System, method, and computer program product for detecting unwanted data based on scanning associated with a payload execution and a behavioral analysis
View Patent ↗A system, method, and computer program product are provided for detecting unwanted data based on scanning associated with a payload execution and a behavioral analysis. In use, an execution of a payload is detected, utilizing interface monitoring. Additionally, process memory associated with the execution of the payload is scanned. Further, a behavioral analysis is performed. Still yet, unwanted data is detected based on the scanning and the performance of the behavioral analysis.
1. A non-transitory computer readable medium comprising instructions stored thereon to cause one or more processing units to:
detect an execution of a payload by utilizing interface monitoring;
scan process memory associated with the execution of the payload for a match against at least one of a plurality of signatures representing known unwanted data;
perform a behavioral analysis to determine an amount of the payload that has executed; and
reduce a level of interface monitoring and a level of process memory scanning after a predetermined amount of the payload has executed and unwanted data has not been detected based on the act of scanning process memory.
2. The non-transitory computer readable medium of claim 1 , wherein the payload includes an executable form of code.
3. The non-transitory computer readable medium of claim 1 , wherein the payload includes unpacked code.
4. The non-transitory computer readable medium of dam 1 , wherein the instructions to cause one or more processing units to detect the execution of the payload by utilizing interface monitoring include instructions to cause one or more processing units to monitor predetermined interfaces.
5. The non-transitory computer readable medium of claim 4 , wherein the instructions to cause one or more processing units to monitor predetermined interfaces include instructions to cause one or more processing units to monitor at least one of an interface for loading a module, an interface for allocating and modifying a memory protection, and an interface for spawning a process.
6. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause one or more processing units to detect the execution of the payload by utilizing interface monitoring are performed by hooking an interface.
7. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause one or more processing units to detect the execution of the payload by utilizing interface monitoring include instructions to cause one or more processing units to utilize a callback.
8. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause one or more processing units to detect the execution of the payload by utilizing interface monitoring include instructions to cause one or more processing units to detect the execution of the payload by detecting execution of an interface invoked by the execution of the payload.
9. The non-transitory computer readable medium of claim 1 , wherein the process memory includes code that invoked a monitored interface.
10. The non-transitory computer readable medium of claim 1 , wherein the process memory includes code included in call frames of a call stack which resulted in invocation of a monitored interface.
11. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause one or more processing units to scan the process memory include instructions to cause one or more processing units to scan data affected by invocation of a monitored interface.
12. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause one or more processing units to scan the process memory include instructions to cause one or more processing units to scan only predetermined types of the process memory.
13. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause one or more processing units to scan the process memory include instructions to cause one or more processing units to determine whether the process memory matches only a portion of a signature from the plurality of signatures representing known unwanted data.
14. The non-transitory computer readable medium of claim 13 , wherein the level of interface monitoring and the level of process memory scanning are maintained for subsequent executions of the payload if it is determined that the process memory matches only the portion of the signature.
15. The non-transitory computer readable medium of claim 1 , wherein the instructions to cause one or more processing units to perform the behavioral analysis include instructions to cause one or more processing units to analyze results of the act of scanning process memory for a current execution of the payload to results of the act of scanning process memory for previous executions of the payload.
16. The non-transitory computer readable medium of claim 1 , further comprising instructions to cause one or more processors to:
report a violation based on a precise match against a signature from the plurality of signatures representing known unwanted data; and
maintain the level of interface monitoring and the level of process memory scanning based on a partial match against a signature from the plurality of signatures representing known unwanted data.
17. A method, comprising:
detecting an execution of a payload by utilizing interface monitoring;
scanning process memory associated with the execution of the payload for a match against at least one of a plurality of signatures representing known unwanted data;
performing a behavioral analysis to determine an amount of the is load that has executed; and
reducing a level of interface monitoring and a level of process memory scanning when a redetermined amount of the era load has executed and unwanted data has not been detected based on the process memory scan.
18. The method of claim 17 , further comprising:
reporting a violation based on a precise match against a signature from the plurality of signatures representing known unwanted data; and
maintaining the level of interface monitoring and the level of process memory scanning based on a partial match against a signature from the plurality of signatures representing known unwanted data.
19. A system, comprising:
a memory; and
a processor operatively coupled to the memory, the processor adapted to execute program code stored in the memory to:
detect an execution of a payload by utilizing interface monitoring,
scan process memory associated with the execution of the payload for a match against at least one of a plurality of signatures representing known unwanted data,
perform a behavioral analysis to determine an amount of the payload that has executed, and
reduce a level of interface monitoring and a level of process memory scanning when a predetermined amount of the payload has executed and unwanted data has not been detected based on the act of scanning process memory.
20. The system of claim 19 , wherein the processor is further adapted to execute program code stored in the memory to:
report a violation based on a precise match against a signature from the plurality of signatures representing known unwanted data; and
maintain the level of interface monitoring and the level of process memory scanning based on a partial match against a signature from the plurality of signatures representing known unwanted data.