System and method for bootkit detection
An embodiment of a computerized method for detecting bootkits is described. Herein, a lowest level software component within a software stack, such as a lowest software driver within a disk driver stack, is determined. The lowest level software component being in communication with a hardware abstraction layer of a storage device. Thereafter, stored information is extracted from the storage device via the lowest level software component, and representative data based on the stored information, such as execution hashes, are generated. The generated data is analyzed to determine whether the stored information includes a bootkit.
1 . A network device for detecting a potential bootkit malware, comprising:
a processor; and
a non-transitory storage medium communicatively coupled to the processor, the non-transitory storage medium comprises a bootkit analysis system for detecting the bootkit malware based on analysis of a plurality of boot samples, the bootkit analysis system including
emulator logic that, upon execution by the processor, simulates processing of each of the plurality of boot samples received to determine high-level functionality of each of the plurality of boot samples and to perform hash operations on the high-level functionality for each of the plurality of boot samples to produce a plurality of execution hashes each generated from a hash operation on mnemonic of instructions for a boot sample of the plurality of boot samples,
de-duplicator logic that, upon execution by the processor, receives the plurality of execution hashes each based on content from one of the plurality of boot samples received by the emulator logic and eliminates execution hashes deemed to be repetitious to produce a reduced set of execution hashes, and
classifier logic that, upon execution by the processor, determines whether data associated with the plurality of boot samples is malicious, suspicious or benign based on a presence or absence of notable distinctions between each execution hash of the plurality of execution hashes for the reduced set of execution hashes and a plurality of execution hashes representative of normal or expected bootstrapping operations.
2 . The network device of claim 1 , wherein the non-transitory storage medium further comprising:
a boot sample data store to store the plurality of boot samples for processing by the emulator logic.
3 . The network device of claim 1 , wherein the non-transitory storage medium further comprising reporting logic that, when executed by the processor, generates an alert that is provided to a security administrator, the alert includes a displayable image to advise the security administrator of a potential bootkit attack.
4 . The network device of claim 1 , wherein the emulator logic simulates processing of each of the plurality of boot samples received to determine the high-level functionality being mnemonic of instructions corresponding to a plurality of logical instructions, the plurality of logical instructions comprises any combination of two or more instructions from a plurality of instructions including an AND instruction, an OR instruction, a SHR (shift right) instruction, a SHL (shift left) instruction, and a MOV (move) instruction.
5 . The network device of claim 1 , wherein the plurality of execution hashes representative of normal bootstrapping operations corresponds to an execution hash intelligence gathered from a plurality of network devices including the network device.
6 . The network device of claim 1 , wherein the de-duplicator logic, upon execution by the processor, is further configured to (i) perform a deduplication operation on an execution hash of the reduced set of execution hashes to determine a level of correlation between the execution hash and prior known execution hashes and (ii) provide the execution hash to the classifier logic to analyze deviations in at least behavior of a first boot sample of the plurality of boot samples from normal OS bootstrapping.
7 . A non-transitory storage medium including software that, when executed by one or more processors, performs operations on a plurality of boot samples associated with an electronic device to determine whether the electronic device includes bootkit malware, the non-transitory computer storage medium comprising:
emulator logic that, upon execution by the one or more processors, simulates processing of each of the plurality of boot samples to determine high-level functionality of each of the plurality of boot samples and to perform operations on the high-level functionality for each of the plurality of boot samples to produce a set of data representations each associated with one of the plurality of boot samples, wherein each data representation constitutes a hash operation on mnemonic of instructions for each boot sample of the plurality of boot samples;
de-duplicator logic that, upon execution by the one or more processors, receives the plurality of data representations each based on content from one of the plurality of boot samples received by the emulator logic and eliminates a data representation of the plurality of data representations deemed to be repetitious to produce a reduced set of data representations; and
classifier logic that, upon execution by the one or more processors, determines whether data associated with the plurality of boot samples is malicious, suspicious or benign based on a presence or absence of notable distinctions between each data representation of the reduced set of data representations and a plurality of data representation associated with normal or expected bootstrapping operations.
8 . The non-transitory storage medium of claim 7 , wherein each data representation corresponds to an execution hash.
9 . The non-transitory storage medium of claim 8 further comprising reporting logic that, when executed by the one or more processors, generates an alert being a message including a displayable image to identify a potential bootkit attack.
10 . The non-transitory storage medium of claim 8 , wherein the emulator logic to simulate processing of each of the plurality of boot samples received to determine the high-level functionality being a plurality of logical instructions, the plurality of logical instructions comprises any combination of two or more instructions from a plurality of instructions including an AND instruction, an OR instruction, a SHR (shift right) instruction, a SHL (shift left) instruction, and a MOV (move) instruction.
11 . The non-transitory storage medium of claim 8 , wherein the plurality of execution hashes representative of normal or expected bootstrapping operations corresponds to an execution hash intelligence gathered from a plurality of network devices.
12 . A computerized method for detecting a potential bootkit malware, comprising:
simulating processing, by emulator logic executed by a processor, of each of the plurality of boot samples received to determine high-level functionality of each of the plurality of boot samples and to perform hash operations on the high-level functionality for each of the plurality of boot samples to produce a plurality of execution hashes, each execution hash of the plurality of execution hashes is generated from a hash operation on mnemonic of instructions for a boot sample of the plurality of boot samples,
receiving, by de-duplicator logic executed by the processor, the plurality of execution hashes, each execution hash of the plurality of execution hashes is based on content from one of the plurality of boot samples received by the emulator logic;
eliminating, by the de-duplicator logic, one or more execution hashes of the plurality of execution hashes deemed to be repetitious to produce a reduced set of execution hashes; and
determining, by classifier logic executed by the processor, whether data associated with the plurality of boot samples is malicious, suspicious or benign based on a presence or absence of notable distinctions between each execution hash of the plurality of execution hashes for the reduced set of execution hashes and a plurality of execution hashes representative of normal or expected bootstrapping operations.
13 . The computerized method of claim 12 further comprising:
storing the plurality of boot samples for processing by the emulator logic.
14 . The computerized method of claim 12 further comprising:
generating, by reporting logic executed by the processor, an alert that is provided to a security administrator, the alert may be a displayable image to advise the security administrator of a potential bootkit attack.
15 . The computerized method of claim 12 , wherein mnemonic of instructions corresponding to a plurality of logical instructions, the plurality of logical instructions comprises any combination of two or more instructions from a plurality of instructions including an AND instruction, an OR instruction, a SHR (shift right) instruction, a SHL (shift left) instruction, and a MOV (move) instruction.
16 . The computerized method of claim 12 , wherein the plurality of execution hashes representative of normal bootstrapping operations corresponds to an execution hash intelligence gathered from a plurality of network devices including the network device.