Method and system for discrete stateful behavioral analysis
View Patent ↗A method for analyzing a computing system includes the steps of at a first moment in time, scanning the resources of the computing system for indications of malware, at a second moment in time scanning the resources of the computing system for indications of malware and determining the system executable objects loaded on the computing system, determining malware system changes, identifying a relationship between the malware system changes and the system executable objects loaded on the computing system, and identifying as suspected malware the system executable objects loaded on the computing system which have a relationship with the malware system changes. The malware system changes include differences between the results of scanning the resources of the computing system for indications of malware at the second and first moment of time.
1. A method for analyzing a computing system, comprising:
at a first moment in time, scanning the resources of the computing system for indications of malware;
at a second moment in time:
scanning the resources of the computing system for indications of malware; and,
determining one or more system executable objects loaded on the computing system;
determining one or more system changes, wherein the system changes comprise one or more differences between the results of scanning the resources of the computing system for indications of malware at the second moment of time and the first moment in time;
identifying a relationship between the system changes and the one or more system executable objects loaded on the computing system;
identifying as malicious the one or more system executable objects loaded on the computing system for which a relationship with the system changes has been identified.
2. The method of claim 1 , further comprising:
applying anti-virus heuristics to the computing system to scan the resources of the computing system for indications of malware;
identifying one or more differences in results of applying anti-virus heuristics to determine the one or more system changes; and
identifying the system executable objects as malicious further based upon the differences in results of applying anti-virus heuristics.
3. The method of claim 1 , further comprising:
applying memory forensics techniques to the computing system to scan the resources of the computing system for indications of malware;
identifying one or more differences in results of applying memory forensics techniques to determine the one or more system changes; and
identifying the system executable objects as malicious further based upon the differences in results of applying memory forensics techniques.
4. The method of claim 1 , further comprising:
determining a candidate executable object loaded on the computing system at the first moment in time; and,
identifying the candidate executable object as malicious based upon determining differences between the candidate executable object loaded on the computing system at the first moment in time and the one or more system executable objects loaded on the computing system at the first moment in time.
5. The method of claim 1 , further comprising, for each moment in time wherein scanning is conducted:
storing a timestamp of the scan;
storing a difference between the scanning at the moment of time and the scanning at a previous moment of time;
storing indications of the system executable objects loaded on the computing system; and
storing changes between indications of the system executable objects loaded at the moment in time and indications of the system executable objects at the previous moment in time.
6. The method of claim 1 , wherein identifying a relationship between the malware system changes and the system executable objects includes applying a behavioral analysis rule.
7. The method of claim 1 , further comprising determining the system executable objects loaded on the computing system by identifying system executable objects loaded into random access memory.
8. An article of manufacture comprising:
a non-transitory computer readable medium; and
computer-executable instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
scan resources of a computing system for indications of malware at a first time and store the results in a first digest;
scan resources of the computing system for indications of malware at a second time and store the results in a second digest;
determine a system executable object loaded on the computing system at the second time;
determine a plurality of system changes of the computing system between the second time and first time by comparing the second digest and the first digest, the system changes including differences in scanning results;
identify a relationship between the system changes and system executable object;
identify the system executable object as malicious based upon the relationship between the system changes and the system executable object.
9. The article of claim 8 , further comprising instructions for causing the processor to:
apply anti-virus heuristics to the computing system to scan the resources of the computing system for indications of malware at the first time and the second time;
identify differences in results of applying anti-virus heuristics to determine the system changes; and
identify the system executable object as malicious further based upon differences in results of applying anti-virus heuristics.
10. The article of claim 8 , further comprising instructions for causing the processor to:
apply memory forensics techniques to the computing system to scan the resources of the computing system for indications of malware at the first time and the second time;
identify differences in results of applying memory forensics techniques to determine the system changes; and
identify the system executable object as malicious further based upon the differences in results of applying memory forensics techniques.
11. The article of claim 8 , further comprising instructions for causing the processor to:
determine whether the system executable object was loaded on the computing system at the first time; and,
identify the system executable object as malicious based upon whether the system executable object is different at the second time compared to the first time.
12. The article of claim 8 , wherein instructions for causing the processor to scan resources of the computing system further comprise instructions for causing the processor to:
store a timestamp of the scan;
store a difference between the scanning at the moment of time and the scanning at a previous moment of time;
store indications of the system executable object; and
store indications of changes of the system executable object at a time of the scan as compared to the previous moment in time.
13. The article of claim 8 , wherein identifying a relationship between the malware system changes and the system executable object includes applying a behavioral analysis rule.
14. The article of claim 8 , further comprising instructions for causing the processor to determine the system executable object by identifying the system executable object as loaded into random access memory.
15. A system for malware detection, comprising:
a processor;
a non-transitory computer readable medium communicatively coupled to the processor;
a scanning module implemented by computer-executable instructions carried on the non-transitory computer readable medium for execution by the processor and configured to:
scan resources of a computing system for indications of malware at a first time and store the results in a first digest; and
scan resources of the computing system for indications of malware at a second time and store the results in a second digest; and
an analysis module implemented by computer-executable instructions carried on the non-transitory computer readable medium for execution by the processor and configured to:
determine a system executable object loaded on the computing system at the second time;
determine a plurality of system changes of the computing system between the second time and first time by comparing the second digest and the first digest, the system changes including differences in scanning results;
identify a relationship between the system changes and system executable object;
identifying the system executable object as malicious based upon the relationship between the system changes and the system executable object.
16. The system of claim 15 , wherein:
the scanning module is further configured to apply anti-virus heuristics to the computing system to scan the resources of the computing system for indications of malware at the first time and the second time; and
the analysis module is further configured to:
identify differences in results of applying anti-virus heuristics to determine the system changes; and
identify the system executable object as malicious further based upon differences in results of applying anti-virus heuristics.
17. The system of claim 15 , wherein:
the scanning module is further configured to apply memory forensics techniques to the computing system to scan the resources of the computing system for indications of malware at the first time and the second time; and
the analysis module is further configured to:
identify differences in results of applying memory forensics techniques to determine the system changes; and
identify the system executable object as malicious further based upon the differences in results of applying memory forensics techniques.
18. The system of claim 15 , wherein the analysis module is further configured to:
determine whether the system executable object was loaded on the computing system at the first time; and,
identify the system executable object as malicious based upon whether the system executable object is different at the second time compared to the first time.
19. The system of claim 15 , wherein:
the scanning module is further configured to:
store a timestamp of the scan; and
store indications of the system executable object; and
the analysis module is further configured to:
store a difference between the scanning at the moment of time and the scanning at a previous moment of time; and
store indications of changes of the system executable object at a time of the scan as compared to the previous moment in time.
20. The system of claim 15 , wherein the analysis module is further configured to identify a relationship between the malware system changes and the system executable object by applying a behavioral analysis rule.