# US 9,521,156 B2 · Method and product for providing a predictive security product and evaluating existing security products

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,521,156 B2
- Document ID: US9521156B2
- Status: Granted
- Kind: B2
- Application number: 14/404,457
- Filed: 2014-02-10
- Published: 2015-05-28
- Granted: 2016-12-13
- Earliest claimed: 2013-02-10
- Assignees: Paypal, Inc.
- Applicants: Paypal, Inc.
- Inventors: Shlomi Boutnaru; Liran Tancman; Michael Markzon
- Web page: https://patentgrep.com/patent/US9521156B2

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 21/564: {by virus signature recognition}
- G06F 21/567: {using dedicated hardware}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- G06F 2221/033: Test or assess software
- G06F 2221/2145: Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method, product and computer program product for effecting an Evolutionary Process on malware, the method including the steps of: (a) receiving a malware specimen; (b) generating variants of the malware specimen; (c) evaluating the variants and awarding each the variant a Fitness Score; (d) selecting the variants having at least a predefined the Fitness Score; and (e) using the selected variants as the malware specimens in step (a) from which to generate a new generation of the variants.

## Claims

### Claim 1

A system, comprising:
a non-transitory memory; and
one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising:
generating malware variants of malware specimens; and
evaluating each of the malware variants based on a maliciousness level and an evasiveness level,
wherein the maliciousness level for a malware variant is determined based on malicious characteristics exhibited by the malware variant, and
wherein the evasiveness level for the malware variant is determined by submitting the malware variant to a plurality of malware detection systems to determine evasive characteristics exhibited by the malware variant;
generating detector mechanisms to detect the malicious characteristics and non-malicious characteristics of the malware variants; and
selecting at least one of the detector mechanisms having a rating above a predetermined level, the rating based on a number of the malicious characteristics correctly detected, a number of the non-malicious characteristics incorrectly detected, and a length of at least one of the malicious characteristics correctly detected.

### Claim 2 (depends on 1)

The system of claim 1, the operations further comprising:
collecting the malware specimens from at least one source selected from the group consisting of: repositories, production systems, and 3rd party products.

### Claim 3 (depends on 1)

The system of claim 1, the operations further comprising:
performing at least one action selected from the group consisting of: applying mutations to executable code of said malware specimens, applying mutations to malware emitted network traffic, applying mutations to source code, applying mutations to assembly language code, and cross-merging said malware variants.

### Claim 4 (depends on 3)

The system of claim 3, wherein said mutations applied to said executable code are selected from the group consisting of:
(i) random mutations,
(ii) replacing a given command sequence with another, functionally equivalent, sequence of commands,
(iii) replacing a selected library call with a different, functionally equivalent, library call,
(iv) replacing a selected library used with a different, functionally equivalent, library,
(v) increasing respective probabilities of said mutations in areas identified as having a malicious function;
(vi) increasing respective probabilities of said mutations in areas identified as unlikely to prevent proper execution of said executable code;
(vii) increasing probability of said mutations in areas signed by security products;
(viii) increasing probability of said mutations in areas where previous said mutations resulted in an increased fitness score;
(ix) rewriting headers of said executable code for a section where binary code has been added, resulting in expansion of said section;
(x) combining said executable code with other said executable code to produce combined code and rewriting relevant headers to allow for proper execution of said combined code; and
(xi) modifying certain sections of said executable code in order to change dynamic function calls to static invocation of relevant operating system calls.

### Claim 5 (depends on 3)

The system of claim 3, the operations further comprising:
applying said mutations to said malware emitted network traffic and sending said mutated malware emitted network traffic to a victim machine, wherein results of said mutated malware emitted network traffic on said victim machine are evaluated to determine said maliciousness level.

### Claim 6 (depends on 5)

The system of claim 5, wherein said mutations applied to said malware emitted network traffic include correcting CRC/Checksum fields, or any other fields of a network packet in various protocols in order to render said CRC/Checksum or other fields valid after various mutations in payloads or headers of said packet.

### Claim 7 (depends on 5)

The system of claim 5, wherein said malware emitted network traffic is obfuscated by wrapping a network communication containing said malware emitted network traffic, in a secure channel.

### Claim 8 (depends on 3)

The system of claim 3, where said executable code of said malware specimens is obfuscated using techniques selected from the group including: packing, encrypting and encoding.

### Claim 9 (depends on 1)

The system of claim 1, the operations further comprising:
awarding fitness scores to said malware variants and selecting at least a portion of said malware variants as new said malware specimens, based on said fitness scores.

