System and method for proactive detection of malware device drivers via kernel forensic behavioral monitoring and a back-end reputation system
View Patent ↗A method for detecting malware device drivers includes the steps of identifying one or more device drivers loaded on an electronic device, analyzing the device drivers to determine suspicious device drivers, accessing information about the suspicious device drivers in a reputation system, and evaluating whether the suspicious device driver include malware. The suspicious device drivers are not recognized as not including malware. The reputation system is configured to store information about suspicious device drivers. The evaluation is based upon historical data regarding the suspicious device driver.
1. A method for detecting malware device drivers, comprising:
identifying one or more device drivers loaded on an electronic device;
analyzing the device drivers to determine suspicious device drivers, the suspicious device drivers unrecognized as safe, comprising:
selectively scanning specified portions of kernel memory, the specified portions known to be modified by malware device drivers;
comparing the specified portions of kernel memory against known values; and
associating the specified portions of kernel memory with a candidate device driver; and
identifying the suspicious device drivers based upon at least:
a load order, the load order including whether a given device driver is a boot type, service order type, manually loadable, or dynamically loadable driver;
a determination that the specified portions of kernel memory associated with the candidate device driver are unrecognized;
a determination that the candidate device driver is unsigned;
based on the determination of the suspicious device drivers, accessing information about the suspicious device drivers from a reputation system, the reputation system configured to store information about suspicious device drivers; and
based on the determination of the suspicious device drivers, evaluating whether the suspicious device drivers comprise malware device drivers, wherein the evaluation is based upon historical data regarding the suspicious device driver.
2. The method of claim 1 , wherein analyzing the device drivers to determine suspicious device drivers comprises:
examining a whitelist for a device driver; and
determining whether the device driver is suspicious based at least on a determination that the device driver is not in the whitelist.
3. The method of claim 1 , further comprising cleaning the electronic device of a malware device driver, wherein the evaluation is that the suspicious device driver is a malware device driver.
4. The method of claim 3 , wherein cleaning the electronic device of a malware device driver comprises repairing the memory of the electronic device.
5. The method of claim 1 , further comprising generating a repair driver for the electronic device, wherein the evaluation is that the suspicious device driver is a malware device driver.
6. The method of claim 1 , further comprising sending information concerning unrecognized memory values associated with the suspicious device driver to the reputation system.
7. The method of claim 1 , further comprising sending information identifying the electronic device to the reputation system.
8. The method of claim 1 :
wherein analyzing the device drivers to determine suspicious device drivers comprises:
examining a loaded code section within a kernel mode to identify an originating device driver, the originating device driver associated with the loaded code section; and
determining whether the originating device driver is suspicious based at least on a determination that the originating device driver is undetermined;
further comprising:
determining whether the loaded code section comprises a memory hook; and
sending information regarding the loaded code section and the memory hook to the reputation server based on a determination that the loaded code section comprises a memory hook.
9. The method of claim 1 , wherein:
the electronic device comprises an operating system kernel, the operating system kernel requiring device drivers to be digitally signed; and
analyzing the device drivers to determine suspicious device drivers comprises determining whether the device drivers are digitally signed.
10. The method of claim 9 , wherein:
the operating system requires each code section of device drivers to be digitally signed; and
analyzing the device drivers to determine suspicious device drivers comprises analyzing a hash of each code section.
11. The method of claim 1 , wherein evaluating whether the suspicious device driver is a malware device driver comprises comparing the distribution pattern of the suspicious device driver against a known distribution pattern, the known distribution pattern indicating a safe device driver or a malware device driver.
12. An article of manufacture, comprising:
a computer readable non-transitory medium; and
computer-executable instructions carried on the computer readable non-transitory medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
identify one or more device drivers loaded on an electronic device;
analyze the device drivers to determine suspicious device drivers, the suspicious device drivers unrecognized as safe, comprising:
selectively scanning specified portions of kernel memory, the specified portions known to be modified by malware device drivers;
comparing the specified portions of kernel memory against known values; and
associating the specified portions of kernel memory with a candidate device driver; and
determining that the candidate device driver is suspicious based at least on:
a load order, the load order including whether a given device driver is a boot type, service order type, manually loadable, or dynamically loadable driver;
a determination that specified portions of kernel memory associated with the candidate device driver are unrecognized; and
a determination that the candidate device driver is unsigned;
based on the determination of the suspicious device drivers, access information about the suspicious device drivers from a reputation system, the reputation system configured to store information about suspicious device drivers; and
based on the determination of the suspicious device drivers, evaluate whether the suspicious device drivers comprise malware device drivers, wherein the evaluation is based upon historical data regarding the suspicious device drivers.
