System and method for strategic anti-malware monitoring
The system and method described herein may leverage active network scanning and passive network monitoring to provide strategic anti-malware monitoring in a network. In particular, the system and method described herein may remotely connect to managed hosts in a network to compute hashes or other signatures associated with processes running thereon and suspicious files hosted thereon, wherein the hashes may communicated to a cloud database that aggregates all known virus or malware signatures that various anti-virus vendors have catalogued to detect malware infections without requiring the hosts to have a local or resident anti-virus agent. Furthermore, running processes and file system activity may be monitored in the network to further detect malware infections. Additionally, the network scanning and network monitoring may be used to detect hosts that may potentially be participating in an active botnet or hosting botnet content and audit anti-virus strategies deployed in the network.
1. A scanner for strategic anti-malware monitoring in a network, comprising:
a memory; and
at least one processor communicatively coupled to the memory and configured to:
identify one or more processes running on a remote host;
compute one or more unique signatures associated with the one or more processes running on the remote host;
query a database that stores signatures associated with a plurality of known malware samples that multiple different anti-virus vendors have catalogued using the one or more unique signatures associated with the one or more processes running on the remote host; and
detect that the remote host has been infected with malware in response to a result from the query indicating that a unique signature associated with at least one of the one or more processes running on the remote host matches a signature associated with at least one known malware sample stored in the database.
2. The scanner recited in claim 1 , wherein the remote host does not have a local or resident anti-virus agent, and wherein the at least one processor is further configured to:
upload, to the remote host, a dissolvable agent configured to identify the one or more processes running thereon and compute the one or more unique signatures associated therewith; and
remove the dissolvable agent from the remote host subsequent to the at least one processor querying the database using the one or more unique signatures associated with the one or more processes running on the remote host.
3. The scanner recited in claim 1 , wherein the at least one processor is are further configured to:
identify one or more additional hosts in the network that are running at least one process having the unique signature associated with the at least one process that matches the signature associated with the at least one known malware sample; and
detect that the one or more additional hosts have been infected with the malware.
4. The scanner recited in claim 1 , wherein:
the at least one processor is further configured to compare a file system associated with the remote host to a trusted file system known to have no malware infections and to identify at least one suspicious file in the file system associated with the remote host based on one or more of the at least one suspicious file not appearing in the trusted file system or having a unique signature that differs from a corresponding file in the trusted file system; and
the at least one processor is further configured to detect that the remote host has been infected with malware in response to the unique signature associated with the at least one suspicious file matching the signature associated with the at least one known malware sample stored in the database.
5. The scanner recited in claim 1 , wherein the at least one processor is further configured to isolate where the malware was introduced into the network and to evaluate an extent to which the malware has propagated or spread throughout the network based on information that describes one or more connections observed in the network and one or more system processes that have occurred in the network.
6. The scanner recited in claim 1 , wherein the at least one processor is further configured to examine one or more local or resident anti-virus agents deployed in the network to audit an anti-malware strategy deployed in the network and evaluate whether the audited anti-malware strategy provides appropriate protection against virus or malware outbreaks in the network.
7. A method for strategic anti-malware monitoring in a network, comprising:
identifying one or more processes running on a remote host in the network;
computing one or more unique signatures associated with the one or more processes running on the remote host;
querying a database that stores signatures associated with a plurality of known malware samples that multiple different anti-virus vendors have catalogued using the one or more unique signatures associated with the one or more processes running on the remote host; and
detecting that the remote host has been infected with malware in response to a result from the query indicating that a unique signature associated with at least one of the one or more processes running on the remote host matches a signature associated with at least one known malware sample stored in the database.
8. The method recited in claim 7 , wherein the remote host does not have a local or resident anti-virus agent and the method further comprises:
uploading, to the remote host, a dissolvable agent configured to identify the one or more processes running thereon and compute the one or more unique signatures associated therewith; and
removing the dissolvable agent from the remote host subsequent to querying the database using the one or more unique signatures associated with the one or more processes running on the remote host.
