Malicious message analysis system
A computerized technique is provided to analyze a message for malware by determining context information from attributes of the message. The attributes are determined by performing one or more of a static analysis of meta information of the message (e.g., delivery protocol attributes) to generate a first result; a dynamic analysis of an object contained in the message to generate a second result; and, in some embodiments, an emulation of the object to generate a third result. The first result, second result, and third result are correlated in accordance with one or more correlation rules to generate a threat index for the message. The threat index is compared with a predetermined threshold to determine whether the message should be classified as malware and, if so, an alert is generated.
1. A computerized method configured to analyze a message by a network device, comprising:
conducting a first analysis of an object included as part of the message to generate one or more attributes being a first set of attributes;
determining whether the first set of attributes is determinative as to whether the message is associated with a malicious attack;
generating an alert in response to determining from the first analysis that the message is associated with a malicious attack;
conducting a second analysis of content recovered from a header or a body of the message to generate one or more delivery protocol attributes;
correlating attributes associated with one or more analyses including at least the one or more delivery protocol attributes and the first set of attributes in accordance with one or more correlation rules in response to the first set of attributes not being determinative as to whether the message is associated with the malicious attack;
generating a threat index based on the correlated attributes associated with the one or more analyses; and
generating the alert in response to determining that the threat index identifies that the message is associated with a malicious attack.
2. The computerized method of claim 1 , wherein the first analysis comprises a dynamic analysis of the object that is part of the message, the dynamic analysis comprises processing the object within a virtual machine and monitoring for one or more behaviors of the virtual machine, wherein the one or more behaviors being the first set of attributes.
3. The computerized method of claim 1 , wherein the first analysis comprises a static analysis is configured to inspect the object for anomalous characteristics comprising any one of selected formatting and patterns associated with malware, the anomalous characteristics being the first set of attributes.
4. The computerized method of claim 1 , wherein the correlating attributes associated with the one or more analyses in accordance with the one or more correlation rules comprises correlating attributes from at least the first set of attributes, the one or more delivery protocol attributes, and at least a second set of attributes generated from a secondary analyses of the object.
5. The computerized method of claim 1 , wherein the analysis of the content recovered from the header or the body of the message comprises analysis of a field of the header to determine a source of the message.
6. The computerized method of claim 5 , wherein the analysis of the field of the header further comprises conducting a handshaking communication session to determine that the message is associated with a malicious attack by verifying that a sender of the message belongs to a prescribed domain identified as a domain of the sender in the message.
7. The computerized method of claim 1 , wherein the one or more correlation rules are directed to detection of the first set of attributes in combination with attributes from at least one or more of (i) static analysis of an object included with the message, (ii) dynamic analysis of the object, and (iii) emulation of the processing of the object.
8. The computerized method of claim 1 , wherein the threat index comprises an association of one or more weighting factors to place higher probative likelihood of maliciousness with respect to a combination of attributes including the first set of attributes and attributes associated with at least one of (i) static analysis of an object included with the message, (ii) dynamic analysis of the object, and (iii) emulation of the processing of the object.
9. The computerized method of claim 1 , wherein in further response to determining that the threat index identifies that the message is malicious, the method further comprises:
uploading the message to a threat intelligence network;
determining if the context information may be used to generate a static signature;
generating the static signature;
uploading the signature to the threat intelligence network; and
deploying the signature to one or more network devices other than the network device.
10. The computerized method of claim 1 , wherein the message comprises an electronic mail message.
11. The computerized method of claim 4 , wherein the first analysis of the object corresponds to a dynamic analysis of the object and the secondary analysis of the object corresponds to a static analysis of the object.
12. The computerized method of claim 4 , wherein the first analysis of the object corresponds to a static analysis of the object and the secondary analysis of the object corresponds to a dynamic analysis of the object.
13. The computerized method of claim 1 , wherein the one or more delivery protocol attributes are based on content that is recovered from the header or the body of the message and directed to a formatting of the message.
14. The computerized method of claim 1 , wherein the one or more delivery protocol attributes are based on content recovered from the header or the body of the message directed to a formatting of the message.
15. The computerized method of claim 1 , wherein the one or more delivery protocol attributes are based on an informality associated with the message that is detected during a handshaking communication session.
16. The computerized method of claim 1 , wherein the one or more delivery protocol attributes are based on a format violation in accordance with a delivery protocol messaging specification.
17. A system to detect malicious messages, comprising:
one or more processors; and
a storage module communicatively coupled to the one or more processors, the storage module including
logic to determine context information comprising one or more combinations of attributes by performing one or more analyses, the logic comprises (a) a meta analyzer to analyze meta information of the message to generate a first set of attributes and (b) one or more engines including (i) a static analysis engine or (ii) a dynamic analysis engine or (iii) an emulation engine to analyze an object attached to the message to produce a second set of attributes,
correlation logic to correlate attributes associated with the second set of attributes, in accordance with one or more correlation rules so as to generate a first threat index,
classification engine to determine whether the first threat index identifies that the message is malicious, and
reporting engine to generate an alert in response to determining that the first threat index identifies that the message is malicious, wherein
in response to the first threat index failing to identify the message is malicious, the correlation logic being further configured to correlate attributes associated with the one or more analyses, including the first set of attributes and the second set of attributes, in accordance with the one or more correlation rules so as to generate a second threat index,
the classification engine to determine whether the second threat index identifies that the message is malicious, and
the reporting engine to generate the alert in response to determining that the second threat index identifies that the message is malicious.