13. The article of claim 12 wherein causing the processor to analyze the device drivers to determine suspicious device drivers comprises causing the processor to:
examine a whitelist for a device driver; and
determining whether the device driver is suspicious based at least on a determination that the device driver is excluded from the whitelist.
14. The article of claim 12 , wherein the processor is further caused to clean the electronic device of a malware device driver, wherein the evaluation is that the suspicious device driver is a malware device driver.
15. The article of claim 12 , wherein causing the processor to clean electronic device of a malware device driver comprises causing the processor to repair the memory of the electronic device.
16. The article of claim 12 , wherein the processor is further caused to generate a repair driver for the electronic device, wherein the evaluation is that the suspicious device driver is a malware device driver.
17. The article of claim 12 , wherein the processor is further caused to send information concerning unrecognized memory values associated with the suspicious device driver to the reputation system.
18. The article of claim 17 , wherein the processor is further caused to send information identifying the electronic device to the reputation system.
19. The article of claim 12 , wherein evaluating whether the suspicious device driver is a malware device driver comprises comparing the distribution pattern of the suspicious device driver against a known distribution pattern, the known distribution pattern indicating a safe device driver or a malware device driver.
20. A system for detecting malware device drivers, comprising:
a processor;
a computer readable medium coupled to the processor; and
computer-executable instructions carried on the computer readable medium, the instructions readable by the processor, the instructions, when read and executed, for causing the processor to:
identify one or more device drivers loaded on an electronic device;
analyze the device drivers to determine suspicious device drivers, the suspicious device drivers unrecognized as safe, comprising:
determining that a candidate device driver is suspicious based at least on:
a determination that the candidate device driver is unsigned; and
a load order, the load order including whether a given device driver is a boot type, service order type, manually loadable, or dynamically loadable driver; and
selectively scanning specified portions of kernel memory, the specified portions known to be modified by malware device drivers;
comparing the specified portions of kernel memory against known values;
associating the specified portions of kernel memory with the candidate device driver; and
a determination that the specified portions of kernel memory associated with the candidate device driver are unrecognized;
based on the determination of the suspicious device drivers, send information about the suspicious device driver to a reputation system;
access information about the suspicious device driver from the reputation system, the reputation system configured to store information about suspicious device drivers; and
based on the determination of the suspicious device drivers, evaluate whether the suspicious device driver is a malware device driver, wherein the evaluation is based upon historical data regarding the suspicious device driver.
21. The system of claim 20 , wherein configuring the processor to analyze the device drivers to determine suspicious device drivers comprises further configuring the processor to:
examine a whitelist for a device driver; and
determining whether the device driver is suspicious based at least on a determination that the device driver is excluded from the whitelist.
22. The system of claim 20 , wherein configuring the processor to analyze the device drivers to determine suspicious device drivers comprises further configuring the processor to examine a device driver to determine whether the device driver is signed.
23. The system of claim 20 , wherein the processor is further configured to clean the electronic device of a malware device driver, wherein the evaluation is that the suspicious device driver is a malware device driver.
24. The system of claim 20 , wherein configuring the processor to clean electronic device of a malware device driver comprises configuring the monitor to repair the memory of the electronic device.
25. The system of claim 20 , wherein the processor is further configured to generate a repair driver for the electronic device, wherein the evaluation is that the suspicious device driver is a malware device driver.
26. The system of claim 20 , wherein the processor is further configured to send information concerning unrecognized memory values associated with the suspicious device driver to the reputation system.
27. The system of claim 26 , wherein the processor is further configured to send information identifying the electronic device to the reputation system.
28. The system of claim 20 , wherein evaluating whether the suspicious device driver is a malware device driver comprises comparing the distribution pattern of the suspicious device driver against a known distribution pattern, the known distribution pattern indicating a safe device driver or a malware device driver.
29. A method for detecting malware device drivers, comprising:
obtaining information about one or more device drivers loaded on an electronic device, the one or more device drivers determined to be suspicious device drivers;
accessing information about the suspicious device drivers from a reputation system, the reputation system configured to store information about suspicious device drivers; and
evaluating whether the suspicious device drivers comprise malware device drivers, including:
comparing a determined quantity of devices for which the suspicious device driver has been reported against a first upper threshold;
comparing the time range of the determined quantity of devices against a first lower threshold; and
determining that the suspicious device driver is not a malware device driver based at least on a determination that the determined quantity of devices exceeds the first upper threshold and the time range of the determined quantity of devices is less than the first lower threshold.