### Claim 10 (depends on 1)

The system of claim 1, the operations further comprising:
awarding fitness scores to said malware variants and selecting at least a portion of said malware variants for generating the detection mechanisms, based on said fitness scores.

### Claim 11 (depends on 1)

The system of claim 1, the operations further comprising processing at least one of the following elements to create the detector mechanisms:
(a) an executable binary of the malware variants,
(b) network traffic emitted or received by the malware variants,
(c) system calls of the malware variants,
(d) API calls of the malware variants, or
(e) a memory footprint and content of the malware variants.

### Claim 12 (depends on 11)

The system of claim 11, wherein the detector mechanisms detect at least one of:
(a) network behavior signatures,
(b) network behavior patterns,
(c) executable signatures,
(d) executable patterns,
(e) system calls signatures,
(f) system calls patterns,
(g) CPU actions signatures,
(h) CPU actions patterns,
(i) API calls signatures, or
(j) API calls patterns.

### Claim 13 (depends on 12)

The system of claim 12, wherein said detector mechanisms are deployed as standalone detection modules on a platform selected from the group including: an end-point, a gateway, a network element, a network appliance, and an integrated 3rd party detecting platform.

### Claim 14 (depends on 10)

The system of claim 10, wherein said evasiveness level is further determined using the detector mechanisms.

### Claim 15 (depends on 1)

The system of claim 1, the operations further comprising:
evaluating said maliciousness level by running said malware variants on a virtual machine (VM).

### Claim 16

A method for effecting an Evolutionary Process on malware, the method comprising:
receiving a malware specimen;
generating variants of said malware specimen;
evaluating an evasiveness and a maliciousness of said variants and awarding each of said variants a fitness score,
wherein said evasiveness is measured for a variant by scanning the variant with a selected group of security products and awarding an evasiveness score based on an inability of the security products to detect the variant, and
wherein said maliciousness is measured for the variant by determining whether the variant causes malicious activity and awarding a maliciousness score based on said determining;
selecting said variants having at least a predefined said fitness score;
using said selected variants to generate a new generation of said variants;
the method further comprising:
selecting, from among a plurality of detectors capable of detecting malicious characteristics and non-malicious characteristics of the variants, at least one detector having a rating above a predetermined level, the rating based on a number of said malicious characteristics correctly detected, a number of said non-malicious characteristics incorrectly detected, and a length of at least one of the malicious characteristics correctly detected.

### Claim 17 (depends on 16)

The method of claim 16, wherein said generating said variants includes performing at least one action selected from the group consisting of: applying mutations to executable code of said malware specimen, applying mutations to malware emitted network traffic, and cross-merging said variants.

### Claim 18 (depends on 17)

The method of claim 17, wherein said applying of said mutations to said executable code includes at least one of:
(i) random mutations,
(ii) replacing a given command sequence with another, functionally equivalent, sequence of commands,
(iii) replacing a selected library call with a different, functionally equivalent, library call,
(iv) replacing a selected library used with a different, functionally equivalent, library,
(v) increasing respective probabilities of said mutations in areas identified as having a malicious function;
(vi) increasing respective probabilities of said mutations in areas identified as unlikely to prevent proper execution of said executable code;
(vii) increasing probability of said mutations in areas signed by security products;
(viii) increasing probability of said mutations in areas where previous said mutations resulted in an increased said fitness score;
(ix) rewriting headers of said executable code for a section where binary code has been added, resulting in expansion of said section;
(x) combining said executable code with other said executable code to produce combined code and rewriting relevant headers to allow for proper execution of said combined code; or
(xi) modifying certain sections of said executable code in order to change dynamic function calls to static invocation of relevant operating system calls.

### Claim 19 (depends on 17)

The method of claim 17, wherein said applying mutations to malware emitted network traffic comprises:
(i) sending said malware emitted network traffic from an attack machine to a router;
(ii) mutating elements of said malware emitted network traffic; and
(iii) sending said mutated malware emitted network traffic to a victim machine.

### Claim 20 (depends on 19)

The method of claim 19, further comprising evaluating said mutated malware emitted network traffic, the evaluating including:
(iv) registering a result of said mutated malware emitted network traffic on said victim machine; and
(v) evaluating said result in order to determine said fitness score.

### Claim 21 (depends on 16)

The method of claim 16, wherein each said variant is executed on at least one of: a virtual machine and a physical machine.

