Detection of malware-usable clean file
There are provided measures for enabling the detection of a malware-usable clean file or, stated differently, the detection of malware using a clean file. Such measures could exemplarily include identifying a vulnerable clean file in a computer system, which does not constitute malware but is vulnerable for usage by malware, checking the vulnerable clean file for its threat of usage by malware, and detecting the vulnerable clean file as malware-usable clean file on the basis of a result of said checking of its threat of usage by malware.
1. A method of preventing clean files being used by malware, comprising
identifying a vulnerable clean file in a computer system, which does not constitute malware but is vulnerable for usage by malware by verifying presence and/or registration of a device associated with the vulnerable clean file in the computer system;
checking the vulnerable clean file for its threat of usage by malware;
detecting the vulnerable clean file as malware-usable clean file as a result of detecting that no device associated with the vulnerable clean file is recognized in the computer system based on the presence and/or registration verification of the device associated with the vulnerable clean file; and
preventing the detected malware-usable clean file from being used by malware.
2. The method according to claim 1 , said checking further comprising:
verifying reputation information of the vulnerable clean file, wherein
said checking results in a high threat of usage by malware when information indicative of a bad and/or malicious reputation is recognized.
3. The method according to claim 1 :
wherein
said verifying the presence and/or registration of a device associated with the vulnerable clean file is performed by querying any one of log, diagnostic and hardware information of an operating system of the computer system, and
said checking results in a high threat of usage by malware when no device associated with the vulnerable clean file is recognized.
4. The method according to claim 1 , said checking further comprising:
verifying launchpoint and/or configuration information of the vulnerable clean file, wherein
said verifying is performed by querying registry information of the computer system and
said checking results in a high threat of usage by malware when unusual launchpoint and/or configuration information is recognized.
5. The method according to claim 1 , said checking comprising:
verifying installation information of installation of the vulnerable clean file in the computer system, wherein
said verifying is performed by querying ecosystem information for file installation in the computer system and
said checking results in a high threat of usage by malware when an anomaly in installation information is recognized.
6. The method according to claim 1 , said checking comprising:
verifying expected state of presence of the vulnerable clean file in the computer system, wherein
said verifying is performed by querying installation and/or security log information for the vulnerable clean file and
said checking results in a high threat of usage by malware when a mismatch between an actual state of presence of the vulnerable clean file and a nominal state of presence of the vulnerable clean file is recognized.
7. The method according to claim 1 , said identifying comprising:
testing a file for being malware, wherein the file is identified as clean file when said testing results in that the file does not constitute malware, and/or
testing a clean file for being vulnerable, wherein the clean file is identified as vulnerable clean file when said testing results in that the clean file is vulnerable for usage by malware.
8. The method according to claim 1 , wherein
the method is executed either when the vulnerable clean file is being input or installed in the computer system, or upon initiation by a user or process of the computer system, or upon detection of a predefined event or situation, or on a regular basis.
9. An apparatus, comprising
a memory device configured to store computer program code, and
a processor configured to read and execute computer program code stored in the memory,
wherein the processor is configured to cause the apparatus to perform:
identifying a vulnerable clean file in a computer system, which does not constitute malware but is vulnerable for usage by malware;
checking the vulnerable clean file for its threat of usage by malware by verifying presence and/or registration of a device associated with the vulnerable clean file in the computer system;
detecting the vulnerable clean file as malware-usable clean file as a result of detecting that no device associated with the vulnerable clean file is recognized in the computer system based on the presence and/or registration verification of the device associated with the vulnerable clean file; and
preventing the detected malware-usable clean file from being used by malware.
10. The apparatus according to claim 9 , wherein the processor is configured to cause the apparatus to perform:
verifying reputation information of the vulnerable clean file, wherein
said checking results in a high threat of usage by malware when information indicative of a bad and/or malicious reputation is recognized.
11. The apparatus according to claim 10 , wherein
the result of said checking is derived on the basis of one or more of available threat indications for the vulnerable clean file resulting from one or more of performed verifications.
12. The apparatus according to claim 11 , wherein
the vulnerable clean file is detected as malware-usable clean file either when at least one verification results in a high threat indication, or when a predetermined number or ratio of verifications results in a high threat indication, or when a weighting operation of threat indications of verifications exceeds a predetermined value.
13. The apparatus according to claim 9 , wherein the processor is configured to cause the apparatus to perform:
verifying the presence and/or registration of the device associated with the vulnerable clean file by querying any one of log, diagnostic and hardware information of an operating system of the computer system and
said checking results in a high threat of usage by malware when no device associated with the vulnerable clean file is recognized.
14. The apparatus according to claim 9 , wherein the processor is configured to cause the apparatus to perform:
verifying launchpoint and/or configuration information of the vulnerable clean file, wherein
the processor is configured to cause the apparatus to perform said verifying by querying registry information of the computer system and
said checking results in a high threat of usage by malware when unusual launchpoint and/or configuration information is recognized.
15. The apparatus according to claim 9 , wherein the processor is configured to cause the apparatus to perform:
verifying installation information of installation of the vulnerable clean file in the computer system, wherein
the processor is configured to cause the apparatus to perform said verifying by querying ecosystem information for file installation in the computer system and
said checking results in a high threat of usage by malware when an anomaly in installation information is recognized.
16. The apparatus according to claim 9 , wherein the processor is configured to cause the apparatus to perform:
verifying expected state of presence of the vulnerable clean file in the computer system, wherein
the processor is configured to cause the apparatus to perform said verifying by querying installation and/or security log information for the vulnerable clean file and
said checking results in a high threat of usage by malware when a mismatch between an actual state of presence of the vulnerable clean file and a nominal state of presence of the vulnerable clean file is recognized.
17. The apparatus according to claim 9 , wherein the processor is configured to cause the apparatus to perform:
testing a file for being malware, wherein the file is identified as clean file when said testing results in that the file does not constitute malware, and/or
testing a clean file for being vulnerable, wherein the clean file is identified as vulnerable clean file when said testing results in that the clean file is vulnerable for usage by malware.
18. The apparatus according to claim 9 , wherein
the processor is configured to cause the apparatus to operate either when the vulnerable clean file is being input or installed in the computer system, or upon initiation by a user or process of the computer system, or upon detection of a predefined event or situation, or on a regular basis.
19. A non-transitory computer storage medium having stored thereon a computer program code executed by at least one processor to perform at least:
identifying a vulnerable clean file in a computer system, which does not constitute malware but is vulnerable for usage by malware by verifying presence and/or registration of a device associated with the vulnerable clean file in the computer system;
checking the vulnerable clean file for its threat of usage by malware;
detecting the vulnerable clean file as malware-usable clean file as a result of detecting that no device associated with the vulnerable clean file is recognized in the computer system based on the presence and/or registration verification of the device associated with the vulnerable clean file; and
preventing the detected malware-usable clean file from being used by malware.