Detecting and responding to malware using link files
View Patent ↗Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for monitoring the generation of link files by processes on a computer and performing protection processes based on whether the link files target malicious objects or are generated by malicious processes. In one aspect, a method includes monitoring for a generation of a first file that includes a target path that points to an object; in response to monitoring the generation of the first file: determining whether the target path is a uniform resource locator; in response to determining that the target path is a uniform resource locator, identifying a process that caused the first file to be generated; determining whether the process is a prohibited process; in response to determining that the process is a prohibited process, performing one or more protection processes on the process and the first file; in response to determining that the process is not a prohibited process, determining whether the uniform resource locator is a prohibited uniform resource locator; in response to determining that the uniform resource locator is a prohibited uniform resource locator, performing one or more protection processes on the process and the first file.
1. A computer-implemented method, comprising:
monitoring, by a first computer, a generation of a link file that includes a target path that points to an object;
in response to monitoring the generation of the link file:
identifying, by the first computer, a process that caused the link file to be generated;
determining, by the first computer, whether the process is a prohibited process;
in response to determining that the process is a prohibited process, performing, by the first computer, one or more protection processes on the process and the link file;
in response to determining that the process is not a prohibited process, determining, by the first computer, whether the link file generates a request to a uniform resource locator;
in response to determining that the link file generates a request to a uniform resource locator, determining, by the first computer, whether the uniform resource locator is associated with a malicious resource;
in response to determining that the uniform resource locator is associated with a malicious resource, performing, by the first computer, one or more protection processes on the link file.
2. The computer-implemented method of claim 1 , wherein determining, by the first computer, whether the process is a prohibited process comprises:
generating, by the first computer, data descriptive of the process;
sending, by the first computer, the data descriptive of the process to a second computer;
receiving, by the first computer, data indicative of whether the process is a prohibited process from the second computer; and
determining, by the first computer, in response to the data received from the second computer, whether the process is a prohibited process.
3. The computer-implemented method of claim 2 , wherein the data descriptive of the process comprises a signature associated with the first process.
4. The computer-implemented method of claim 1 , wherein determining, by the first computer, whether the uniform resource locator is associated with a malicious resource comprises:
generating, by the first computer, data descriptive of the uniform resource locator;
sending, by the first computer, the data descriptive of the uniform resource locator to a second computer;
receiving, by the first computer, data indicative of whether the uniform resource locator is associated with a malicious resource from the second computer; and
determining, by the first computer, in response to the data received from the second computer, whether the uniform resource locator is associated with a malicious resource.
5. The computer-implemented method of claim 1 , wherein the one or more protection processes performed on the process comprise one or more of the following:
terminating, by the first computer, the process;
deleting, by the first computer, one or more files associated with the process;
renaming, by the first computer, one or more files associated with the process;
quarantining, by the first computer, one or more files associated with the process; and
sending, by the first computer, one or more files associated with the process to a second computer for analysis.
6. The computer-implemented method of claim 1 , wherein the one or more protection processes performed on the link file comprise one or more of the following:
deleting, by the first computer, one or more files associated with the link file;
renaming, by the first computer, one or more files associated with the link file; and
quarantining, by the first computer, one or more files associated with the link file.
7. The method of claim 1 , wherein determining whether the uniform resource locator is associated with a malicious resource includes determining whether the uniform resource locator references a malicious object.
8. The method of claim 1 , wherein determining whether the uniform resource locator is associated with a malicious resource includes determining whether the uniform resource locator addresses a malicious resource.
9. A computer-implemented method, comprising:
monitoring, by a first computer, a generation of a link file that includes a target path that points to an object;
in response to monitoring the generation of the link file:
determining, by the first computer, whether the link file generates a request to a uniform resource locator;
in response to determining that the link file generates a request to a uniform resource locator, identifying, by the first computer, a process that caused the link file to be generated;
determining, by the first computer, whether the process is a prohibited process;
in response to determining that the process is a prohibited process, performing, by the first computer, one or more protection processes on the process and the link file;
in response to determining that the process is not a prohibited process, determining, by the first computer, whether the uniform resource locator is associated with a malicious resource;
in response to determining that the uniform resource locator is associated with a malicious resource, performing, by the first computer, one or more protection processes on the process and the link file.
