Detecting addition of a file to a computer system and initiating remote analysis of the file for malware
In certain embodiments, a computer system includes a memory unit and a processing unit. The processing unit executes a monitoring module stored on the computer system. The monitoring module monitors the computer system for addition of a file to the computer system and detects an addition of a file to the computer system. The monitoring module accesses policies to determine whether to communicate information associated with the detected addition of the file over a communication network to a remote malware analysis system to initiate a possible malware analysis of the file by the remote malware analysis system. The monitoring module initiates, in response to determining to communicate information associated with the detected addition of the file, communication over the communication network of information associated with the detected addition of the file to the remote malware analysis system, the remote malware analysis system operable to analyze the file for malware.
1. A computer system, comprising:
a host user system comprising:
a first memory; and
a first processor operable to monitor the host user system, the first processor further arranged to:
monitor the host user system for addition of a file to the host user system;
detect the addition of a file to the host user system;
access one or more policies to determine whether to communicate information associated with the detected addition of the file over a communication network to initiate a possible malware analysis of the file;
initiate, in response to determining to communicate the information associated with the detected addition of the file over the communication network, a communication over the communication network of the information associated with the detected addition of the file to an intermediary; and
the intermediary, disposed separate to the host user system, the intermediary, comprising:
a second memory; and
a second processor arranged:
to coordinate monitoring the host user system and the malware analysis and to receive the information associated with the detected addition of the file at the host user system prior to forwarding the information to a remote malware analysis system;
the intermediary further arranged to access the one or more policies to determine whether to communicate, over the communication network, the information associated with the detected addition of the file received from the host user system to the remote malware analysis system to initiate the malware analysis of the file by the remote malware analysis system and to determine, based on the one or more policies, what information associated with the detected addition of the file to communicate over the communication network to the remote malware analysis system;
wherein the information comprises one or more of the following:
identification information for the host user system;
identification of a manner in which the file was attempted to be added to the host user system; and
timestamp information.
2. The computer system of claim 1 , wherein:
the first processor monitors the host user system for the addition of the file to the host user system by monitoring the host user system for from a removable media storage device to the host user system and monitors the addition of the file to the host user system by detecting the addition of the file from the removable media storage device to the host user system.
3. The computer system of claim 2 , wherein the removable media storage device comprises one or more of:
a flash storage device;
a optical media storage device; and
a magnetic media storage device.
4. The computer system of claim 1 , wherein:
the first processor monitors the host user system for the addition of the file to the host user system by monitoring the user system for the addition of the file to the host user system via a network connection and detects the addition of the file to the host user system by detecting a transfer to the host user system of the file via the network connection.
5. The computer system of claim 1 , wherein:
the first processor monitors the host user system for the addition of the file to the host user system comprises monitoring the host user system for the addition of the file from a web-based electronic mail service to the host user system and detects the addition of the file to the host user system by detecting a transfer of the file from the web-based electronic mail service to the host user system.
6. The computer system of claim 5 , wherein the web-based electronic mail service comprises one or more of:
WINDOWS LIVE™ HOTMAIL® service;
YAHOO! MAIL service;
GMAIL™ service; and
MOBILEME® service.
7. The computer system of claim 5 , wherein:
the file comprises an attachment to an email accessed using the web-based electronic mail service;
the first processor monitoring the host user system for the addition of the file from a web-based electronic mail service to the host user system by monitoring the host user system for a download of the attachment from the web-based electronic mail service to the host user system and detecting the addition of the file from the web-based electronic mail service to the host user system by detecting the transfer of the attachment from the web-based electronic mail service to the host user system.
8. The computer system of claim 1 , wherein the first processor is operable to initiate communication over the communication network of the information associated with the detected addition of the file by invoking a web service call to the remote malware analysis system.