18. The system of claim 17 , wherein the one or more engines comprise a dynamic analysis engine that is configured to process the object within a virtual machine and monitor for one or more behaviors of the virtual machine, wherein the one or more behaviors being the second set of attributes.
19. The system of claim 18 , wherein the one or more engines a static analysis engine that is configured to inspect the object for anomalous characteristics comprising selected formatting and patterns associated with malware, the anomalous characteristics being a third set of attributes.
20. The system of claim 19 , wherein the correlation logic to correlate attributes associated with the one or more analyses in accordance with the one or more correlation rules, the correlated attributes include at least the first set of attributes and at least one of the second set of attributes and the third set of attributes.
21. The system of claim 17 , wherein the meta analyzer analyzes a header field to determine a source of the message.
22. The system of claim 21 , wherein the meta analyzer further conducts a handshaking communication session to determine that the message is associated with a malicious attack by verifying that a sender of the message belongs to a prescribed domain identified as a domain of the sender in the message.
23. The system of claim 17 , wherein the one or more correlation rules are directed to detection of the first set of attributes in combination with the second set of attributes from at least one or more of (i) static analysis of the object included with the message, (ii) dynamic analysis of the object, and (iii) emulation of the processing of the object.
24. The system of claim 17 , wherein the threat index comprises an association of one or more weighting factors to place higher probative likelihood of maliciousness with respect to a combination of attributes including the first set of attributes and the second set of attributes associated with at least one of (i) static analysis of an object included with the message, (ii) dynamic analysis of the object, and (iii) emulation of the processing of the object.
25. The system of claim 17 further comprises logic to:
upload the message to a threat intelligence network;
determine if the context information may be used to generate a static signature;
generate the static signature;
upload the signature to the threat intelligence network; and
deploy the signature to one or more network devices other than the network device.
26. The system of claim 19 , wherein the message comprises an electronic mail message.
27. The system of claim 17 , wherein the meta analyzer includes at least a header analysis logic and a format analysis logic, wherein the header analysis logic is configured to determine a legitimacy of a source of the message or a legitimacy in identification of a sender of the message and the format analysis logic is configured to determine a format violation in a header of the message based on message format specifications.
28. A computerized method configured to analyze a message by a network device, comprising:
determining context information comprising one or more combinations of attributes by performing one or more analyses, the one or more analyses comprises a first analysis of content recovered from a header of the message to generate a first set of attributes corresponding to one or more delivery protocol attributes;
correlating attributes associated with the one or more analyses, including the first set of attributes, in accordance with one or more correlation rules;
generating a first threat index based on the first set of attributes; and
generating an alert in response to determining that the first threat index identifies that the message is associated with a malicious attack;
generating another threat index based on a second set of attributes in response to determining that the first threat index fails to identify that the message is associated with a malicious attack; and
generating an alert in response to determining that the second threat index identifies that the message is associated with a malicious attack.
29. The computerized method of claim 28 , wherein the one of more analysis further comprises a dynamic analysis of an object that is part of the message, the dynamic analysis comprises processing the object within a virtual machine and monitoring for one or more behaviors of the virtual machine, wherein the one or more behaviors being a second set of attributes different from the first set of attributes.
30. The computerized method of claim 28 , wherein the one of more analysis further comprises a static analysis is configured to inspect the object for anomalous characteristics comprising any one of selected formatting and patterns associated with malware, the anomalous characteristics being a set of attributes different from the first set of attributes.
31. The computerized method of claim 28 , wherein the correlating attributes associated with the one or more analyses in accordance with the one or more correlation rules comprises correlating attributes from at least the first set of attributes, and at least one of a second set of attributes and a third set of attributes.
32. The computerized method of claim 28 , wherein the first analysis of the content comprises an analysis of the content from a header of the message including an analysis of a field of the header to determine a source of the message.
33. The computerized method of claim 28 , wherein the one or more delivery protocol attributes are based on content that is recovered from the header or the body of the message and directed to a formatting of the message.
34. The computerized method of claim 28 , wherein the one or more delivery protocol attributes are based on content recovered from the header or the body of the message directed to a formatting of the message.
35. The computerized method of claim 28 , wherein the one or more delivery protocol attributes are based on an informality associated with the message that is detected during a handshaking communication session.
36. The computerized method of claim 28 , wherein the one or more delivery protocol attributes are based on a format violation in accordance with a delivery protocol messaging specification.