System and method for malware containment
View Patent ↗Systems and methods for malware containment on connection is provided. In exemplary embodiments, digital devices are quarantined for a predetermined period of time upon connection to the communication network. When a digital device is quarantined, all network data transmitted by the digital device is temporarily directed to a controller which then analyzes the network data to identify unauthorized activity and/or malware within the newly connected digital device. An exemplary method to contain malware comprises detecting a digital device upon connection with a communication network, temporarily redirecting network data from the digital device, and analyzing the network data to identify malware within the digital device.
1. A malware containment method comprising:
redirecting network data received over a communication network via a virtual switch to a virtual machine, the virtual machine being configured to simulate functionality of a digital device; and
analyzing of the redirected network data including analyzing a response of the virtual machine to processing of the network data within the virtual machine to identify a malware attack;
continuing to redirect the network data for processing by the virtual machine until expiration of a predetermined period of time without detection of malware; and
continuing to redirect the network data for processing by the virtual machine beyond the predetermined period of time when malware is detected.
2. The method of claim 1 , wherein the analyzing of the redirected network data further comprises determining if a digital device that transmitted the network data over the communication network is associated with a white list, and halting the redirecting if the digital device is determined to be associated with the white list.
3. The method of claim 1 , wherein the analyzing of the redirected network data further comprises comparing some or all of the redirected network data with an unauthorized activity signature to detect the malware attack.
4. The method of claim 1 , further comprising generating an unauthorized activity signature based on a detection of the malware.
5. The method of claim 4 , further comprising:
storing the unauthorized activity signature; and
sending the unauthorized activity signature to another digital device.
6. The method of claim 4 , wherein the unauthorized activity signature is used to subsequently identify the malware and mitigate vulnerabilities including changing a setting in a browser application or an operating system.
7. The method of claim 1 , wherein the analyzing of the redirected network data comprises:
analyzing the redirected network data with a heuristic to identify the network data has a prescribed likelihood of including malware and to use metadata associated with the network data to configure the virtual machine.
8. The method of claim 1 further comprising sending information to a client associated with the digital device to remove the malware.
9. A system comprising:
a processor; and
a memory coupled to the processor, the memory comprises instructions that,
when executed by the processor, redirects a first portion of network data that exceeds a threshold used to identify whether the first portion of network data is suspicious to a virtual machine, and
analyzes the redirected first portion of network data by at least analyzing a response of the virtual machine processing the first portion of network data to identify a malware attack, wherein
a second portion of network data subsequently received after the first portion of network data continues to be redirected to the virtual machine for processing by the virtual machine until expiration of a predetermined period of time without detection of malware; and
the second portion continues to be redirected to the virtual machine for processing beyond the predetermined period of time when malware is detected.
10. The system of claim 9 , wherein the first portion of network data and the second portion of network data are part of a data flow.
11. The system of claim 10 , wherein the memory further comprises a policy engine that, when executed by the processor, analyzes the redirected first portion of network data by at least determining if a digital device that transmitted the first portion of the network data is associated with a white list.
12. The system of claim 10 , wherein the memory further comprises a policy engine that, when executed by the processor, analyzes the redirected first portion of network data by at least comparing some or all of the redirected first portion of network data with an unauthorized activity signature to detect malware.
13. The system of claim 9 , wherein the memory further comprises a scheduler that, when executed by the processor, configures the virtual machine based on metadata associated with the redirected first portion of network data.
14. The system of claim 9 , wherein the memory further comprising a signature module that, when executed by the processor, generates or stores an unauthorized activity signature based on a detection of the malware.
15. The system of claim 12 , wherein the policy engine uses an unauthorized activity signature to subsequently identify malware associated with another malware attack without virtual execution of the malware associated with another malware attack.
16. A non-transitory machine readable medium having embodied thereon executable code, the executable code being executable by a processor for performing a malware containment method, the method comprising:
redirecting network data received over a communication network via a virtual switch to a virtual machine, the virtual machine being configured to simulate functionality of a digital device; and
analyzing of the redirected network data during the predetermined period of time to detect a malware attack, the analysis of the redirected network data including analyzing a response of the virtual machine during processing of the network data within the virtual machine;
generating an unauthorized activity signature directed to detected malware associated with the malware attack,
wherein the redirecting of the network data (i) continues until expiration of the predetermined period of time without detection of malware and (ii) continues after the predetermined period of time expires when the malware is detected during the predetermined period of time.
17. The non-transitory machine readable medium of claim 16 , wherein the unauthorized activity signature is further used to alter at least one setting in one of an application or an operating system that is susceptible to the malware.
18. The non-transitory machine readable medium of claim 17 , wherein the altered setting includes a setting in a browser application.