### Claim 22 (depends on 16)

The method of claim 16, wherein said fitness score is calculated based on, at least, said evasiveness score and said maliciousness score.

### Claim 23 (depends on 22)

The method of claim 22, wherein said fitness score is further calculated based on a degree of divergence of said variant from said malware specimen.

### Claim 24 (depends on 21)

The method of claim 21, further: executing said variant on both said virtual machine (VM) and said physical machine; and comparing results of executing said variant on said VM and executing said variant on said physical machine in order to detect a discrepancy between said results.

### Claim 25 (depends on 24)

The method of claim 24, wherein if said discrepancy is found, said variant is evaluated only on said results of executing said variant on said physical machine.

### Claim 26 (depends on 21)

The method of claim 21, further comprising sending at least one signal selected from: predetermined system signals, communication data, arguments, while executing said variant, in order to neutralize integrated triggers, wherein said at least one signal has been captured by agents on endpoint devices or network appliances.

### Claim 27 (depends on 21)

The method of claim 21, further comprising: monitoring code coverage while executing said variant, in order to identify code regions not executed, said not executed code regions being indicative of triggers integrated in said variant.

### Claim 28

A method comprising:
receiving a malware specimen;
generating variants of said malware specimen;
scanning each said variant with a selected group of security products and awarding an evasiveness Score, based on an inability of said security products to detect said variant;
determining, for each said variant, whether said variant causes malicious activity and awarding a maliciousness score based on said determination;
awarding each said variant a fitness score based on the variant's said evasiveness score and said maliciousness score;
the method further comprising:
selecting, from among a plurality of detectors capable of detecting malicious characteristics and non-malicious characteristics of the variants, at least one detector having a rating above a predetermined level, the rating based on a number of said malicious characteristics correctly detected, a number of non-malicious characteristics incorrectly detected, and a length of at least one of the malicious characteristics correctly detected.

### Claim 29 (depends on 28)

The method of claim 28, further comprising:
awarding a rating to each of said security products based on a level of success in detecting said variants.

### Claim 30 (depends on 29)

The method of claim 29, wherein said rating is based on said level of success relative to other said security products.

### Claim 31

A method for generating malware variants from a malware specimen, the method comprising:
generating the malware variants by performing at least one action selected from the group consisting of applying mutations to executable code of said malware specimens, applying mutations to malware emitted network traffic, and cross-merging said malware variants;
evaluating an evasiveness and a maliciousness of the malware variants and awarding each of the malware variants a fitness score,
wherein the evasiveness is measured for a malware variant by scanning the malware variant with a selected group of security products and awarding an evasiveness score based on an inability of the security products to detect the malware variant, and
wherein said maliciousness is measured by determining whether the malware variant causes malicious activity and awarding a maliciousness score based on the determination;
the method further comprising:
selecting, from among a plurality of detectors capable of detecting malicious characteristics and non-malicious characteristics of the malware variants, a Detector having a rating above a predetermined level, the rating based on a number of the malicious characteristics correctly detected, a number of the non-malicious characteristics incorrectly detected, and a length of at least one of the malicious characteristics correctly detected.

### Claim 32 (depends on 31)

The method of claim 31, wherein said applying of said mutations to said executable code is effected by at least one of:
(i) random mutations,
(ii) replacing a given command sequence with another, functionally equivalent, sequence of commands,
(iii) replacing a selected library call with a different, functionally equivalent, library call,
(iv) replacing a selected library used with a different, functionally equivalent, library,
(v) increasing respective probabilities of said mutations in areas identified as having a malicious function;
(vi) increasing respective probabilities of said mutations in areas identified as unlikely to prevent proper execution of said executable code;
(vii) increasing probability of said mutations in areas signed by security products;
(viii) increasing probability of said mutations in areas where previous said mutations resulted in an increased said fitness score;
(ix) rewriting headers of said executable code for a section where binary code has been added, resulting in expansion of said section;
(x) combining said executable code with other said executable code to produce combined code and rewriting relevant headers to allow for proper execution of said combined code; or
(xi) modifying certain sections of said executable code in order to change dynamic function calls to static invocation of relevant operating system calls.

### Claim 33 (depends on 31)

The method of claim 31, wherein applying mutations to malware emitted network traffic comprises:
(i) sending said malware emitted network traffic from an attack machine to a router;
(ii) mutating elements of said malware emitted network traffic; and
(iii) sending said mutated malware emitted network traffic to a victim machine.