10. The computer-implemented method of claim 9 , wherein determining, by the first computer, whether the process is a prohibited process comprises:
generating, by the first computer, data descriptive of the process;
sending, by the first computer, the data descriptive of the process to a second computer;
receiving, by the first computer, data indicative of whether the process is a prohibited process from the second computer; and
determining, by the first computer, in response to the data received from the second computer, whether the process is a prohibited process.
11. The computer-implemented method of claim 10 , wherein the data descriptive of the process comprises a signature associated with the process.
12. The computer-implemented method of claim 9 wherein determining, by the first computer, whether the uniform resource locator is associated with a malicious resource comprises:
generating, by the first computer, data descriptive of the uniform resource locator;
sending, by the first computer, the data descriptive of the uniform resource locator to a second computer;
receiving, by the first computer, data indicative of whether the uniform resource locator is associated with a malicious resource from the second computer; and
determining, by the first computer, in response to the data received from the second computer, whether the uniform resource locator is associated with a malicious resource.
13. The computer-implemented method of claim 9 , wherein the one or more protection processes performed on the process comprise one or more of the following:
terminating, by the first computer, the process;
deleting, by the first computer, one or more files associated with the process;
renaming, by the first computer, one or more files associated with the process;
quarantining, by the first computer, one or more files associated with the process; and
sending, by the first computer, one or more files associated with the process to a second computer for analysis.
14. The computer-implemented method of claim 9 , wherein the one or more protection processes performed on the link file comprise one or more of the following:
deleting, by the first computer, one or more files associated with the link file;
renaming, by the first computer, one or more files associated with the link file; and
quarantining, by the first computer, one or more files associated with the link file.
15. A computer storage medium encoded with a computer program, the program comprising instructions that when executed by at least one data processing apparatus cause the at least one data processing apparatus to perform operations comprising:
monitoring a generation of a link file that generates a request to a uniform resource locator;
in response to monitoring the generation of the link file:
identifying a process that caused the link file to be generated;
determining whether the process is a prohibited process;
in response to determining that the process is a prohibited process, performing one or more protection processes on the process and the link file;
in response to determining that the process is not a prohibited process, determining whether the uniform resource locator is associated with a malicious resource;
in response to determining that the uniform resource locator is associated with a malicious resource, performing one or more protection processes on the process and the link file.
16. The computer storage medium of claim 15 , wherein determining whether the process is a prohibited process, further comprises:
generating data descriptive of the process;
sending the data descriptive of the process to a second computer;
receiving data indicative of whether the process is a prohibited process from the second computer; and
determining, in response to the data received from the second computer, whether the process is a prohibited process.
17. The computer storage medium of claim 16 , wherein the data descriptive of the process comprises a signature associated with the process.
18. The computer storage medium of claim 15 , wherein determining whether the uniform resource locator is associated with a malicious resource further comprises:
generating data descriptive of the uniform resource locator;
sending the data descriptive of the uniform resource locator to a second computer;
receiving data indicative of whether the uniform resource locator is associated with a malicious resource from the second computer; and
determining, in response to the data received from the second computer, whether the uniform resource locator is associated with a malicious resource.
19. The computer storage medium of claim 15 , wherein the one or more protection processes performed on the process comprise one or more of the following:
terminating the process;
deleting one or more files associated with the process;
renaming one or more files associated with the process;
quarantining one or more files associated with the process; and
sending one or more files associated with the process to a second computer for analysis.
20. The computer storage medium of claim 15 , wherein the one or more protection processes performed on the link file comprise one or more of the following:
deleting one or more files associated with the link file;
renaming one or more files associated with the link file; and
quarantining one or more files associated with the link file.