Granted Patent B2

US 9,223,963 · App. 13/898,284 · Granted Dec 29, 2015

Abstract

Claims (85)

1. A method for dynamically determining an execution environment in a system having a plurality of execution environments including a first execution environment and a second execution environment, the second execution environment being a protected execution environment, the method comprising:

performing behavioral analysis on an executable application prior to each execution of the executable application, comprising:

requesting behavioral information regarding prior performance of suspicious or out of policy activities of the executable application from a remote security database prior to each execution of the executable application; and

evaluating the behavioral information obtained responsive to the request;

determining an initial execution environment based on the behavioral analysis prior to each execution of the executable application, comprising:

determining a first portion of a single execution of the executable application for execution in the first execution environment and a second portion of the single execution for execution in the second execution environment; and

determining the initial execution environment as one of the first execution environment and the second execution environment;

loading the executable application for execution in the initial execution environment;

collecting behavioral characteristics of the executable application as it is executed within the initial execution environment; and

determining from the collected behavioral characteristics whether execution of the executable application should be moved from the initial execution environment to a secondary execution environment while the executable application is still executing in the initial execution environment,

wherein only one of the initial execution environment and the secondary execution environment is a protected execution environment.

2. The method of claim 1 , wherein performing behavioral analysis prior to execution further comprises evaluating one or more characteristics associated with the executable application that indicate an origin of the executable application.

3. The method of claim 2 , wherein performing behavioral analysis prior to execution comprises analyzing resources the executable application will utilize.

4. The method of claim 2 , wherein the one or more characteristics include one or more of the following:

network address the executable application was received from;

trust level of a process that requested the executable application; and

signed certificate from a trusted source.

5. The method of claim 1 , wherein loading the executable application for execution within the second execution environment comprises determining a scope of restrictions to apply to the second execution environment prior to execution of the executable application.

6. The method of claim 5 , wherein determining the scope of restrictions comprises determining what types of activity should be contained within the second execution environment.

7. The method of claim 5 , wherein determining the scope of restrictions comprises determining a disposition for operations performed within the second execution environment by the executable application.

8. The method of claim 1 , wherein determining from the collected behavioral characteristics comprises detecting potentially malicious activities including:

opening resource files;

loading plug-ins;

manipulation by other processes;

manipulating other processes; and

accessing the Internet.

9. The method of claim 1 , wherein determining the initial execution environment comprises applying a security policy.

10. The method of claim 1 , wherein the first portion a single execution of the executable application includes execution of:

a fiber;

a thread;

a process;

a dynamic link library;

a script; or

a plug-in component.

11. A system comprising:

a computer comprising one or more processors wherein the one or more processors are configured to:

perform behavioral analysis on an executable application prior to each execution of the executable application, comprising:

requesting behavioral information regarding prior performance of suspicious or out of policy activities of the executable application from a remote security database prior to each execution of the executable application; and

evaluating the behavioral information obtained responsive to the request;

determine an initial execution environment based on the behavioral analysis prior to each execution of the executable application, comprising:

determining a first portion of a single execution of the executable application for execution in a first execution environment and a second portion of the single execution for execution in a second execution environment; and

determining the initial execution environment as one of the first execution environment and the second execution environment;

load the executable application for execution in the initial execution environment;

collect behavioral characteristics of the executable application as it is executed in the initial execution environment; and

determine from the collected behavioral characteristics whether execution of the executable application should be moved from the initial execution environment to a secondary execution environment while the executable application is still executing in the initial execution environment,

wherein only one of the initial execution environment and the secondary execution environment is a protected execution environment.

12. The system of claim 11 , wherein the one or more processors configured to perform behavioral analysis are further configured to evaluate a characteristic associated with the executable application, wherein the characteristic indicates whether the provider of the executable application can be trusted.

13. The system of claim 12 , wherein the one or more processors configured to perform behavioral analysis are further configured to evaluate a plurality of characteristics including two or more of the following:

network address the executable application was received from;

trust level of the process that requested the executable application;

signed certificate from a trusted source.

14. The system of claim 11 , wherein the one or more processors configured to perform behavioral analysis are further configured to analyze, prior to execution of the executable application, a resource the executable application will utilize if executed.

15. The system of claim 11 , wherein the one or more processors configured to perform behavioral analysis are further configured to determine a scope of restrictions a protected execution environment will use to control the execution of the executable application.

16. The system of claim 15 , wherein the one or more processors configured to perform behavioral analysis are further configured to determine what types of activity should be contained within the protected execution environment.

17. The system of claim 15 , wherein the one or more processors configured to perform behavioral analysis are further configured to apply a security policy when determining the scope of restrictions for use by the protected execution environment.

18. The system of claim 15 , wherein the one or more processors configured to perform behavioral analysis are further configured to determine a disposition for operations performed within the protected execution environment by the executable application.

19. The system of claim 11 , wherein the one or more processors configured to perform behavioral analysis are further configured to detect potentially malicious activities, including:

opening resource files;

loading plug-ins;

manipulation by other processes;

manipulating other processes; and

accessing the Internet.

20. The system of claim 11 , wherein the one or more processors configured to perform behavioral analysis are further configured to apply a security policy when evaluating a plurality of behavioral characteristics of the executable application to determine whether the initial execution environment should be a protected execution environment.

21. The system of claim 11 , wherein the portion of the single execution of the executable application includes execution of:

a fiber;

a thread;

a process;

a dynamic link library;

a script; or

a plug-in component.

22. A non-transitory computer-readable storage medium comprising instructions stored thereon that when executed cause one or more processors to:

perform behavioral analysis on an executable application prior to each execution of the executable application, comprising:

requesting behavioral information regarding prior performance of suspicious or out of policy activities of the executable application from a remote security database prior to each execution of the executable application; and

evaluating the behavioral information obtained responsive to the request;

determine an initial execution environment based on the behavioral analysis prior to each execution of the executable application, comprising instructions that when executed cause the one or more processors to:

determine a first portion of a single execution of the executable application for execution in a first execution environment and a second portion of the single execution for execution in a second execution environment; and

determine the initial execution environment as one of the first execution environment and the second execution environment;

load the executable application for execution in the initial execution environment;

collect behavioral characteristics of the executable application as it is executed in the initial execution environment; and

determine from the collected behavioral characteristics whether execution of the executable application should be moved from the initial execution environment to a secondary execution environment while the executable application is still executing in the initial execution environment,

wherein only one of the initial execution environment and the secondary execution environment is a protected execution environment.

23. The non-transitory computer-readable storage medium of claim 22 , further comprising instructions stored thereon to cause one or more processors to:

monitor second behavioral characteristics of the executable application during execution within the secondary execution environment after the executable application is moved from the initial execution environment;

perform behavioral analysis on the monitored second behavioral characteristics to determine whether the executable application should be moved from the secondary execution environment back to the initial execution environment; and

move, based on the behavioral analysis of the monitored second behavioral characteristics, the executable application from the secondary execution environment to the initial execution environment prior to termination of the execution in the secondary execution environment.

Assignments (9)