Backwards researching activity indicative of pestware
A system and method for researching an identity of a source of activity that is indicative of pestware is described. In one embodiment the method comprises monitoring, using a kernel-mode driver, API call activity on the computer; storing information related to the API call activity in a log; analyzing, heuristically, the API call activity to determine whether one or more weighted factors associated with the API call activity exceeds a threshold; identifying, based upon the API call activity, a suspected pestware object on the computer; identifying, in response to the identifying the suspected pestware object, a reference to an identity of an externally networked source of the suspected pestware object; and reporting the identity of the externally networked source to an externally networked pestware research entity.
1. A method for identifying an origin of activity on a computer that is indicative of pestware comprising:
monitoring, using a kernel-mode driver, API call activity on the computer;
storing information related to the API call activity in a log;
analyzing, heuristically, the API call activity to determine whether one or more weighted factors associated with the API call activity exceeds a threshold;
identifying, based upon the API call activity, a suspected pestware object on the computer;
identifying, in response to the identifying the suspected pestware object, a reference to an identity of an externally networked source of the suspected pestware object; and
reporting the identity of the externally networked source to an externally networked pestware research entity, wherein
the identity of the externally networked source is selected from a group consisting of an I.P. address, a URL, an email client and a program.
2. The method of claim 1 , wherein the identifying the suspected pestware object includes accessing an activity log that includes information that relates the activity to the suspected pestware object.
3. The method of claim 1 , wherein the identifying a reference includes accessing at least a portion of a recorded history of externally networked sources.
4. The method of claim 3 , wherein the recorded history resides in at least one log selected from the group consisting of an activity log, a browser history, browser cache, browser settings, operating system settings, an event log, a debugging log, a firewall log, file information and monitoring software logs.
5. A system for identifying a source of activity on a computer that is indicative of pestware including:
a kernel-level monitor configured to monitor API call activity on the computer and to store information related to the API call activity in a log;
a heuristics module configured to analyze the API call activity to determine whether one or more weighted factors associated with the API call activity exceeds a threshold;
a research portion configured to identify, in response to a prompt from the heuristics module, a suspected pestware object on the computer; and
a reporting portion configured to generate a report including a reference to an identity of an externally networked source of the suspected pestware object and to report the identity of the externally networked source to an externally networked pestware research entity, wherein
the kernel-level monitor is configured to store information about a relationship between at least one API call of the API call activity and a file.
6. The system of claim 5 , wherein the information comprises an identity of at least one process that made at least one API call in the log.
7. The system of claim 5 , wherein the heuristics module is configured to receive information about the API call activity from the kernel-level monitor and to determine whether the API call activity is indicative of pestware.
8. The system of claim 5 , wherein the kernel-level monitor is configured to intercept at least one API call.
9. The system of claim 5 , wherein the identity of the externally networked source is selected from the group consisting of an I.P. address, a URL, an email client and a program name.
10. The system of claim 5 , wherein the research portion is configured to access at least a portion of a recorded history of externally networked sources.
11. The system of claim 10 , wherein the recorded history resides in at least one log selected from the group consisting of an activity log, a browser history, browser cache, browser settings, operating system settings, an event log, a debugging log, a firewall log, file information and monitoring software logs.
12. A non-transitory computer-readable medium including processor-executable instructions for identifying an origin of activity on a computer that is indicative of pestware, the instructions including instructions for:
monitoring, using a kernel-mode driver, API call activity on the computer;
storing information related to the API call activity in a log;
analyzing, heuristically, the API call activity to determine whether one or more weighted factors associated with the API call activity exceeds a threshold;
identifying, based upon the API call activity, a suspected pestware object on the computer;
identifying, in response to the identifying the suspected pestware object, a reference to an identity of an externally networked source of the suspected pestware object; and
reporting the identity of the externally networked source to an externally networked pestware research entity, wherein
the identity of the externally networked source is selected by an identifier selected from a group consisting of an I.P. address, a URL, an email client and a program.
13. The non-transitory computer-readable medium of claim 12 , wherein the instructions for identifying the suspected pestware object include instructions for accessing an activity log that includes information that relates the activity to the suspected pestware object.
14. The non-transitory computer-readable medium of claim 12 , wherein the instructions for identifying a reference include instructions for accessing at least a portion of a recorded history of externally networked sources.
15. The non-transitory computer-readable medium of claim 14 , wherein the recorded history resides in at least one log selected from the group consisting of an activity log, a browser history, browser cache, browser settings, operating system settings, an event log, a debugging log, a firewall log, file information and monitoring software logs.