Structural recognition of malicious code patterns
View Patent ↗Various embodiments include an apparatus comprising a detection database including a tree structure of descriptor parts including one or more root nodes and one or more child nodes linked to from one or more parent descriptor parts chains, each of the root nodes representing a descriptor part, and each root node linked to at least one of the child nodes, each root node and each child node linked to any possible additional child nodes, wherein the possible additional child nodes include any possible successor child nodes and a descriptor comparator coupled to the detection database, the descriptor comparator operable to receive data including a plurality of logic entities, once or successively, and to continuously compare logic entities provided to the tree structure of descriptor parts stored in detection database, and to provide an output based on the comparison.
1. A non-transitory machine readable medium, on which are stored instructions, comprising instructions that when executed cause a machine to:
receive a file possibly containing malware; identify a logic entity in the file;
compare a chain of logic entities beginning with the logic entity to a path through a tree structure of structural code pattern descriptors, comprising instructions that when executed cause the machine to:
match the logic entity to a root node of the tree structure; and
match succeeding logic entities of the file with the path through the tree structure of structural code pattern descriptors from the root node to a terminal child node of the path; and
indicate the file contains malware responsive to matching the chain of logic entities to the path,
wherein each of the logic entities is:
a process flow statement:
a call to application programming interface call or a user-defined function: a definition or modification of a variable:
one or more variables passed with a call to an application programming interface or function: or
a boundary between two logically separated code blocks.
2. The non-transitory machine readable medium of claim 1 , wherein the instructions further comprise instructions that when executed cause the machine to:
compare a plurality of chains of logic entities to a plurality of paths through the tree structure of structural code pattern descriptors;
assign a match probability to each of the plurality of paths; and compare an overall match probability for the file based on the match probabilities assigned to each of the plurality of paths.
3. The non-transitory machine readable medium of claim 1 , wherein the instructions that when executed cause the machine to indicate the file contains malware comprise instructions that when executed cause the machine to:
output a single bit having a bit value indicative of whether or not malware has been detected in the received file based on whether any part of the chain of logic entities matches a path through the tree structure.
4. The non-transitory machine readable medium of claim 1 , wherein the instructions that when executed cause the machine to indicate the file contains malware comprise instructions that when executed cause the machine to:
output a malware name that can be assigned to an input file and represents a type or family of detected malicious code.
5. The non-transitory machine readable medium of claim 1 , wherein the instructions that when executed cause the machine to compare a chain of logic entities beginning with the logic entity to a path through a tree structure of structural code pattern descriptors further comprises instructions that when executed cause the machine to:
determine that the logic entity and succeeding logic entities of the file match a plurality of paths through the tree structure; and
determine which of the plurality of paths has a highest match probability.
6. The non-transitory machine readable medium of claim 1 , wherein the instructions that when executed cause the machine to compare a chain of logic entities beginning with the logic entity to a path through a tree structure of structural code pattern descriptors further comprises instructions that when executed cause the machine to:
terminate the comparison upon reaching a terminal child node in the path through the tree structure.
7. The non-transitory machine readable medium of claim 1 , wherein the instructions that when executed cause the machine to compare the chain of logic entities beginning with the logic entity to a path through a tree structure of structural code pattern descriptors further comprises instructions that when executed cause the machine to:
begin the comparison upon receiving a portion of the file; and continue to receive the file during the comparison.
8. A programmable device, comprising: one or more processors;
a memory, on which are stored instructions, comprising instructions that when executed cause at least some of the one or more processors to: receive a file possibly containing malware; identify a logic entity in the file;
compare a chain of logic entities beginning with the logic entity to a path through a tree structure of structural code pattern descriptors, comprising instructions that when executed cause at least some of the one or more processors to:
match the logic entity to a root node of the tree structure; and match succeeding logic entities of the file with the path through the tree structure of structural code pattern descriptors from the root node to a terminal child node of the path; and
indicate the file contains malware responsive to matching the chain of logic entities to the path,
wherein each of the logic entities is:
a process flow statement:
a call to application programming interface call or a user-defined function; a definition or modification of a variable;
one or more variables passed with a call to an application programming interface or function: or
a boundary between two logically separated code blocks.
