Method and apparatus for determination of the non-replicative behavior of a malicious program
View Patent ↗Disclosed is a method, a computer system and a computer readable media product that contains a set of computer executable software instructions for directing the computer system to execute a process for determining a non-replicative behavior of a program that is suspected of containing an undesirable software entity. The process causes execution of the program in at least one known environment and automatically examines the at least one known environment to detect if a change has occurred in the environment as a result of the execution of the program. If a change is detected, the process automatically analyzes the detected change (i.e., the process performs a side effects analysis) to determine if the change resulted from execution of the program or from execution of the undesirable software entity. The process then uses the result of the analysis at least for undoing a detected change that results from execution of the undesirable software entity. The result of the analysis can also be used for informing a user of an anti-virus system of the non-replicative changes made to the environment.
1. A method, comprising:
executing, by a first computer system, a program suspected of containing an undesirable software entity exhibiting non-replicative behavior in at least one controlled environment, where executing the program comprises infecting a plurality of goat files, selecting an infected goat file deemed to be most effective for soliciting side effects generations based on at least one criterion, and executing the selected infected goat file;
automatically examining, by a second computer system, the at least one controlled environment to detect if a change has occurred in the environment as a result of the execution of the program and, if a change is detected, automatically analyzing the detected change to determine if the change resulted from normal execution of the program or from execution of the undesirable software entity, where normal execution of the program comprises execution of the program when the program does not contain the undesirable software entity, where automatically examining the at least one controlled environment comprises comparing a first system state that results from the execution of the selected infected goat file with a second system state that results from the execution of a non-infected version of the selected goat file; and
using, by a third computer system, a result of the analysis for at least one of undoing a detected change that results from execution of the undesirable software entity and informing a user of the changes that have been observed to result from the execution of the undesired software entity, where if the step of infecting a plurality of goat files is unsuccessful the step of executing the program executes the program and a generically repaired version of the program, and the step of automatically examining the at least one controlled environment comprises comparing a third system state that results from the execution of the program with a fourth system state that results from the execution of the generically repaired version of the program.
2. The method as in claim 1 , where a number of times that the program is executed is a function of the type of the detected changes and the consistency of the detected changes between executions of the program.
3. The method as in claim 1 , where another program infected during the execution of the program is exercised in the same environment for differentiating between malicious and non-malicious program changes.
4. The method as in claim 1 , further comprising disinfecting the program; and exercising the disinfected program in the same environment for differentiating between malicious and non-malicious program changes.
5. The method as in claim 1 , further comprising locating a non-infected copy of the program using at least one of a pattern of changes made to the environment during execution of a malicious program and a look and feel of the program.
6. The method as in claim 1 , where the program is executed in an environment where requests made by the program to interact with the environment have a potential to create a side effect.
7. The method as claim 6 , further comprising always granting a request by the program to interact with the environment.
8. The method as claim 6 , further comprising always granting a request by the program for access to an environmental resource.
9. The method as claim 6 , further comprising always granting a request by the program for access to a resource located external to the environment.
10. The method as in claim 1 , where the program is suspected of containing a virus program.
11. The method as in claim 1 , where the program is suspected of containing a worm program.
12. The method as in claim 1 , where the program is suspected of containing a Trojan Horse program or being a Trojan Horse program.
13. The method as in claim 1 , where the step of automatically examining includes comparing a current state of the environment after the program is executed at least once to a state of the environment before the program was executed.
14. The method as in claim 1 , where the step of automatically examining includes comparing a current state of the environment after the program is executed at least once to a state of the environment that results from the execution of a known non-infected version of the program, and ignoring side effects that result normally from program execution.
15. The method as in claim 1 , where the step of automatically examining comprises comparing a current state of the environment after the program is executed at least once to a state of the environment that results from the execution of a generically repaired version of the program, and ignoring side effects that result normally from program execution.
16. The method as in claim 1 , where the step of automatically examining comprises comparing a current state of the environment after the program is executed at least once to a state of the environment that is ascertained from a look and feel analysis of the operation of a graphical user interface of the program to determine the identity of the original uninfected program, and ignoring side effects that result normally from program execution.
17. The method as in claim 1 , where the step of automatically examining comprises comparing a current state of the environment after the program is executed at least once to a state of the environment that results from the execution of a plurality of commonly used programs, and ignoring side effects that result normally from program execution.
18. The method as in claim 1 , where the step of automatically examining comprises comparing a content of a registry after the program is executed at least once to a saved content of the registry that results from the execution of at least one of a known non-infected version of the program and a generically repaired version of the program, and identifying differences in the registry contents as side effects that are used for at least one of undoing a detected change that results from execution of the undesirable software entity and informing a user of the side effects.
