Method and apparatus for detecting malicious code in an information handling system
View Patent ↗A method for detecting malicious code on an information handling system includes executing malicious code detection code (MCDC) on the information handling system. The malicious code detection code includes detection routines. The detection routines are applied to executable code under investigation running on the information handling system during the execution of the MCDC. The detection routines associate weights to respective executable code under investigation in response to detections of a valid program or malicious code as a function of respective detection routines. Lastly, executable code under investigation is determined a valid program or malicious code as a function of the weights associated by the detection routines. Computer-readable media and an information handling system are also disclosed.
1. One or more non-transitory computer-readable media storing program instructions executable by an information handling system to:
scan a plurality of programs currently running on the information handling system, wherein each of the plurality of programs is scanned while running on the information handling system in a manner that permits infection of the information handling system;
wherein the scan includes, for each of the plurality of programs:
executing a plurality of detection routines to compute a valid score and a malicious score for that program; and
in response to the valid score for that program exceeding a valid score threshold value, categorizing that program as valid code, regardless of the malicious score for that program.
2. The computer-readable media of claim 1 , wherein at least one of the plurality of programs currently running on the information system is a thread.
3. The computer-readable media of claim 1 , wherein the program instructions are executable, upon completion of the execution of the plurality of detection routines for a given one of the plurality of programs, to categorize the given program into one of a set of categories indicative of the likelihood of that program compromising the security of the information handling system, wherein the set of categories includes a first category indicative of malicious code and a second category indicative of valid code.
4. The computer-readable media of claim 3 , wherein the plurality of detection routines include a first set of detection routines that determine whether the program being scanned has at least one of characteristics and behaviors typically associated with malicious code and wherein the plurality of detection routines include a second set of detection routines that determine whether the program being scanned has at least one of characteristics and behaviors typically associated with valid code.
5. The computer-readable media of claim 1 , wherein the scan includes, for each of the plurality of programs, in response to the malicious score for that program exceeding a malicious code threshold value and the valid score for that program being below the valid code threshold value, categorizing that program as malicious code.
6. The computer-readable media of claim 1 , wherein the plurality of detection routines include one or more detection routines that examine a binary image of the current program being scanned for one or more signatures.
7. The computer-readable media of claim 1 , wherein the plurality of detection routines include one or more detection routines that access an operating system of the information handling system on which the plurality of programs are running to determine information relating to the current program being scanned, wherein the access is made via one or more APIs of the operating system.
8. The computer-readable media of claim 1 , wherein the plurality of detection routines include one or more detection routines that access a memory of the information handling system to determine information relating to the current program being scanned.
9. The computer-readable media of claim 1 , wherein the plurality of detection routines include one or more detection routines that access a network connection of the information handling system to determine information relating to the current program being scanned.
10. The computer-readable media of claim 1 , wherein at least one of the plurality of programs is running in a kernel mode.
11. The computer-readable media of claim 1 , wherein the plurality of detection routines include one or more detection routines that interface with a device driver of the information handling system to determine information relating to the current program being scanned.
12. The computer-readable media of claim 1 , wherein the program instructions are executable by the information handling system to determine whether the current program being scanned is a Trojan horse.
13. The computer-readable media of claim 1 , wherein the plurality of detection routines include one or more detection routines to determine whether the current program being scanned is logging keystrokes of a user of the information handling system.
14. The computer-readable media of claim 1 , wherein the plurality of detection routines include one or more detection routines to determine whether the current program being scanned is uploading/downloading files from/to the information handling system.
15. The computer-readable media of claim 1 , wherein the program instructions are executable to perform a scan of currently running programs on an event-driven basis.
16. A method, comprising:
scanning a plurality of programs currently running on an information handling system, wherein each of the plurality of programs is scanned while running on the information handling system in a manner that permits infection of the information handling system, wherein the scanning includes, for each of the currently running programs, executing a plurality of detection routines to determine a valid score and a malicious score; and
upon completion of execution of the plurality of detection routines for a first one of the plurality of programs, categorizing the first program as valid code based on the valid score for the first program exceeding a valid score threshold value, regardless of the malicious score for the first program.
17. The method of claim 16 , further comprising:
upon completion of execution of the plurality of detection routines for a second one of the plurality of programs, categorizing the second program as malicious code based on the malicious score for the second program exceeding a malicious code threshold value and the valid score for the second program not exceeding the valid code threshold value.
18. The method of claim 16 , further comprising performing the scanning on an event-driven basis.
19. The method of claim 16 , wherein the plurality of detection routines include one or more detection routines that examine a binary image of the current program being scanned for one or more signatures, and include one or more detection routines that access an operating system of the information handling system on which the plurality of programs are running to determine information relating to the current program being scanned.
20. An information handling system, comprising:
a central processing unit (CPU);
a memory storing program instructions executable by the CPU to:
scan a plurality of programs currently running on the information handling system, wherein each of the plurality of programs is scanned while running on the information handling system in a manner that permits infection of the information handling system;
wherein the scan includes, for each of the currently running programs, executing a plurality of detection routines to compute a valid score and a malicious score, and categorizing a program as valid code based on the valid score for that program exceeding a valid score threshold value, regardless of the malicious score for that program.
21. The information handling system of claim 20 , wherein the scan includes, for each of the currently running programs, categorizing that program as malicious code in response to the malicious score for that program exceeding a malicious code threshold value and the valid score for that program being below the valid code threshold value.
22. The information handling system of claim 20 , wherein the information handling system is configurable to perform a scan of currently running programs on an event-driven basis.