9. The method recited in claim 7 , further comprising:
identifying one or more additional hosts in the network that are running at least one process having the unique signature associated with the at least one process that matches the signature associated with the at least one known malware sample; and
detecting that the one or more additional hosts have been infected with the malware.
10. The method recited in claim 7 , further comprising:
comparing a file system associated with the remote host to a trusted file system known to have no malware infections;
identifying at least one suspicious file in the file system associated with the remote host based on one or more of the at least one suspicious file not appearing in the trusted file system or having a different unique signature from a corresponding file in the trusted file system; and
detecting that the remote host has been infected with the malware in response to the different unique signature associated with the at least one suspicious file matching the signature associated with the at least one known malware sample stored in the database.
11. The method recited in claim 7 , further comprising:
isolating where the malware was introduced into the network; and
evaluating an extent to which the malware has propagated or spread throughout the network based on information that describes one or more connections observed in the network and one or more system processes that have occurred in the network.
12. The method recited in claim 7 , further comprising:
examining one or more local or resident anti-virus agents deployed in the network to audit an anti-malware strategy deployed in the network; and
evaluating whether the audited anti-malware strategy provides appropriate protection against virus or malware outbreaks in the network.
13. A non-transitory computer-readable storage medium having computer-executable instructions stored thereon for strategic anti-malware monitoring in a network, wherein executing the computer-executable instructions on one or more processors causes the one or more processors to:
identify one or more processes running on a remote host in the network;
compute one or more unique signatures associated with the one or more processes running on the remote host;
query a database that stores signatures associated with a plurality of known malware samples that multiple different anti-virus vendors have catalogued using the one or more unique signatures associated with the one or more processes running on the remote host; and
detect that the remote host has been infected with malware in response to a result from the query indicating that a unique signature associated with at least one of the one or more processes running on the remote host matches a signature associated with at least one known malware sample stored in the database.
14. The non-transitory computer-readable storage medium recited in claim 13 , wherein the remote host does not have a local or resident anti-virus agent, and wherein the executed computer-executable instructions further cause the one or more processors to:
upload, to the remote host, a dissolvable agent configured to identify the one or more processes running thereon and compute the one or more unique signatures associated therewith; and
remove the dissolvable agent from the remote host subsequent to querying the database using the one or more unique signatures associated with the one or more processes running on the remote host.
15. The non-transitory computer-readable storage medium recited in claim 13 , wherein the executed computer-executable instructions further cause the one or more processors to:
identify one or more additional hosts in the network that are running at least one process having the unique signature associated with the at least one process that matches the signature associated with the at least one known malware sample; and
detect that the one or more additional hosts have been infected with the malware.
16. The non-transitory computer-readable storage medium recited in claim 13 , wherein the executed computer-executable instructions further cause the one or more processors to:
compare a file system associated with the remote host to a trusted file system known to have no malware infections;
identify at least one suspicious file in the file system associated with the remote host based on one or more of the at least one suspicious file not appearing in the trusted file system or having a different unique signature from a corresponding file in the trusted file system; and
detect that the remote host has been infected with the malware in response to the different unique signature associated with the at least one suspicious file matching the signature associated with the at least one known malware sample stored in the database.
17. The non-transitory computer-readable storage medium recited in claim 13 , wherein the executed computer-executable instructions further cause the one or more processors to:
isolate where the malware was introduced into the network; and
evaluate an extent to which the malware has propagated or spread throughout the network based on information that describes one or more connections observed in the network and one or more system processes that have occurred in the network.
18. The non-transitory computer-readable storage medium recited in claim 13 , wherein the executed computer-executable instructions further cause the one or more processors to:
examine one or more local or resident anti-virus agents deployed in the network to audit an anti-malware strategy deployed in the network; and
evaluate whether the audited anti-malware strategy provides appropriate protection against virus or malware outbreaks in the network.