System and method for detecting interpreter-based exploit attacks
For one embodiment, a computerized method for detecting exploit attacks on an interpreter comprises configuring a virtual machine including a user mode and a kernel mode and processing an object by an application operating in the user mode of the virtual machine. Responsive to the processing of the object, detecting a loading of an interpreter. Furthermore, responsive to the loading of the interpreter, inserting one or more intercept points for detecting one or more types of software calls from the interpreter or for detecting a certain type or certain types of activities occurring within the interpreter. Thereafter, an exploit attack is detected as being conducted by the object in response to the interpreter invoking a software call that corresponds to the one or more types of software calls that is considered anomalous when invoked by the interpreter or an anomalous activity being conducted within the interpreter.
1. A non-transitory storage medium including software, executed by a processor and operating within a virtual machine, to detect an exploit attack on an interpreter based on processing of an object by an application in the virtual machine and detecting a loading of interpreter by the application, the software comprising:
a hook framework that, responsive to launching of the application, is configured to insert one or more intercept points into the interpreter or software operating in cooperation with the interpreter for detecting calls associated with one or more types of activities that are normally not conducted by the interpreter and represent a potential exploit attack; and
an instrumentation framework configured to insert one or more intercept points into the interpreter instrumented as a first type of interpreter or software operating in cooperation with the interpreter to detect any activities conducted by the interpreter that differ from activities conducted by the first type of interpreter and represent a potential exploit attack.
2. The non-transitory storage medium of claim 1 , wherein the one or more intercept points inserted by the hook framework are configured to detect a certain type or types of Application Programming Interface (API) calls.
3. The non-transitory storage medium of claim 1 , wherein the one or more intercept points inserted by the hook framework are configured to detect a different type or types of Application Programming Interface (API) calls, depending on a type of the interpreter.
4. The non-transitory storage medium of claim 1 , wherein the one or more intercept points inserted by the hook framework are configured to detect one or more Application Programming Interface (API) calls each corresponding to a selected software call of the calls associated with one or more types of activities, where the detected one or more API calls being an anomalous activity by the interpreter.
5. The non-transitory storage medium of claim 1 , wherein the software operating in cooperation with the interpreter includes software being part of a kernel driver.
6. The non-transitory storage medium of claim 5 , wherein the software further comprises monitoring logic to track activities associated with the certain type or types of API calls after detection.
7. The non-transitory storage medium of claim 6 , wherein the kernel driver further comprises a correlation logic to aggregate and categorize the monitored data from the monitoring logic in order to determine whether any detected anomalous activities denote an exploit attack on the interpreter.
8. The non-transitory storage medium of claim 1 , wherein the instrumentation framework further collects state information associated with the interpreter.
9. The non-transitory storage medium of claim 8 , wherein the state information provides evidence of an exploit attack when the interpreter is invoking (i) functions at different times, (ii) functions in a different sequence than normally observed, or (iii) functions unexpectedly.
10. The non-transitory storage medium of claim 1 , wherein the hook framework is configured to intercept system calls including Application Programming Interface (API) calls and the instrumentation framework is configured to collect state information associated with the interpreter.
11. The non-transitory storage medium of claim 1 further comprising classification logic communicatively coupled to the hook framework and the instrumentation framework, the classification logic being configured to determine whether any anomalous activities detected by the hook framework and any anomalous activities detected by the instrumentation framework denote an exploit attack on the interpreter.
12. The non-transitory storage medium of claim 11 further comprising reporting logic communicatively coupled to the classification logic, the reporting logic being configured to generate an alert signal to identify that the object is classified as malicious.
13. A computerized method for detecting an exploit attack on a software component based on processing of an object by an application in a virtual machine, comprising:
detecting a loading of the software component by the application when processing of the object;
responsive to launching of the application, inserting one or more intercept points, by a hook framework, into the software component or software operating in cooperation with the software component for detecting calls associated with one or more types of activities that are normally not conducted by the software component and represent a potential exploit attack; and
inserting one or more intercept points, by an instrumentation framework, into either (i) the software component instrumented as a first type of software component or (ii) software operating in cooperation with the software component to detect any activities conducted by the software component that differ from activities conducted by the first type of software component and represent a potential exploit attack.
14. The computerized method of claim 13 , wherein the one or more intercept points inserted by the hook framework are configured to detect a certain type or types of Application Programming Interface (API) calls.
15. The computerized method of claim 13 , wherein the software component is an interpreter.
16. The computerized method of claim 15 , wherein the one or more intercept points inserted by the hook framework are configured to detect a different type or types of Application Programming Interface (API) calls, depending on a type of the interpreter.
