first version of the resource with a malware sample opened using the first version of the resource; and installing a second version of the resource on the first virtual machine and monitoring the instrumented virtual machine environment while executing the second version of the resource with the malware sample opened using the second version of the resource.

Claims15

Dependent claims

A system for detection of malware using an instrumented virtual machine environment, comprising:

a processor configured to:
instantiate a first virtual machine in the instrumented virtual machine environment, wherein the first virtual machine is configured to support installation of two or more versions of a resource;
install a first version of the resource on the first virtual machine and monitor the instrumented virtual machine environment while executing the first version of the resource with a malware sample opened using the first version of the resource, comprising to:
store the first version of the resource using a first dummy file name for a registry file associated with the resource and a first executable file associated with the resource;
install a second version of the resource on the first virtual machine and monitor the instrumented virtual machine environment while executing the second version of the resource with the malware sample opened using the second version of the resource, comprising to:
store the second version of the resource using a second dummy file name for the registry file and a second executable file associated with the resource;
and
monitor the instrumented virtual machine environment while executing each version of the resource with the malware sample opened using each version of the resource for at least a predetermined period of time or until malicious behavior is detected, comprising to:
rename the first dummy file name to a first expected file name in order to execute the first version of the resource;
execute the first version of the resource based on the first expected file name and the first executable file;
rename the second dummy file name to a second expected file name in order to execute the second version of the resource;
and
execute the second version of the resource based on the second expected file name and the second executable file;
and
a memory coupled to the processor and configured to provide the processor with instructions.

12 more elements

A method for detection of malware using an instrumented virtual machine environment, comprising:

instantiating a first virtual machine in the instrumented virtual machine environment, wherein the first virtual machine is configured to support installation of two or more versions of a resource;
installing a first version of the resource on the first virtual machine and monitoring the instrumented virtual machine environment while executing the first version of the resource with a malware sample opened using the first version of the resource, comprising:
storing the first version of the resource using a first dummy file name for a registry file associated with the resource and a first executable file associated with the resource;
installing a second version of the resource on the first virtual machine and monitoring the instrumented virtual machine environment while executing the second version of the resource with the malware sample opened using the second version of the resource, comprising:
store the second version of the resource using a second dummy file name for the registry file and a second executable file associated with the resource;
and
monitoring the instrumented virtual machine environment while executing each version of the resource with the malware sample opened using each version of the resource for at least a predetermined period of time or until malicious behavior is detected, comprising:
renaming the first dummy file name to a first expected file name in order to execute the first version of the resource;
executing the first version of the resource based on the first expected file name and the first executable file;
renaming the second dummy file name to a second expected file name in order to execute the second version of the resource;
and
executing the second version of the resource based on the second expected file name and the second executable file.

9 more elements

A computer program product for detection of malware using an instrumented virtual machine environment, the computer program product being embodied in a non-transitory, tangible computer readable storage medium and comprising computer instructions for:

instantiating a first virtual machine in the instrumented virtual machine environment, wherein the first virtual machine is configured to support installation of two or more versions of a resource;
installing a first version of the resource on the first virtual machine and monitoring the instrumented virtual machine environment while executing the first version of the resource with a malware sample opened using the first version of the resource, comprising:
storing the first version of the resource using a first dummy file name for a registry file associated with the resource and a first executable file associated with the resource;
installing a second version of the resource on the first virtual machine and monitoring the instrumented virtual machine environment while executing the second version of the resource with the malware sample opened using the second version of the resource, comprising:
storing the second version of the resource using a second dummy file name for the registry file and a second executable file associated with the resource;
and
monitoring the instrumented virtual machine environment while executing each version of the resource with the malware sample opened using each version of the resource for at least a predetermined period of time or until malicious behavior is detected, comprising:
renaming the first dummy file name to a first expected file name in order to execute the first version of the resource;
executing the first version of the resource based on the first expected file name and the first executable file;
renaming the second dummy file name to a second expected file name in order to execute the second version of the resource;
and
executing the second version of the resource based on the second expected file name and the second executable file.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/331,113Filed 14 Jul 2014
Granted: 8 Nov 2016
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 21/53
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by executing in a restricted environment, e.g.…
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…
G06F 21/567
Computer malware detection or handling, e.g. anti-virus arrangements: using dedicated hardware