Malware detection via tracing calls rate to obtain file attributes
The system call rates associated with system calls made by applications or processes operating in a user space are determined and tracked. A malware detection engine, hidden from the user space and operating in the kernel space, is configured to identify anomalous system call rates. A malware process can be identified based on its anomalous system call rate. Once the malware process is identified, protection operations can be performed in the computing system.
1 . A method comprising:
categorizing files of a computing system, by the computing system, into one or more categories including a first category, wherein categorizing the files includes identifying, based on file attributes, files that are predictively valuable to ransomware or other malware processes, wherein the computing system identifies first files from among the files that belong to the first category, wherein the computing system determines that the first files are likely targets of a malicious process based on the file attributes indicating sensitivity or value to a malicious process;
monitoring system calls made to an operating system kernel from a process operating in a user space of a computing system, wherein monitoring includes detecting system calls directed to the first files in the first category;
determining a system call rate of the system calls issued by the process, wherein the system call rate comprises a rate at which the process issues file-access system calls directed to the first category of files;
determining that the system call rate is anomalous in the computing system based on the system call rate to the first category exceeding an expected rate associated with non-malicious processes; and
performing a protection operation when the process is determined to be a malicious process based on the system call rate being anomalous with respect to accesses directed to the first category of files.
2 . The method of claim 1 , wherein the system call rate is a first system call rate for all files in the computing system or is a second system call rate for the first category of files in the computing system.
3 . The method of claim 2 , wherein the system call rate is a combination of the first system call rate and the second system call rate.
4 . The method of claim 1 , wherein the first category includes files whose attributes indicate that the files include financial data, personal data, confidential data, or combination thereof.
5 . The method of claim 2 , further comprising determining the first system call rate and the second system call rate with regard to a time window.
6 . The method of claim 5 , further comprising varying a size of the time window.
7 . The method of claim 1 , further comprising determining that the process is anomalous when the system call rate exceeds a threshold system call rate.
8 . The method of claim 1 , further comprising determining that the process is anomalous when the system call rate is statistically anomalous in the context of system call rates associated with other processes operating in the user space.
9 . The method of claim 1 , wherein the system calls are directed to files, databases, and/or other data types.
10 . A non-transitory storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
categorizing files of a computing system, by the computing system, into one or more categories including a first category, wherein the computing system identifies first files from among the files that belong to the first category, wherein the computing system determines that the first files are predictively valuable to ransomware or other malware processes based on file attributes indicating sensitivity or likely targeting by malware processes;
monitoring system calls made to an operating system kernel from a process operating in a user space of a computing system, including detecting system calls directed to the first files in the first category;
determining a system call rate of the system calls issued by the process, including determining a rate at which the process issues file-access system calls directed to the first category of files;
determining that the system call rate is anomalous in the computing system based on the rate of system calls directed to the first category of files exceeding an expected rate associated with non-malicious processes; and
performing a protection operation when the process is determined to be a malicious process based on the system call rate being anomalous with respect to the accesses directed to the first category of files.
11 . The non-transitory storage medium of claim 10 , wherein the system call rate is a first system call rate for all files in the computing system or is a second system call rate for a first category of files in the computing system.
12 . The non-transitory storage medium of claim 11 , wherein the system call rate is a combination of the first system call rate and the second system call rate.
13 . The non-transitory storage medium of claim 11 , wherein the first category includes files whose attributes indicate that the files include financial data, personal data, confidential data, or combination thereof.
14 . The non-transitory storage medium of claim 11 , further comprising determining the first system call rate and the second system call rate with regard to a time window.
15 . The non-transitory storage medium of claim 14 , further comprising varying a size of the time window.
16 . The non-transitory storage medium of claim 10 , further comprising determining that the process is anomalous when the system call rate exceeds a threshold system call rate.
17 . The non-transitory storage medium of claim 10 , further comprising determining that the process is anomalous when the system call rate is statistically anomalous in the context of system call rates associated with other processes operating in the user space.
18 . A method comprising:
categorizing files of a computing system, by the computing system, into one or more categories including a first category, wherein the computing system identifies first files from among the files that belong to the first category, wherein the computing system determines that the first files are predictively valuable to ransomware or other malware processes based on file attributes indicating sensitivity or likely malware targeting by malware processes;
monitoring a vector associated with a process operating in a user space of a computing system, wherein the vector comprises a system-call-rate vector representing file-access system calls made to an operating system kernel and directed to the first category of files;
determining that the vector associated with the process is anomalous based on an abnormal rate of system calls directed to the first category of files relative to expected non-malicious file-access patterns;
performing a protection operation when the process is determined to be a malicious process based on the vector being anomalous with respect to accesses directed to the first category of files.
19 . The method of claim 18 , wherein the vector is a system call rate, an access scheme, or a target list or combination thereof.