9. The programmable device of claim 8 , wherein the instructions further comprise instructions that when executed cause at least some of the processors to:
compare a plurality of chains of logic entities to a plurality of paths through the tree structure of structural code pattern descriptors;
assign a match probability to each of the plurality of paths; and compare an overall match probability for the file based on the match probabilities assigned to each of the plurality of paths.
10. The programmable device of claim 9 , wherein the instructions that when executed cause at least some of the processors to indicate the file contains malware comprise instructions that when executed cause at least some of the processors to:
output a single bit having a bit value indicative of whether or not malware has been detected in the received file based on whether any part of the chain of logic entities matches a path through the tree structure.
11. The programmable device of claim 9 , wherein the instructions that when executed cause at least some of the processors to indicate the file contains malware comprise instructions that when executed cause at least some of the processors to:
output a malware name that can be assigned to an input file and represents a type or family of detected malicious code.
12. The programmable device of claim 9 , wherein the instructions that when executed cause at least some of the processors to compare a chain of logic entities beginning with the logic entity to a path through a tree structure of structural code pattern descriptors further comprises instructions that when executed cause at least some of the processors to:
determine that the logic entity and succeeding logic entities of the file match a plurality of paths through the tree structure; and
determine which of the plurality of paths has a highest match probability.
13. The programmable device of claim 9 , wherein the instructions that when executed cause at least some of the processors to compare a chain of logic entities beginning with the logic entity to a path through a tree structure of structural code pattern descriptors further comprises instructions that when executed cause at least some of the processors to:
terminate the comparison upon reaching a terminal child node in the path through the tree structure.
14. The programmable device of claim 9 , wherein the instructions that when executed cause at least some of the processors to compare the chain of logic entities beginning with the logic entity to a path through a tree structure of structural code pattern descriptors further comprises instructions that when executed cause at least some of the processors to:
begin the comparison upon receiving a portion of the file; and continue to receive the file during the comparison.
15. A method for detecting malware, comprising:
receiving by a programmable device a file possibly containing malware;
identifying by the programmable device a logic entity in the file;
comparing by the programmable device a chain of logic entities beginning with the logic entity to a path through a tree structure of structural code pattern descriptors, comprising:
matching the logic entity to a root node of the tree structure; and
matching succeeding logic entities of the file with the path through the tree structure of structural code pattern descriptors from the root node to a terminal child node of the path; and
indicating by the programmable device the file contains malware responsive to matching the chain of logic entities to the path,
wherein each of the logic entities is:
a process flow statement;
a call to application programming interface call or a user-defined function; a definition or modification of a variable;
one or more variables passed with a call to an application programming interface or function; or
a boundary between two logically separated code blocks.
16. The method of claim 15 , further comprising:
comparing a plurality of chains of logic entities to a plurality of paths through the tree structure of structural code pattern descriptors;
assigning a match probability to each of the plurality of paths; and comparing an overall match probability for the file based on the match probabilities assigned to each of the plurality of paths.
17. The method of claim 15 , wherein indicating the file contains malware comprises:
outputting a single bit having a bit value indicative of whether or not malware has been detected in the received file based on whether any part of the chain of logic entities matches a path through the tree structure.
18. The method of claim 15 , wherein indicating the file contains malware comprises:
outputting a malware name that can be assigned to an input file and represents a type or family of detected malicious code.
19. The method of claim 15 , wherein comparing a chain of logic entities beginning with the logic entity to a path through a tree structure of structural code pattern descriptors further comprises:
determining that the logic entity and succeeding logic entities of the file match a plurality of paths through the tree structure; and
determining which of the plurality of paths has a highest match probability.
20. The method of claim 15 , wherein comparing a chain of logic entities beginning with the logic entity to a path through a tree structure of structural code pattern descriptors further comprises:
terminating the comparison upon reaching a terminal child node in the path through the tree structure.