System, method, and apparatus for computer security
A system for protecting a computer from malicious software uses a whitelist to determine is a program is safe to run. As new malicious software is created, attempts at execution of executables including such malicious software are prevented being that the new malicious software is not listed in the whitelist. When such attempts are made, the executable is forwarded to a server where further analysis is performed to determine if the executable contains suspect code (e.g., malicious software) including running the executable in a sandbox to analyze how the executable behaves and running industry virus scanners against the executable to see if those scanners can find a virus. If such research finds that the executable is well-behaved, the executable is added to the whitelist and future execution is allowed.
1. A system for computer security, the system comprising:
at least one whitelist;
a server, the server having storage;
a computer protected by the system for computer security;
software running on the computer detecting an attempt to run an application, the software determining if the application is in the at least one whitelist and if the application is present in the at least one whitelist, the software running on the computer allows the running of the application;
if the application is not found in the at least one whitelist, execution is blocked and at least a portion of the application is forwarded to the server for further analyzes;
at the server, a researcher selects the application for analysis and performs the analysis on the application using one or more industry virus scanners against the application;
if the one or more industry virus scanners collectively detects that malicious software exists in the application, the server notifies regarding a malicious software application and the application is blocked;
if the one or more industry virus scanners fail to detect any malicious software in the application, then further analysis is performed;
if the further analysis indicates that no malicious software exists in the application, the server updates one or more of the at least one whitelist, and if the further analysis indicates that that there may be malicious software in application, future execution of the application is blocked;
wherein the further research includes running the application in a sandbox and analyzing of a file system of the sandbox, a registry of the sandbox, an input/output subsystem of the sandbox and a communications port of the sandbox, and if the analyzing indicates that there is a virus in the application, the application is added to at least one blacklist and future execution of the application is blocked; and
whereas the server notifies regarding the malicious software by sending an email to a user of the computer.
2. The system of claim 1 , wherein the at least one whitelist and the at least one blacklist are stored and accessed from storage associated with the server.
3. The system of claim 2 , wherein the further research includes reviewing at least two hash values of the application determined from at least two hash algorithms and if any of the at least two hash values is determined to be a hash value of the virus, the application is added to the at least one blacklist and future execution of the application is blocked.
4. The system of claim 1 , wherein the further research includes searching for patterns in the application using regular expressions and if a pattern known to be the virus is found, the application is added to the at least one blacklist and future execution of the application is blocked.
5. The system of claim 1 , wherein when the at least the portion of the application is forwarded to the server for further the analyzes, an identification of an invoking application and any command-line parameters are also forwarded to the server.
6. The system of claim 1 , wherein the email includes a description of the malicious software and links to training on how to prevent future intrusions of the malicious software into the computer.
7. A method for computer security, the method comprising:
providing at least one whitelist, a server having a storage, and a computer protected by the method for computer security;
detecting an attempt to run an application;
determining if the application is in the at least one whitelist and if the application is present in the at least one whitelist, allowing the running of the application;
if the application is not found in the at least one whitelist, blocking execution and forwarding at least a portion of the application to the server for further analyzes;
at the server, a researcher selecting the application for analysis and performing the analysis on the application using one or more industry virus scanners against the application;
if the one or more industry virus scanners collectively detects that malicious software exists in the application, the server notifies regarding a malicious software application and the application is blocked;
if the one or more industry virus scanners fail to detect any malicious software in the application, then further analysis is performed;
if the further analysis indicates that no malicious software exists in the application, the server updates one or more of the at least one whitelist, and if the further analysis indicates that that there may be malicious software in application, future execution of the application is blocked;
wherein the further research includes running the application in a sandbox and analyzing of a file system of the sandbox, a registry of the sandbox, an input/output subsystem of the sandbox and a communications port of the sandbox, and if the analyzing indicates that there is a virus in the application, the application is added to at least one blacklist and future execution of the application is blocked; and
whereas the server notifies regarding the malicious software by sending an email to a user of the computer.
8. The method of claim 7 , wherein the at least one whitelist and the at least one blacklist are stored and accessed from storage associated with the server.
9. The method of claim 7 , wherein the further research includes searching for patterns in the application using regular expressions and if a pattern known to be the virus is found, the application is added to the at least one blacklist and future execution of the application is blocked.
10. The method of claim 7 , wherein the further research includes reviewing at least two hash values of the application determined from at least two hash algorithms and if any of the at least two hash values is determined to be a hash value of the virus, the application is added to the at least one blacklist and future execution of the application is blocked.
11. The method of claim 7 , wherein when the at least the portion of the application is forwarded to the server for further the analyzes, an identification of an invoking application and any command-line parameters are also forwarded to the server.
12. The method of claim 7 , wherein the email includes a description of the malicious software and links to training on how to prevent future intrusions of the malicious software into the computer.
13. A computer program product for providing security to a computer comprising:
a non-transitory storage medium having computer readable instructions stored therewith, the computer readable instructions being executable by a processor and comprising:
the computer readable instructions running on the computer detecting an attempt to run an application, the computer readable instructions running on the computer determining if the application is in at least one whitelist and if the application is present in the at least one whitelist, the computer readable instructions running on the computer allows the running of the application;
if the application is not found in the at least one whitelist, the computer readable instructions running on the computer block execution of the application and at least a portion of the application is forwarded to a server for further analyzes;
the computer readable instructions running on the server select the application for analysis and perform the analysis on the application using one or more industry virus scanners against the application;
if the one or more industry virus scanners collectively detects that malicious software exists in the application, the computer readable instructions running on the server notifies regarding a malicious software application and the application is blocked;
if the one or more industry virus scanners fail to detect any malicious software in the application, then further analysis is performed;
if the further analysis indicates that no malicious software exists in the application, the computer readable instructions running on the server updates one or more of the at least one whitelist, and if the further analysis indicates that that there may be malicious software in application, future execution of the application is blocked;
wherein the further research includes the computer readable instructions running on the server running the application in a sandbox and analyzing of a file system of the sandbox, a registry of the sandbox, an input/output subsystem of the sandbox and a communications port of the sandbox, and if the analyzing indicates that there is a virus in the application, the computer readable instructions running on the server add the application to at least one blacklist and future execution of the application is blocked; and
whereas the computer readable instructions running on the server notifies regarding the malicious software by sending an email to a user of the computer.
14. The computer program product of claim 13 , wherein the at least one whitelist and the at least one blacklist are stored and accessed from storage associated with the server.
15. The computer program product of claim 13 , wherein the further research includes the computer readable instructions running on the server searching for patterns in the application using regular expressions and if a pattern known to be the virus is found, the computer readable instructions running on the server adds the application to the at least one blacklist and future execution of the application is blocked.
16. The computer program product of claim 13 , wherein the further research includes the computer readable instructions running on the server reviewing at least two hash values of the application determined from at least two hash algorithms and if any of the at least two hash values is determined to be a hash value of the virus, the computer readable instructions running on the server adds the application to the at least one blacklist and future execution of the application is blocked.
17. The computer program product of claim 13 , wherein when the at least the portion of the application is forwarded to the server for further analyzes, an identification of an invoking application and any command-line parameters are also forwarded to the server.
18. The computer program product of claim 13 , wherein the email includes a description of the malicious software and links to training on how to prevent future intrusions of the malicious software into the computer.