30. The method of claim 29 , wherein evaluating whether the suspicious device driver is a malware device driver further comprises:
determining a range of networks from which the suspicious device driver has been reported; and
based at least on a determination that the suspicious device driver has been reported from a single network, determining that the suspicious device driver is not a malware infection.
31. The method of claim 29 , wherein evaluating whether the suspicious device driver is a malware device driver further comprises:
comparing the determined quantity of devices for which the suspicious device driver has been reported against a second lower threshold;
comparing the time range of the determined quantity of devices against a second upper threshold; and
determining that the suspicious device driver is a malware device driver based at least on a determination that the determined quantity of devices is less than the second lower threshold and the time range of the determined quantity of devices exceeds the second upper threshold.
32. An article of manufacture, comprising:
a non-transitory computer readable medium; and
computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
obtain information about one or more device drivers loaded on an electronic device, the one or more device drivers determined to be suspicious device drivers;
access information about the suspicious device drivers from a reputation system, the reputation system configured to store information about suspicious device drivers; and
evaluate whether the suspicious device drivers comprise malware device drivers, comprising causing the processor to:
compare the distribution pattern of the suspicious device driver against a known distribution pattern, the known distribution pattern indicating a safe device driver or a malware device driver;
compare a determined quantity of devices for which the suspicious device driver has been reported against a first upper threshold;
compare the time range of the determined quantity of devices against a first lower threshold; and
determine that the suspicious device driver is not a malware device driver based at least on a determination that the determined quantity of devices exceeds the first upper threshold and the time range of the determined quantity of devices is less than the first lower threshold.
33. The article of claim 32 , wherein causing the processor to evaluate whether the suspicious device driver is a malware device driver further comprises causing the processor to:
determine a range of networks from which the suspicious device driver has been reported; and
based at least on a determination that the suspicious device driver has been reported from a single network, determine that the suspicious device driver is not a malware device driver.
34. The article of claim 32 , wherein causing the processor to evaluate whether the suspicious device driver is a malware device driver further comprises causing the processor to:
compare the determined quantity of devices for which the suspicious device driver has been reported against a second lower threshold;
compare the time range of the determined quantity of devices against a second upper threshold; and
determine that the suspicious device driver is a malware device driver based at least on a determination that the determined quantity of devices is less than the second lower threshold and the time range of the determined quantity of devices exceeds the second upper threshold.
35. A system for detecting malware device drivers, comprising:
a processor;
a computer readable medium coupled to the processor; and
computer-executable instructions carried on the computer readable medium, the instructions readable by the processor, the instructions, when read and executed, for causing the processor to:
obtain information about one or more device drivers loaded on an electronic device, the one or more device drivers determined to be suspicious device drivers;
access information about the suspicious device drivers from a reputation system, the reputation system configured to store information about suspicious device drivers; and
evaluate whether the suspicious device drivers comprise malware device drivers, comprising causing the processor to:
compare the distribution pattern of the suspicious device driver against a known distribution pattern, the known distribution pattern indicating a safe device driver or a malware device driver;
compare a determined quantity of devices for which the suspicious device driver has been reported against a first upper threshold;
compare the time range of the determined quantity of devices against a first lower threshold; and
determine that the suspicious device driver is not a malware device driver based at least on a determination that the determined quantity of devices exceeds the upper threshold and the time range of the determined quantity of devices is less than the lower threshold.
36. The system of claim 35 , wherein configuring the processor to evaluate whether the suspicious device driver is a malware device driver further comprises configuring the processor to:
determine a range of networks from which the suspicious device driver has been reported; and
based at least on a determination that the suspicious device driver has been reported from a single network, determine that the suspicious device driver is not a malware infection.
37. The system of claim 35 , wherein configuring the processor to evaluate whether the suspicious device driver is a malware device driver further comprises configuring the processor to:
compare the determined quantity of devices for which the suspicious device driver has been reported against a second lower threshold;
compare the time range of the determined quantity of devices against a second an upper threshold; and
determine that the suspicious device driver is a malware device driver based at least on a determination that the determined quantity of devices is less than the second lower threshold and the time range of the determined quantity of devices exceeds the second upper threshold.