17. The computerized method of claim 15 , wherein the one or more intercept points inserted by the hook framework are configured to detect one or more Application Programming Interface (API) calls each corresponding to a selected software call of the calls associated with one or more types of activities, where the detected one or more API calls being an anomalous activity by the interpreter.
18. The computerized method of claim 15 , wherein the software operating in cooperation with the interpreter includes software being part of a kernel driver.
19. The computerized method of claim 18 , wherein the software further comprises monitoring logic to track activities associated with the certain type or types of API calls after detection.
20. The computerized method of claim 19 , wherein the kernel driver further comprises a correlation logic to aggregate and categorize the monitored data from the monitoring logic in order to determine whether any detected anomalous activities denote an exploit attack on the interpreter.
21. The computerized method of claim 15 further comprising collecting, by the instrumentation framework, state information associated with the interpreter.
22. The computerized method of claim 21 , wherein the state information provides evidence of an exploit attack when the interpreter is invoking (i) functions at different times, (ii) functions in a different sequence than normally observed, or (iii) functions unexpectedly.
23. The computerized method of claim 15 further comprising intercepting system calls including Application Programming Interface (API) calls by the hook framework and collecting state information associated with the interpreter from the instrumentation framework.
24. The computerized method of claim 13 , wherein the software component includes a Just-In-Time (JIT) compiler.
25. The computerized method of claim 13 further comprising:
determining, by classification logic communicatively coupled to the hook framework and the instrumentation framework, whether any anomalous activities detected by the hook framework and any anomalous activities detected by the instrumentation framework denote an exploit attack on the software component.
26. The computerized method of claim 25 further comprising:
generating an alert signal, by reporting logic communicatively coupled to the classification logic, to identify that the object is classified as malicious.
27. A system for detecting an exploit attack on a software component, comprising:
one or more processors; and
a non-transitory storage medium communicatively coupled to the one or more processors, the non-transitory storage medium includes software, when executed by the one or more processors, to (i) process an object by an application in a virtual machine, and (ii) detect a launching of the software component by the application when processing the object;
wherein the software further comprising:
a hook framework that, responsive to the launching of the application, is configured to insert one or more intercept points into the software component or software operating in cooperation with the software component for detecting calls associated with one or more types of activities that are normally not conducted by the software component and represent a potential exploit attack, and
an instrumentation framework configured to insert one or more intercept points into either (i) the software component instrumented as a first type of software component or (ii) software operating in cooperation with the software component to detect any activities conducted by the software component that differ from activities conducted by the first type of software component and represent a potential exploit attack.
28. The system of claim 27 , wherein the one or more intercept points inserted by the hook framework are configured to detect a certain type or types of Application Programming Interface (API) calls.
29. The system of claim 27 , wherein the software component is an interpreter.
30. The system of claim 29 , wherein the one or more intercept points inserted by the hook framework are configured to detect a different type or types of Application Programming Interface (API) calls, depending on a type of the interpreter.
31. The system of claim 29 , wherein the one or more intercept points inserted by the hook framework are configured to detect one or more Application Programming Interface (API) calls each corresponding to a selected software call of the calls associated with one or more types of activities, where the detected one or more API calls being an anomalous activity by the interpreter.
32. The system of claim 29 , wherein the software operating in cooperation with the interpreter includes software being part of a kernel driver.
33. The system of claim 32 , wherein the software further comprises monitoring logic to track activities associated with the certain type or types of API calls after detection.
34. The system of claim 33 , wherein the kernel driver further comprises a correlation logic to aggregate and categorize the monitored data from the monitoring logic in order to determine whether any detected anomalous activities denote an exploit attack on the interpreter.
35. The system of claim 29 , wherein the instrumentation framework further collects state information associated with the interpreter.
36. The system of claim 35 , wherein the state information provides evidence of an exploit attack when the interpreter is invoking (i) functions at different times, (ii) functions in a different sequence than normally observed, or (iii) functions unexpectedly.
37. The system of claim 29 , wherein the hook framework is configured to intercept system calls including Application Programming Interface (API) calls and the instrumentation framework is configured to collect state information associated with the interpreter.
38. The system of claim 27 , wherein the software component includes a Just-In-Time (JIT) compiler.
39. The system of claim 27 further comprising classification logic communicatively coupled to the hook framework and the instrumentation framework, the classification logic being configured to determine whether any anomalous activities detected by the hook framework and any anomalous activities detected by the instrumentation framework denote an exploit attack on the software component.
40. The system of claim 39 further comprising reporting logic communicatively coupled to the classification logic, the reporting logic being configured to generate an alert signal to identify that the object is classified as malicious.
41. The system of claim 27 , wherein the one or more processors correspond to one or more hardware processors.