Automated classification of exploits based on runtime environmental features
Various approaches are described herein for the automated classification of exploit(s) based on snapshots of runtime environmental features of a computing process in which the exploit(s) are attempted. The foregoing is achieved with a server and local station(s). Each local station is configured to neutralize operation of malicious code being executed thereon, obtain snapshot(s) indicating the state thereof at the time of the exploitation attempt, and perform a classification process using the snapshot(s). The snapshot(s) are analyzed with respect to a local classification model maintained by the local station to find a classification of the exploit therein. If a classification is found, an informed decision is made as to how to handle the classified exploit. If a classification is not found, the snapshot(s) are provided to the server for classification thereby. The server provides an updated classification model containing a classification for the exploit to the local station(s).
1. A method performed by a computing device, comprising:
injecting a protection component into a computing process at creation of the computing process;
determining, by the protection component, that code is malicious based on the code accessing a predetermined resource;
subsequent to said determining, halting execution of the malicious code, the malicious code being injected into the computing process;
obtaining a snapshot of at least the computing process in response to halting execution of the malicious code;
performing a classification process using the snapshot to classify an exploit attempted by the malicious code to obtain a classification of the exploit; and
handling the exploit based on the obtained classification.
2. The method of claim 1 , wherein said performing the classification process comprises:
analyzing the snapshot with respect to a first classification model stored on the computing device;
determining whether a classification for the exploit is found in the first classification model; and
in response to determining that the classification is not found, providing the snapshot to a second computing device configured to analyze the snapshot for classification of the exploit.
3. The method of claim 2 , further comprising:
in response to determining that the classification is not found, classifying the exploit as a zero-day exploit.
4. The method of claim 2 , further comprising:
in response to determining that the classification is not found, obtaining an update for the first classification model from the second computing device that includes the classification for the exploit, the classification for the exploit being the classification obtained by said performing.
5. The method of claim 1 , said handling comprising:
performing at least one of the following based on the obtained classification:
terminating execution of the computing process;
restarting the computing process; and
isolating the malicious code.
6. The method of claim 1 , said obtaining a snapshot comprising:
obtaining a snapshot of at least the computing process and an operating system executing on the computing device in response to halting execution of the malicious code.
7. The method of claim 1 , wherein the snapshot comprises at least one of the following data items:
register values at a time of said halting;
a number of sequential calls from a particular library module that occurred prior to said halting;
a listing of library modules loaded at the time of said halting;
a listing of file handles opened at the time of said halting; and
at least a partial memory dump at the time of said halting.
8. A computing device, comprising:
one or more processing units; and
a memory coupled to the one or more processing units, the memory storing instructions, which, when executed by the one or more processing units, are configured to perform operations, the operations comprising:
injecting a protection component into a computing process at creation of the computing process;
determining, by the protection component, that code is malicious based on the code accessing a predetermined resource;
subsequent to said determining, halting execution of the malicious code, the malicious code being injected into the computing process;
obtaining a snapshot of at least the computing process in response to halting execution of the malicious code;
performing a classification process using the snapshot to classify an exploit attempted by the malicious code to obtain a classification of the exploit; and
handling the exploit based on the obtained classification.
9. The computing device of claim 8 , wherein said performing the classification process comprises:
analyzing the snapshot with respect to a first classification model stored on the computing device;
determining whether a classification for the exploit is found in the first classification model; and
in response to determining that the classification is not found, providing the snapshot to a second computing device configured to analyze the snapshot for classification of the exploit.
10. The computing device of claim 9 , the operations further comprising:
in response to determining that the classification is not found, classifying the exploit as a zero-day exploit.
11. The computing device of claim 9 , the operations further comprising:
in response to determining that the classification is not found, obtaining an update for the first classification model from the second computing device that includes the classification for the exploit, the classification for the exploit being the classification obtained by said performing.
12. The computing device of claim 8 , said handling comprising:
performing at least one of the following based on the obtained classification:
terminating execution of the computing process;
restarting the computing process; and
isolating the malicious code.
13. The computing device of claim 8 , said obtaining a snapshot comprising:
obtaining a snapshot of at least the computing process and an operating system executing on the computing device in response to halting execution of the malicious code.
14. The computing device of claim 8 , wherein the snapshot comprises at least one of the following data items:
register values at a time of said halting;
a number of sequential calls from a particular library module that occurred prior to said halting;
a listing of library modules loaded at the time of said halting;
a listing of file handles opened at the time of said halting; and
at least a partial memory dump at the time of said halting.
15. A non-transitory computer-readable storage medium having program instructions recorded thereon that, when executed by a processor of a computing device, perform a method for handling an exploit attempted by malicious code, the method comprising:
injecting a protection component into a computing process at creation of the computing process;
determining, by the protection component, that code is malicious based on the code accessing a predetermined resource;
subsequent to said determining, halting execution of the malicious code, the malicious code being injected into the computing process;
obtaining a snapshot of at least the computing process in response to halting execution of the malicious code;
performing a classification process using the snapshot to classify an exploit attempted by the malicious code to obtain a classification of the exploit; and
handling the exploit based on the obtained classification.
16. The non-transitory computer-readable storage medium of claim 15 , wherein said performing the classification process comprises:
analyzing the snapshot with respect to a first classification model stored on the computing device;
determining whether a classification for the exploit is found in the first classification model; and
in response to determining that the classification is not found, providing the snapshot to a second computing device configured to analyze the snapshot for classification of the exploit.
17. The non-transitory computer-readable storage medium of claim 16 , the method further comprising:
in response to determining that the classification is not found, classifying the exploit as a zero-day exploit.
18. The non-transitory computer-readable storage medium of claim 16 , the method further comprising:
in response to determining that the classification is not found, obtaining an update for the first classification model from the second computing device that includes the classification for the exploit, the classification for the exploit being the classification obtained by said performing.
19. The non-transitory computer-readable storage medium of claim 15 , said handling comprising:
performing at least one of the following based on the obtained classification:
terminating execution of the computing process;
restarting the computing process; and
isolating the malicious code.
20. The non-transitory computer-readable storage medium of claim 15 , said obtaining a snapshot comprising:
obtaining a snapshot of at least the computing process and an operating system executing on the computing device in response to halting execution of the malicious code.