DETERMINING MALICIOUSNESS OF SOFTWARE
A method of detecting malicious activity, including the steps of: intercepting activity in a processing system 100; detecting attributes of an un-assessed process 460 associated with the activity; comparing the process attributes and activity to a database 430 of attributes and activity associated with known malicious and non-malicious processes; and using an inference filter 470 to compute the likely maliciousness of the un-assessed process.
1 . A method of detecting malicious activity, including the steps of:
intercepting activity in a processing system;
detecting attributes of an un-assessed process associated with the activity;
comparing the process attributes and activity to a database of attributes and activity associated with known malicious and non-malicious processes; and
using an inference filter to compute the likely maliciousness of the un-assessed process.
2 . The method of claim 1 , wherein a minimum number of attributes of un-assessed processes are detected before the process attributes and activity of the un-assessed processes are compared with attributes and activity associated with known malicious and non-malicious processes.
3 . The method of claim 1 , wherein if the inference filter computes that the un-assessed process is likely to be malicious, the method further includes the step of terminating the un-assessed process associated with the activity.
4 . The method of claim 1 , wherein if the inference filter computes that the un-assessed process is likely to be malicious, the method further includes the step of deleting a file associated with the un-assessed process run by the activity.
5 . The method of claim 1 , wherein if the inference filter computes that the un-assessed process is likely to be malicious, the method further includes the step of notifying a user.
6 . The method of claim 1 , wherein the method further includes the step of notifying a communications module after the inference filter computes the un-assessed process to be a likely malicious process or non-malicious process.
7 . The method of claim 6 , wherein the communications module is in communication with an administrator and notifies the administrator if the un-assessed process was computed by the inference filter to be a likely malicious process or non-malicious process.
8 . The method of claim 6 , wherein the communications module is in communication with a third party and notifies the third party if the un-assessed process was computed by the inference filter to be a likely malicious process or non-malicious process.
9 . The method of claim 8 , wherein the third party is a remote database operated by a vendor.
10 . The method of claim 9 , wherein the communications module provides the remote database with user information, process information and a user response.
11 . The method of claim 10 , wherein the process information and user response is exchanged between other users via the remote database.
12 . The method of claim 11 , wherein the exchange takes place after the user executes the method of claim 1 .
13 . The method of claim 12 , wherein the exchange takes place automatically at periodic intervals.
14 . The method of claim 12 , wherein the exchange takes place when new software is installed by the user.
15 . The method of claim 10 , wherein whether the communications module updates the database is determined by user response.
16 . The method of claim 1 , wherein once the inference filter computes the likely maliciousness of the un-assessed process, the database is amended if a user considers that the un-assessed process is a malicious process or non-malicious process.
17 . A method of training an inference filter for use in a method of detecting malicious activity according to claim 1 , including the steps of:
loading and running known malicious and known non-malicious software into a processing system;
intercepting activity by the known malicious and known non-malicious software in a processing system;
detecting attributes of one or more processes associated with the activity by the known malicious and known non-malicious software;
storing process attributes and activity in a database;
advising the inference filter if the attributes of one or more processes associated with activity are malicious or non-malicious.
18 . The method of claim 17 , wherein the malicious and non-malicious software is loaded manually into the processing system by a user.
19 . The method of claim 17 , wherein the malicious and non-malicious software is loaded automatically by a loader into the processing system.
20 . The method of claim 17 , wherein the malicious and non-malicious software is loaded automatically by a loader which services a queue populated by a local or remote service.
21 . The method of claim 1 or 17 , wherein the malicious and non-malicious activities are intercepted by API hooking techniques.
22 . Software for use with a computer including a processor and associated memory device for storing the software, the software including a series of instructions to cause the processor to carry out a method according to any one of claims 1 or 17 .
23 . The software of claim 23 , wherein the software resides in a virtual environment.
24 . The software of claim 22 , wherein the virtual environment is a virtual machine.
25 . The software of claim 22 , wherein the software resides in a revertible physical machine.