9. A non-transitory computer-readable medium comprising instructions that when executed by one or more processors operable to perform operations comprising:
monitoring, by a first processor of a host user system, a user system for addition of a file to the user system;
detecting, by the first processor of the host user system, the addition of the file to the user system;
accessing, by the first processor of the host user system, one or more policies to determine whether to communicate information associated with the detected addition of the file over a communication network to an intermediary to initiate a possible malware analysis of the file by the intermediary;
initiating by the processor of the intermediary, in response to determining to communicate the information associated with the detected addition of the file over the communication network to the intermediary, a communication over the communication network of the information associated with the detected addition of the file to the intermediary;
coordinating, by the processor of the intermediary, monitoring the user system and the malware analysis and receiving, by the second processor, the information associated with the detected addition of the file at the user system prior to being forwarded to a remote malware analysis system;
accessing the one or more policies by the processor of the intermediary to determine whether to communicate, over the communication network, the information associated with the detected addition of the file received from the host user system to the remote malware analysis system to initiate the malware analysis of the file by the remote malware analysis system; and
determining by the processor of the intermediary, based on the one or more policies, what information associated with the detected addition of the file to communicate over the communication network to the remote malware analysis system;
wherein the information comprises one or more of the following:
identification information for the host user system;
identification of a manner in which the file was attempted to be added to the host user system; and
timestamp information.
10. The non-transitory computer-readable medium of claim 9 , wherein:
the processor of the host user system monitors the host user system for the addition of the file to the host user system by monitoring the host user system for the addition of the file from a removable media storage device to the host user system and monitors an the addition of the file to the host user system by detecting an the addition of the file from the removable media storage device to the host user system.
11. The non-transitory computer-readable medium of claim 10 , wherein the removable media storage device comprises one or more of:
a flash storage device;
a optical media storage device; and
a magnetic media storage device.
12. The non-transitory computer-readable medium of claim 9 , wherein:
the processor of the host user system monitors the host user system for the addition of the file to the host user system by monitoring the user system for the addition of the file to the host user system via a network connection and detects the addition of the file to the host user system by detecting a transfer to the host user system of the file via the network connection.
13. The non-transitory computer-readable medium of claim 9 , wherein:
the processor of the host user system monitors the host user system for the addition of the file to the host user system comprises monitoring the host user system for the addition of the file from a web-based electronic mail service to the host user system and detects the addition of the file to the host user system by detecting a transfer of the file from the web-based electronic mail service to the host user system.
14. The non-transitory computer-readable medium of claim 13 , wherein the web-based electronic mail service comprises one or more of:
WINDOWS LIVE™ HOTMAIL® service;
YAHOO! MAIL service;
GMAIL™ service; and
MOBILEME® service.
15. The non-transitory computer-readable medium of claim 13 , wherein:
the file comprises an attachment to an email accessed using the web-based electronic mail service;
the processor of the host user system monitoring the host user system for the addition of the file from a web-based electronic mail service to the host user system by monitoring the host user system for a download of the attachment from the web-based electronic mail service to the host user system and detecting the addition of the file from the web-based electronic mail service to the host user system by detecting the transfer of the attachment from the web-based electronic mail service to the host user system.
16. The non-transitory computer-readable medium of claim 9 , further comprising initiating communication over the communication network by the second processor of information associated with the detected addition of the file by invoking a web service call to the malware analysis system.
17. A computer-implemented method, comprising:
monitoring, by a first processor of a host user system, a host user system for addition of a file to the host user system;
detecting, by the first processor of the host user system, the addition of the file to the host user system;
accessing, by the first processor of the host user system, one or more policies to determine whether to communicate the information associated with the detected addition of the file over a communication network to an intermediary to initiate a possible malware analysis of the file by a remote malware analysis system;
initiating by the first processor of the host user system, in response to determining to communicate the information associated with the detected addition of the file over the communication network to the intermediary, a communication over the communication network of the information associated with the detected addition of the file to the intermediary;
coordinating, by a second processor of the intermediary, monitoring the host user system and receiving, by the second processor of the intermediary, the information associated with the detected addition of the file at the host user system prior to being forwarded to a remote malware analysis system;
accessing the one or more policies by the second processor of the intermediary to determine whether to communicate, over the communication network, the information associated with the detected addition of the file received from the host user system to the remote malware analysis system to initiate the malware analysis of the file by the remote malware analysis system; and
determining by the second processor of the intermediary, based on the one or more policies, what information associated with the detected addition of the file to communicate over the communication network to the remote malware analysis system;
wherein the information comprises one or more of the following:
identification information for the host user system;
identification of a manner in which the file was attempted to be added to the host user system; and
timestamp information.