Granted Patent B1

US 10,032,025 · App. 15/642,093 · Granted Jul 24, 2018

Inventors: Mark William Patton (San Jose, CA); Ares Lopez Ituiño (Malaga, ES)

Assignee: Malwarebytes Inc.

G06F21/566G06F21/568

Abstract

Claims (84)

1. A method for detecting and terminating malware, the method comprising:

storing to a log in a storage device, a plurality of thread-level indicators associated with detected behavior of a target thread and respective thread-level scores associated with the thread-level indicators;

storing to a log in a storage device, a plurality of process-level indicators associated with detected behavior of a process in which the target thread is executing, and respective process-level scores associated with the process-level indicators;

monitoring the target thread executing on a computing device;

detecting, by a processor, a behavior of the target thread that conforms to one of a predefined set of behaviors indicative of ransomware;

responsive to detecting the behavior, updating the plurality of thread-level indicators to include a new thread-level indicator associated with the detected behavior of the target thread and updating the respective thread-level scores to include a new thread-level score associated with the new thread-level indicator;

generating a running score for the target thread by combining the process-level scores and the thread-level scores from the log;

determining that the running score for the target thread exceeds a predefined threshold score; and

responsive to determining that the running score exceeds the predefined threshold score, terminating execution of the target thread.

2. The method of claim 1 , further comprising:

identifying a source malware file that initiated launching of the target thread; and

quarantining the source malware file.

3. The method of claim 1 , wherein generating the running score comprises:

identifying, based on a reference stored in the log, a child thread created by the target thread;

identifying a child score for the child thread; and

combining the child score with the thread-level scores and the process-level scores.

4. The method of claim 1 , wherein detecting the behavior of the target thread comprises:

detecting that a file which is not created by and is not deleted by the target thread is read by the target thread and written to by the target thread;

detecting that the target thread transforms the file from an unencrypted file to an encrypted file;

detecting that the target thread transforms content of the file such that it fails to conform an expected format associated with a file extension of the file.

5. The method of claim 1 , wherein detecting the behavior of the target thread comprises:

detecting that the target thread reads an unencrypted file;

detecting that the target thread deletes the unencrypted file; and

detecting that the target thread creates a new encrypted file.

6. The method of claim 1 , wherein detecting the behavior of the target thread comprises:

detecting that the target thread reads a target file;

detecting that the target thread deletes the target file; and

detecting that the target thread creates a new file in a same folder as the target file.

7. The method of claim 1 , further comprising:

detecting that a time period since detection of the new thread-level indicator exceeds a time threshold; and

removing the new thread-level indicator from the log responsive to the time period since the detection of the new thread-level indicator exceeding the time threshold.

8. A non-transitory computer-readable storage medium storing instructions for detecting and terminating malware, the instructions when executed by a processor cause the processor to perform steps including:

storing to a log in a storage device, a plurality of thread-level indicators associated with detected behavior of a target thread and respective thread-level scores associated with the thread-level indicators;

storing to a log in a storage device, a plurality of process-level indicators associated with detected behavior of a process in which the target thread is executing, and respective process-level scores associated with the process-level indicators;

monitoring the target thread executing on a computing device;

detecting a behavior of the target thread that conforms to one of a predefined set of behaviors indicative of ransomware;

responsive to detecting the behavior, updating the plurality of thread-level indicators to include a new thread-level indicator associated with the detected behavior of the target thread and updating the respective thread-level scores to include a new thread-level score associated with the new thread-level indicator;

generating a running score for the target thread by combining the process-level scores and the thread-level scores from the log;

determining that the running score for the target thread exceeds a predefined threshold score; and

responsive to determining that the running score exceeds the predefined threshold score, terminating execution of the target thread.

9. The non-transitory computer-readable storage medium of claim 8 , wherein the instructions when executed further cause the processor to perform steps including:

identifying a source malware file that initiated launching of the target thread; and

quarantining the source malware file.

10. The non-transitory computer-readable storage medium of claim 8 , wherein generating the running score comprises:

identifying, based on a reference stored in the log, a child thread created by the target thread;

identifying a child score for the child thread; and

combining the child score with the thread-level scores and the process-level scores.

11. The non-transitory computer-readable storage medium of claim 8 , wherein detecting the behavior of the target thread comprises:

detecting that a file which is not created by and is not deleted by the target thread is read by the target thread and written to by the target thread;

detecting that the target thread transforms the file from an unencrypted file to an encrypted file;

detecting that the target thread transforms content of the file such that it fails to conform an expected format associated with a file extension of the file.

12. The non-transitory computer-readable storage medium of claim 8 , wherein detecting the behavior of the target thread comprises:

detecting that the target thread reads an unencrypted file;

detecting that the target thread deletes the unencrypted file; and

detecting that the target thread creates a new encrypted file.

13. The non-transitory computer-readable storage medium of claim 8 , wherein detecting the behavior of the target thread comprises:

detecting that the target thread reads a target file;

detecting that the target thread deletes the target file; and

detecting that the target thread creates a new file in a same folder as the target file.

14. The non-transitory computer-readable storage medium of claim 8 , further comprising:

detecting that a time period since detection of the new thread-level indicator exceeds a time threshold; and

removing the new thread-level indicator from the log responsive to the time period since the detection of the new thread-level indicator exceeding the time threshold.

15. A computing system comprising:

a processor; and

a non-transitory computer-readable storage medium storing instructions for detecting and terminating malware, the instructions when executed by the processor cause the processor to perform steps including:

storing to a log in a storage device, a plurality of thread-level indicators associated with detected behavior of a target thread and respective thread-level scores associated with the thread-level indicators;

storing to a log in a storage device, a plurality of process-level indicators associated with detected behavior of a process in which the target thread is executing, and respective process-level scores associated with the process-level indicators;

monitoring the target thread executing on a computing device;

detecting a behavior of the target thread that conforms to one of a predefined set of behaviors indicative of ransomware;

responsive to detecting the behavior, updating the plurality of thread-level indicators to include a new thread-level indicator associated with the detected behavior of the target thread and updating the respective thread-level scores to include a new thread-level score associated with the new thread-level indicator;

generating a running score for the target thread by combining the process-level scores and the thread-level scores from the log;

determining that the running score for the target thread exceeds a predefined threshold score; and

responsive to determining that the running score exceeds the predefined threshold score, terminating execution of the target thread.

16. The computing system of claim 15 , wherein detecting the behavior of the target thread comprises:

detecting that a file which is not created by and is not deleted by the target thread is read by the target thread and written to by the target thread;

detecting that the target thread transforms the file from an unencrypted file to an encrypted file;

detecting that the target thread transforms content of the file such that it fails to conform an expected format associated with a file extension of the file.

17. The computing system of claim 15 , wherein detecting the behavior of the target thread comprises:

detecting that the target thread reads an unencrypted file;

detecting that the target thread deletes the unencrypted file; and

detecting that the target thread creates a new encrypted file.

18. The computing system of claim 15 , further comprising:

detecting that a time period since detection of the new thread-level indicator exceeds a time threshold; and

removing the new thread-level indicator from the log responsive to the time period since the detection of the new thread-level indicator exceeding the time threshold.

Assignments (8)

Continuity (1)