Systems and methods for determining a likelihood of an existence of malware on an executable
Provided herein are systems and methods for determining a likelihood that an executable comprises malware. A learning engine may determine a plurality of attributes of an executable identified in a computing environment, and a corresponding weight to assign to each of the plurality of attributes. Each of the plurality of attributes may be indicative of a level of risk for the computing environment. The learning engine may generate, according to the determined plurality of attributes and the corresponding weights, one or more scores indicative of a likelihood that the executable comprises malware. A rule engine may perform an action to manage operation of the executable, according to the generated one or more scores.
1. A system for determining a likelihood that an executable comprises malware, the system comprising:
a server device comprising one or more processors coupled with memory, configured to:
identify an executable to unpack for analysis in a first computing environment and to be executed in a second computing environment;
determine that an identifier for the executable is not included in a database of indexed executables;
determine, responsive to determining that the identifier is not included, a first attribute of a plurality of attributes identified from the executable unpacked in the first computing environment by the server device detecting initiation of the executable by a computing device containing the second computing environment, the initiation of the executable being in the second computing environment, and identifying, by the server device, the first attribute as a characteristic of the second computing environment while the executable is executing in the second computing environment, wherein the first environment comprises an operating environment on the server device, and wherein the second environment comprises an operating environment on a client device separate from the server device, wherein detecting the initiation of the executable comprises the server device detecting a process of the executable being run in the second computing environment;
determine a remainder of the plurality of attributes identified from the executable unpacked in the first computing environment;
determine a corresponding weight to assign to each of the plurality of attributes, each of the plurality of attributes indicative of a level of risk for the first second computing environment;
assign a weight to an attribute corresponding to the use of a first API, the assigned weight being lower than one for assigning to an attribute corresponding to the use of a second API that is riskier than the first API;
generate, according to the determined plurality of attributes and the corresponding weights, one or more scores indicative of a likelihood that the executable comprises malware;
store, in the database of indexed executables, the identifier for the executable in association with the one or more scores; and
perform an action to manage operation of the executable in the second computing environment according to the generated one or more scores.
2. The system of claim 1 , wherein the one or more scores are indicative of at least one of: a likelihood of falsely identifying that the executable comprises malware, or a likelihood of falsely identifying that the executable is free of malware.
3. The system of claim 1 , wherein the plurality of attributes comprises at least one of the executable: being associated with a non-standard compiler, using an embedded uniform resource locator (URL) or an external internet protocol (IP) address, using an unknown or unsafe application programming interface (API), using a non-standard import string, having packed or encrypted binary data, being smaller than a predetermined file-size, having no signature or root authority, being excluded from program files, being a hidden file, being downloaded from an external site, or having ability to encrypt files.
4. The system of claim 1 , wherein the plurality of attributes comprises the executable being able to at least one of: start a process, start a process as a user, exit a process, open or access a process, suspend a process, open a process token, create a symbolic link, query a file system volume, access an environment string, create a thread, exit a thread, access a thread, suspend a thread, open a thread token, or create a named pipe, copy a file, print a file, or transmit a file out of the first computing environment.
5. The system of claim 1 , wherein the first computing environment includes decrypted binary data of the executable unpacked in a testing computing environment and the second computing environment includes a runtime computing environment.
6. The system of claim 1 , wherein the one or more processors are configured to evaluate the one or more scores against an assessment by a user.
7. The system of claim 6 , wherein the one or more processors are configured to adjust, responsive to the evaluation, at least one of: a weight to assign to one of the plurality of attributes, or a mathematical function.
8. The system of claim 1 , wherein the one or more processors are configured to perform the action, the action comprising automatically blocking an operation of the executable, adding or updating a rule to apply when the executable is detected, storing the one or more scores of the executable, sending the one or more scores to another learning engine or rule engine, sending a rule to block or control the operation of the executable, or sending one or more prompts to a user regarding the executable.
