Malware detection using external call characteristics
View Patent ↗A malware scanner 2 , for malware such as computer viruses, worms, Trojans and the like, utilizes the external call characteristics associated with known items of malware to identify the presence of malware within a computer file. Malware written in a high level language when compiled can take a variety of different forms as object code, but these different object code forms will usually share external call characteristics to a sufficient degree to allow the presence of such external call characteristics to properly and accurately generically identify different compiled variants of the source code malware.
1. A computer program product embodied on a non-transitory tangible computer readable medium and configured to:
search code operable to search said computer program for external call instructions;
compare said external call instructions within said computer program with at least one predetermined external call instruction characteristic determined from a plurality of external calls and corresponding to known malware; and
identify said computer program as containing malware if said external call instructions within said computer program match a predetermined external call instruction characteristic corresponding to known malware;
delete one or more files associated with known malware, wherein the one or more predetermined external call instruction characteristics comprise predetermined sets characterizing external calls, and wherein at least one of the predetermined sets characterizing external calls includes at least one wildcard external call marker that provides a match to any external call within a particular range within the computer program, wherein said sets characterizing external calls have associated characterizing relative position information specifying relative position requirements for matching external calls within said computer program.
2. A computer program product as claimed in claim 1 , wherein said search code searches for all external calls within said computer program.
3. A computer program product as claimed in claim 1 wherein at least one of said predetermined sets characterizing external calls includes at least one parameterized characterizing external call associated with a characterizing parameter value, said parameterized characterizing external call matching with an external call within said computer program if said characterizing parameter value also matches a corresponding parameter value associated with said external call within said computer program.
4. A computer program product as claimed in claim 3 , wherein said characterizing parameter value has associated relative position information specifying a relative position to said parameterized characterizing external call within which a matching parameter value must be found.
5. A computer program product as claimed in claim 1 , comprising analysis code operable to analyze said computer program to determine identifying characteristics of external calls prior to said step of searching.
6. A computer program product as claimed in claim 5 , wherein said analysis includes one or more of:
analyzing link information associated with said computer program; and
analyzing a location of said computer program within a file to identify a boundary between said computer program and the joined run-time library.
7. A computer program product as claimed in claim 1 , wherein said malware is one or more of:
a computer virus;
a worm;
and a Trojan.
8. A method of detecting a computer program containing malware, comprising:
searching said computer program for external call instructions;
comparing said external call instructions within said computer program with at least one predetermined external call instruction characteristic determined from a plurality of external calls and corresponding to known malware; and
identifying said computer program as containing malware if said external call instructions within said computer program match a predetermined external call instruction characteristic corresponding to known malware,
deleting one or more files associated with known malware, wherein the one or more predetermined external call instruction characteristics comprise
predetermined sets characterizing external calls, and wherein at least one of the predetermined sets characterizing external calls includes at least one wildcard external call marker that provides a match to any external call within a particular range within the computer program, wherein said sets characterizing external calls have associated characterizing relative position information specifying relative position requirements for matching external calls within said computer program.
9. A method as claimed in claim 8 , wherein said step of searching said computer program searches for all external calls within said computer program.
10. A method as claimed in claim 8 , wherein at least one of said predetermined sets characterizing external calls includes at least one parameterized characterizing external call associated with a characterizing parameter value, said parameterized characterizing external call matching with an external call within said computer program if said characterizing parameter value also matches a corresponding parameter value associated with said external call within said computer program.
11. A method as claimed in claim 10 , wherein said characterizing parameter value has associated relative position information specifying a relative position to said parameterized characterizing external call within which a matching parameter value must be found.
12. A method as claimed in claim 8 , comprising analyzing said computer program to determine identifying characteristics of external calls prior to said step of searching.
13. A method as claimed in claim 12 , wherein said analyzing includes one or more of:
analyzing link information associated with said computer program; and
analyzing a location of said computer program within a file to identify a boundary between said computer program and the joined run-time library.
14. A method as claimed in claim 8 , wherein said malware is one or more of:
a computer virus;
a worm;
and a Trojan.
15. An apparatus for detecting a computer program containing malware using a processor and a memory, said apparatus being configured to:
search said computer program for external call instructions;
compare said external call instructions within said computer program with at least one predetermined external call instruction characteristic determined from a plurality of external calls and corresponding to known malware; and
identify said computer program as containing malware if said external call instructions within said computer program match a predetermined external call instruction characteristic corresponding to known malware;
delete one or more files associated with known malware, wherein the one or more predetermined external call instruction characteristics comprise predetermined sets characterizing external calls, and wherein at least one of the predetermined sets characterizing external calls includes at least one wildcard external call marker that provides a match to any external call within a particular range within the computer program, wherein said sets characterizing external calls have associated characterizing relative position information specifying relative position requirements for matching external calls within said computer program.
16. The apparatus as claimed in claim 15 , wherein said search logic searches for all external calls within said computer program.
17. The apparatus as claimed in claim 15 , wherein at least one of said predetermined sets characterizing external calls includes at least one parameterized characterizing external call associated with a characterizing parameter value, said parameterized characterizing external call matching with an external call within said computer program if said characterizing parameter value also matches a corresponding parameter value associated with said external call within said computer program.
18. The apparatus as claimed in claim 17 , wherein said characterizing parameter value has associated relative position information specifying a relative position to said parameterized characterizing external call within which a matching parameter value must be found.
19. The apparatus as claimed in claim 15 , comprising analysis logic operable to analyze said computer program to determine identifying characteristics of external calls prior to said step of searching.
20. The apparatus as claimed in claim 19 , wherein said analysis includes one or more of:
analyzing link information associated with said computer program; and
analyzing a location of said computer program within a file to identify a boundary between said computer program and the joined run-time library.
21. The apparatus as claimed in claim 15 , wherein said malware is one or more of:
a computer virus;
a worm; and
a Trojan.