System and method for network behavior detection
View Patent ↗Techniques for detecting malicious behavior of content or objects are described herein. According to one embodiment, a malicious content suspect is executed within a virtual machine that simulates a target operating environment associated with the malicious content suspect. A communication response object is received as a result of processing the malicious content suspect. A first behavior match result for a first sub-object of the communication response object is determined. A second behavior match result for a second sub-object of the communication response object is also determined. The first and second behavior match results are aggregated and a malicious behavior score is calculated according to the aggregated result from all matches. The malicious content suspect is classified according to the malicious behavior score.
1. A computer-implemented method for detecting malicious behavior, comprising:
processing a malicious content suspect within a virtual machine that simulates a target operating environment associated with the malicious content suspect;
receiving a communication response object as a result of processing the malicious content suspect;
parsing the communication response object into at least a first sub-object and a second sub-object;
sending the first sub-object to a first communication behavior detector in response to determining the first sub-object is a compatible input for the first communication behavior detector;
sending the second sub-object to a second communication behavior detector in response to determining the second sub-object is a compatible input for the second communication behavior detector;
determining, by the first communication behavior detector, a first behavior match result for the first sub-object of the communication response object;
determining, by the second communication behavior detector, a second behavior match result for the second sub-object of the communication response object;
aggregating the first behavior match result with the second behavior match result, wherein a malicious behavior score is calculated according to an aggregated result from all matches; and
classifying the malicious content suspect according to the malicious behavior score.
2. The method of claim 1 , wherein the first communication behavior detector determines whether information within the first sub-object matches one or more identifiers associated with malicious activity.
3. The method of claim 1 , wherein the first behavior match result is determined by comparing a behavior characteristic of the first sub-object to an identifier.
4. The method of claim 3 , wherein the identifier is one or more of:
a suspicious Dynamic Domain Name System (DDNS) identifier,
an email communication identifier, or
a network traffic pattern related to data theft.
5. The method of claim 1 , wherein the malicious behavior score is related to a probability that the communication response object indicates the malicious content suspect should be classified as malware.
6. The method of claim 1 , further comprising:
classifying the malicious content suspect as malware in response to determining the malicious behavior score reaches a predetermined threshold; and
creating, in response classifying the malicious content suspect as malware, one or more of: a malware alert notification, or a malicious fingerprint.
7. The method of claim 3 , wherein the identifier comprises one or more suspicious Dynamic Domain Name System (DDNS) identifiers.
8. The method of claim 3 , wherein the identifier comprises one or more identifiers that correspond to free Dynamic Domain Name System (DDNS) servers.
9. The method of claim 3 , wherein the identifier comprises one or more content exfiltration identifiers.
10. The method of claim 3 , wherein the one or more content exfiltration identifiers comprises at least an identifier that identifies a software product operating within the virtual machine.
11. The method of claim 3 , wherein the one or more content exfiltration identifiers comprises at least an identifier that identifies a serial number of a hardware component.
12. A computer-implemented method for detecting malicious behavior, comprising:
processing a malicious content suspect within a virtual machine that simulates a target operating environment associated with the malicious content suspect;
receiving a communication response object as a result of processing the malicious content suspect;
determining, by a communication behavior analyzer, a first behavior match result for a first sub-object of the communication response object, and a second behavior match result for a second sub-object of the communication response object;
receiving an execution response object as a result of processing the malicious content suspect;
determining, by an execution behavior analyzer, a third behavior match result for the execution response object;
aggregating the first behavior match result with the second behavior match result and the third behavior match result, wherein a malicious behavior score is calculated according to an aggregated result of at least the first behavior match result, the second behavior match result and the third behavior match result;
classifying the malicious content suspect according to the malicious behavior score.
13. A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to detect malicious behavior detection, comprising:
a communication behavior analyzer, when executed by the processor, to receive a communication response object as a result of processing of a malicious content suspect within a virtual machine, the communication behavior analyzer comprises
a parser to parse the communication response object into at least a first sub-object and a second sub-object, provide the first sub-object to a first communication behavior detector in response to determining the first sub-object is a compatible input for the first communication behavior detector, and provide the second sub-object to a second communication behavior detector in response to determining the second sub-object is a compatible input for the second communication behavior detector,
a first communication behavior detector to determine a first behavior match result for the first sub-object of the communication response object;
a second communication behavior detector to determine a second behavior match result for the second sub-object of the communication response object;
an aggregator, when executed by the processor, to aggregate the first behavior match result with the second behavior match result, wherein a malicious behavior score is calculated according to an aggregated result from all matches; and
a classifier, when executed by the processor, to classify the malicious content suspect according to the malicious behavior score.
14. The medium of claim 13 , wherein the first communication behavior detector determines whether information within the first sub-object matches one or more identifiers associated with malicious activity.
15. The medium of claim 13 , wherein the first communication behavior detector of the communication behavior analyzer to determine the first behavior match result by comparing a behavior characteristic of a sub-object to an identifier.
16. The medium of claim 15 , wherein the identifier is one or more of:
a suspicious Dynamic Domain Name System (DDNS) identifier,
an email communication identifier, or
a network traffic pattern related to data theft.
17. The medium of claim 13 , wherein the malicious behavior score is related to a probability that the communication response object indicates the malicious content suspect should be classified as malware.