19. The method as in claim 1 , where the step of automatically examining comprises comparing system initialization files after the program is executed at least once to saved system initialization files that result from the execution of at least one of a known non-infected version of the program and a generically repaired version of the program, and identifying differences in the system initialization files as side effects that are used for at least one of undoing a detected change that results from execution of the undesirable software entity and informing a user of the side effects.
20. A computer readable storage memory storing a set of computer executable software instructions for execution by a computer, said execution resulting in operations comprising:
executing a program suspected of containing an undesirable software entity exhibiting non-replicative behavior in at least one controlled environment, where executing the program comprises infecting a plurality of goat files, selecting an infected goat file deemed to be most effective for soliciting side effects generations based on at least one criterion, and executing the selected infected goat file;
automatically examining the at least one controlled environment to detect if a change has occurred in the environment as a result of the execution of the program and, if a change is detected, automatically analyzing the detected change to determine if the change resulted from normal execution of the program or from execution of the undesirable software entity, where normal execution of the program comprises execution of the program when the program does not contain the undesirable software entity, where automatically examining the at least one controlled environment comprises comparing a first system state that results from the execution of the selected infected goat file with a second system state that results from the execution of a non-infected version of the selected goat file; and
using a result of the analysis for at least one of undoing a detected change that results from execution of the undesirable software entity and informing a user of the changes that have been observed to result from the execution of the undesired software entity, where if the step of infecting a plurality of goat files is unsuccessful the step of executing the program executes the program and a generically repaired version of the program, and the step of automatically examining the at least one controlled environment comprises comparing a third system state that results from the execution of the program with a fourth system state that results from the execution of the generically repaired version of the program.
21. The computer readable storage memory as in claim 20 , where examining comprises comparing a current state of the environment after the program is executed at least once to a state of the environment before the program was executed.
22. The computer readable storage memory as in claim 20 , where examining comprises comparing a current state of the environment after the program is executed at least once to a state of the environment that results from the execution of a known non-infected version of the program.
23. The computer readable storage memory as in claim 20 , where examining comprises comparing a current state of the environment after the program is executed at least once to a state of the environment that results from the execution of a generically repaired version of the program.
24. The computer readable storage memory as in claim 20 , where examining comprises comparing a current state of the environment after the program is executed at least once to a state of the environment resulting from execution of a program selected on the basis of its look and feel, as determined from operation of a graphical user interface of the program.
25. The computer readable storage memory as in claim 20 , where examining comprises comparing a current state of the environment after the program is executed at least once to a state of the environment that results from the execution of a plurality of commonly used programs.
26. The computer readable storage memory as in claim 20 , where examining comprises comparing a content of a registry after the program is executed at least once to a saved content of said registry that results from execution of at least one of a known non-infected version of the program and a generically repaired version of the program; and identifying differences in registry contents as side effects that are used for at least one of undoing a detected change that results from execution of the undesirable software entity and informing a user of the side effects.
27. The computer readable storage memory as in claim 20 , where examining comprises comparing system initialization files after the program is executed at least once to saved system initialization files that result from execution of at least one of a known non-infected version of the program and a generically repaired version of the program; and identifying differences in the system initialization files as side effects that are used for at least one of undoing a detected change that results from execution of the undesirable software entity and informing a user of the side effects.
28. A computer system comprising:
a behavior elicitation subsystem comprising a memory and a processor, where the behavior elicitation subsystem is configured to execute a program suspected of containing an undesirable software entity exhibiting non-replicative behavior in at least one controlled environment, where executing the program comprises infecting a plurality of goat files, selecting an infected goat file deemed to be most effective for soliciting side effects generations based on at least one criterion, and executing the selected infected goat file; and
a controlling subsystem comprising a memory and a processor, where the controlling subsystem is configured to automatically examine the at least one controlled environment to detect if a change has occurred in the environment as a result of the execution of the program and, if a change is detected, to automatically analyze the detected change to determine if the change resulted from normal execution of the program or from execution of the undesirable software entity, where normal execution of the program comprises execution of the program when the program does not contain the undesirable software entity, where automatically examining the at least one controlled environment comprises comparing a first system state that results from the execution of the selected infected goat file with a second system state that results from the execution of a non-infected version of the selected goat file,
where the controlling subsystem is further configured to use a result of the analysis for at least one of undoing a detected change that results from execution of the undesirable software entity and informing a user of the changes that have been observed to result from the execution of the undesired software entity, where if the step of infecting a plurality of goat files is unsuccessful the step of executing the program executes the program and a generically repaired version of the program, and the step of automatically examining the at least one controlled environment comprises comparing a third system state that results from the execution of the program with a fourth system state that results from the execution of the generically repaired version of the program.