System and methods for sandboxed malware analysis and automated patch development, deployment and validation
A system and methods for sandboxed malware analysis and automated patch development, deployment and validation, that uses a business operating system, vulnerability scoring engine, binary translation engine, sandbox simulation engine, at least one network endpoint, at least one database, a network, and a combination of machine learning and vulnerability probing techniques, to analyze software, locate any vulnerabilities or malicious behavior, and attempt to patch and prevent undesired behavior from occurring, autonomously.
1. A system for sandboxed malware analysis and automated vulnerability protection, comprising:
a computing device comprising a memory and a processor;
a business operating system comprising a first plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:
intercept a file at a network device endpoint;
determining whether the file is executable machine code;
for files comprising executable machine code, identify a type of device on which the executable machine code will operate;
for files not comprising executable machine code, determine whether the file comprises programming code for an executable application:
identify a programming code language and a type of device for which the programming code was written; and
compile the programming code into executable machine code;
transfer the executable machine code to a device-specific sandbox environment, the device-specific sandbox environment comprising a safe environment that emulates functionality of the identified type of device where malware is unable to affect systems outside of the device-specific sandbox environment;
receive an identified vulnerability from the sandbox environment related to the identified type of device; and
change the system behavior of the real device to prevent exploitation of the identified vulnerability through either address space layout randomization or data execution prevention;
and
a device-specific sandbox environment comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:
receive the executable machine code from the business operating system;
execute the executable machine code on an emulator of the type of device;
identify an irregularity in the execution of the executable machine code on the emulator, the irregularity comprising one or more of the following activities performed in suspicious ways not normally performed by benign software: memory scanning, deletion of the file containing the executable machine code from storage media, access of system files, access of permissions, access of security settings, and access of network adapters;
identify a vulnerability of the identified type of device being targeted by the identified irregularity in the execution of the executable machine code; and
send the identified vulnerability to the business operating system.
2. A method for sandboxed malware analysis and automated vulnerability protection, comprising the steps of:
intercepting a file at a network device endpoint;
determining whether the file is executable machine code;
for files comprising executable machine code, identifying a type of device on which the executable machine code will execute;
for files not comprising executable machine code, determining whether the file comprises programming code for an executable application:
identifying a programming code language and a type of device for which the programming code was written; and
compiling the programming code into executable machine code;
transferring the executable machine code to a device-specific sandbox environment, the device-specific sandbox environment comprising a safe environment that emulates functionality of the identified type of device where malware is unable to affect systems outside of the device-specific sandbox environment;
executing the executable machine code on an emulator for the type of device within the device-specific sandbox environment;
identifying an irregularity in the execution of the executable machine code within the device-specific sandbox environment, the irregularity comprising one or more of the following activities performed in suspicious ways not normally performed by benign software: memory scanning, deletion of the file containing the executable machine code from storage media, access of system files, access of permissions, access of security settings, and access of network adapters;
identifying a vulnerability of the identified type of device being targeted by the identified irregularity in the execution of the executable machine code; and
changing the system behavior of the real device to prevent exploitation of the identified vulnerability through either address space layout randomization or data execution prevention.