Detecting timing anomalies
AssigneeThe MITRE Corporation
InventorsDarrow Paine Leibner, Alessandro Paolo Cerruti
Life of this patent
Estimating the term…
Abstract
Disclosed herein are system, method, and computer program product embodiments for adapting to malware activity on a compromised computer system. An embodiment operates by detecting an active adversary operating malware on a compromised system. A stream of data traffic associated with active adversary is intercepted. The stream of data traffic includes a command and control channel of the active adversary. The stream of data traffic is accessed. An emulation of the command and control channel is provided. An analysis of the accessed stream of traffic is executed. A plurality of response mechanisms is provided. The plurality of response mechanisms is based in part on the analysis of the stream of data traffic and a custom policy language tailored for the malware.
Claims15
A method comprising:
- processing first timing data accessed from a validated clock source;
- processing second timing data accessed from an unvalidated receiver source, wherein the validated clock source is independent of the validated receiver source;
- comparing the processed first timing data with the processed second timing data for an adjustable interval of time to determine a threat detection value;
- and
- when the threat detection value meets a configurable threat detection threshold, generating a threat alert message, wherein the threat alert message identifies an anomaly in either the validated clock source or the unvalidated receiver source,
- wherein the comparing comprises analyzing the processed second timing data and the processed first timing data, wherein the analyzing comprises:
- detecting a pulse per second (PPS) received from the unvalidated receiver source,
- determining a quantity of cycles received from the validated clock source prior to the detected PPS,
- wherein the comparing further comprises:
- determining the threat detection value based on a comparison between the determined quantity of cycles and a predetermined expected clock cycle value.
A system comprising:
- a memory;
- and
- at least one processor coupled to the memory and configured to:
- process first timing data received from a validated clock source;
- process second timing data received from an unvalidated receiver source, wherein the validated clock source is independent of the unvalidated receiver source;
- compare the processed first timing data with the processed second timing data for an adjustable interval of time to determine a threat detection value;
- and
- when the threat detection value meets a configurable threat detection threshold, generate a threat alert, wherein the threat value indicates at least one of a timing anomaly or frequency anomaly in either the validated clock source or the unvalidated receiver source,
- wherein to perform the compare the processor is configured to:
- analyze the processed second timing data and the processed first timing data;
- detect a pulse per second (PPS) received from the unvalidated receiver source;
- determine a quantity of cycles received from the validated clock source prior to the detected PPS;
- determine the threat detection value based on a comparison between the determined quantity of cycles and a predetermined expected clock cycle value.
A tangible computer-readable device having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform operations comprising:
- processing first timing data received from a validated clock source;
- processing second timing data received from an unvalidated receiver source, wherein the validated clock source is independent of the unvalidated receiver source;
- comparing the processed first timing data with the processed second timing data for an adjustable interval of time to determine a threat detection value;
- and
- when the threat detection value meets a configurable threat detection threshold, generating a threat alert, wherein the threat value indicates at least one of a timing anomaly or frequency anomaly in either the validated clock source or the unvalidated receiver source,
- wherein the comparing comprises analyzing the processed second timing data and the processed first timing data, wherein the analyzing comprises:
- detecting a pulse per second (PPS) received from the unvalidated receiver source;
- determining a quantity of cycles received from the validated clock source prior to the detected PPS, and wherein the comparing further comprises:
- determining the threat detection value based on a comparison between the determined quantity of cycles and a predetermined expected clock cycle value.
Dependencies are inferred from the claim text.