18. The medium of claim 13 , further comprising:
a reporting module, when exposed by the processor to create, in response classifying the malicious content suspect as malware in response to the classifier determining that the malicious behavior score reaches a predetermined threshold, one or more of: a malware alert notification, or a malicious fingerprint.
19. A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to detect malicious behavior detection, comprising:
a communication behavior analyzer that, when executed by the processor, is configured to receive a communication response object as a result of processing of a malicious content suspect within a virtual machine, determine a first behavior match result for a first sub-object of the communication response object, and a second behavior match result for a second sub-object of the communication response object;
an execution behavior analyzer that, when executed by the processor, is configured to receive an execution response object as a result of processing the malicious content suspect and determine a third behavior match result for the execution response object;
an aggregator, when executed by the processor, to aggregate the first behavior match result with the second behavior match result and the third behavior match result, wherein a malicious behavior score is calculated according to an aggregated result from all matches; and
a classifier, when executed by the processor, to classify the malicious content suspect according to the malicious behavior score.
20. A data processing system, comprising:
a hardware processor; and
a memory coupled to the processor for storing instructions that, when executed by the processor, causes the processor to:
process a malicious content suspect within a virtual machine that simulates a target operating environment associated with the malicious content suspect;
receive a communication response object as a result of processing the malicious content suspect;
parse the communication response object into at least a first sub-object and a second sub-object;
provide the first sub-object to a first communication behavior detector in response to determining the first sub-object is a compatible input for the first communication behavior detector;
provide the second sub-object to a second communication behavior detector in response to determining the second sub-object is a compatible input for the second communication behavior detector;
determine a first behavior match result for the first sub-object of the communication response object, and a second behavior match result for a second sub-object of the communication response object;
aggregate the first behavior match result with the second behavior match result, wherein a malicious behavior score is calculated according to an aggregated result from all matches; and
classify the malicious content suspect according to the malicious behavior score.
21. The system of claim 20 , wherein each behavior match result is determined by comparing a behavior characteristic of a sub-object to an identifier.
22. The system of claim 21 , wherein the identifier is one or more of:
a suspicious Dynamic Domain Name System (DDNS) identifier,
an email communication identifier, or
a network traffic pattern related to data theft.
23. The system of claim 20 , wherein the malicious behavior score is related to a probability that the communication response object indicates the malicious content suspect should be classified as malware.
24. The system of claim 20 , wherein the memory further comprises instructions that, when executed by the processor, cause the processor to:
receive an execution response object as a result of processing the malicious content suspect;
determine a third behavior match result for the execution response object; and
aggregate the third behavior match result with the aggregated results.
25. The system of claim 20 , wherein the memory further comprises instructions that, when executed by the processor, cause the processor to:
classify the malicious content suspect as malware in response to determining the malicious behavior score reaches a predetermined threshold; and
create, in response classifying the malicious content suspect as malware, one or more of: a malware alert notification, or a malicious fingerprint.
26. A system for detecting malicious behavior, comprising:
a hardware processor;
a memory communicatively coupled to the hardware processor, the memory comprises
a communication behavior analyzer that, when executed by the processor, receives a communication response object as a result of processing of a malicious content suspect within a virtual machine, the communication behavior analyzer comprises
a parser to parse the communication response object into at least a first sub-object and a second sub-object, provide the first sub-object to a first communication behavior detector in response to determining the first sub-object is a compatible input for the first communication behavior detector, and provide the second sub-object to a second communication behavior detector in response to determining the second sub-object is a compatible input for the second communication behavior detector,
a first communication behavior detector to determine a first behavior match result for the first sub-object of the communication response object, and
a second communication behavior detector to determine a second behavior match result for the second sub-object of the communication response object;
an aggregator, when executed by the processor, to aggregate the first behavior match result with the second behavior match result, wherein a malicious behavior score is calculated according to an aggregated result from all matches; and
a classifier, when executed by the processor, to classify the malicious content suspect according to the malicious behavior score.
27. The system of claim 26 , wherein the first communication behavior detector, when executed by the processor, determines whether information within the first sub-object matches one or more identifiers associated with malicious activity.
28. The system of claim 26 , wherein the first communication behavior detector, when executed by the processor, determines the first behavior match result by comparing a behavior characteristic of a sub-object to an identifier.
29. The system of claim 28 , wherein the identifier is one or more of:
a suspicious Dynamic Domain Name System (DDNS) identifier,
an email communication identifier, or
a network traffic pattern related to data theft.
30. The system of claim 26 , wherein the malicious behavior score is related to a probability that the communication response object indicates the malicious content suspect should be classified as malware.
31. The system of claim 28 , wherein the identifier comprises one or more suspicious Dynamic Domain Name System (DDNS) identifiers.
32. The system of claim 28 , wherein the identifier comprises one or more identifiers that correspond to free Dynamic Domain Name System (DDNS) servers.
33. The system of claim 28 , wherein the identifier comprises one or more content exfiltration identifiers.
34. The system of claim 33 , wherein the one or more content exfiltration identifiers comprises at least an identifier that identifies a software product operating within the virtual machine.
35. The system of claim 33 , wherein the one or more content exfiltration identifiers comprises at least an identifier that identifies a serial number of a hardware component.