9. The system of claim 1 , wherein the plurality of attributes comprises at least one of the executable: being associated with a standard compiler, not using an embedded uniform resource locator (URL) or an external internet protocol (IP) address, using a known or safe application programming interface (API), using a standard import string, not having packed or encrypted binary data, having a file-size of at least a predetermined value, having a legitimate signature, not being excluded from program files, being a visible file, being installed using a known or signed installer file.
10. The system of claim 1 , wherein the one or more processors are further configured to generate the identifier for the executable based at least on a hash function of decrypted binary data unpacked in the first computing environment.
11. The system of claim 1 , wherein the first attribute comprises one or more of a process of the executable, additional code loaded into the executable, one or more executable binaries, one or more executable libraries, one or more binary libraries, one or more dynamic libraries, and one or more dynamic link files.
12. A method for determining a likelihood that an executable comprises malware, the method comprising:
identifying, by one or more processors, an executable unpacked in a first computing environment to be executed in a second computing environment, wherein the first environment comprises an operating environment on a server device, and wherein the second environment comprises an operating environment on a client device separate from the server device;
determining, by the one or more processors, that an identifier for the executable is not included in a database of indexed executables;
determining, by the one or more processors, a first attribute of a plurality of attributes identified from the executable unpacked in the first computing environment by the server device detecting initiation of the executable by a computing device containing the second computing environment, the initiation of the executable being in the second computing environment, and identifying, by the server device, the first attribute as a characteristic of the second computing environment while the executable is executing in the second computing environment, wherein detecting the initiation of the executable comprises the server device detecting a process of the executable being run in the second computing environment;
determining, by the one or more processors responsive to determining that the identifier is not included, a remainder of the plurality of attributes identified from the executable unpacked in the first computing environment;
determining, by the one or more processors, a corresponding weight to assign to each of the plurality of attributes, each of the plurality of attributes indicative of a level of risk for the second computing environment;
assigning, by the one or more processors, a weight to an attribute corresponding to the use of a first API, the assigned weight being lower than one for assigning to an attribute corresponding to the use of a second API that is riskier than the first API;
generating, by the one or more processors according to the determined plurality of attributes and the corresponding weights, one or more scores indicative of a likelihood that the executable comprises malware;
storing, by the one or more processors, in the database of indexed executables, the identifier for the executable in association with the one or more scores; and
performing, by the one or more processors, an action to manage operation of the executable in the second computing environment, according to the generated one or more scores.
13. The method of claim 12 , wherein the generated one or more scores are indicative of at least one of: a likelihood of falsely identifying that the executable comprises malware, or a likelihood of falsely identifying that the executable is free of malware.
14. The method of claim 12 , wherein the plurality of attributes comprises at least one of the executable: being associated with a non-standard compiler, using an embedded uniform resource locator (URL) or an external internet protocol (IP) address, using an unknown or unsafe application programming interface (API), using a non-standard import string, having packed or encrypted binary data, being smaller than a predetermined file-size, having no signature or root authority, being excluded from program files, being a hidden file, being downloaded from an external site, or having ability to encrypt files.
15. The method of claim 12 , wherein the plurality of attributes comprises the executable being able to at least one of: start a process, start a process as a user, exit a process, open or access a process, suspend a process, open a process token, create a symbolic link, query a file system volume, access an environment string, create an execution path, exit an execution path, access an execution path, suspend an execution path, open an execution path token, create a named pipe, copy a file, print a file, or transmit a file out of the first computing environment.
16. The method of claim 12 , wherein the first computing environment includes decrypted binary data of the executable unpacked in a testing computing environment and the second computing environment includes a runtime computing environment.
17. The method of claim 12 , further comprising:
evaluating, by the one or more processors, the one or more scores against an assessment by a user; and
adjusting, by the one or more processors responsive to the evaluation, at least one of: a weight to assign to one of the plurality of attributes, or a mathematical function.
18. The method of claim 12 , wherein performing the action comprises automatically blocking an operation of the executable, adding or updating a rule to apply when the executable is detected, storing the one or more scores of the executable, sending the one or more scores, sending a rule to block or control the operation of the executable, or sending one or more prompts to a user regarding the executable.