Systems and methods for analyzing process chains to detect malicious behavior
Disclosed herein are systems and method for malicious behavior detection in processing chains comprising identifying a chain of related processes executing on a computing device; for each respective process in the chain of related processes: monitoring events generated by the respective process; storing snapshots of data modified by any of the events; determining a level of suspicion for the respective process by applying an artificial intelligence (AI) model to the snapshots of data; determining whether the chain of related processes is trusted based on the determined levels of suspicion; and in response to determining that the chain of related processes is not trusted, restoring objects affected by the chain from the snapshots.
1. A method for malicious behavior detection in processing chains, the method comprising:
identifying a chain of related processes executing on a computing device;
for each respective process in the chain of related processes:
monitoring events generated by the respective process;
storing snapshots of data modified by any of the events;
determining a level of suspicion for the respective process by applying an artificial intelligence (AI) model to the snapshots of data, wherein the level of suspicion is a likelihood of the respective process being attributed to malware based on the data modified by any of the events;
determining whether the chain of related processes is trusted based on the determined levels of suspicion;
in response to determining that the chain of related processes is not trusted, restoring objects affected by the chain from the snapshots.
2. The method of claim 1 , wherein identifying the chain of related processes comprises:
identifying at least two processes with a relationship comprising one or more of:
a parent-child relationship;
injector-injected relationship;
a software-component relationship; or
a process-thread relationship.
3. The method of claim 1 , wherein the chain of related processes comprises a first process with a first level of suspicion, and wherein determining whether the chain of related processes is trusted comprises:
in response to determining that (1) the first level of suspicion is below a predetermined threshold value and (2) all remaining processes in the chain are sub-processes of the first process, determining that the chain is not trusted.
4. The method of claim 1 , wherein determining whether the chain of related processes is trusted further comprises:
identifying a first amount of processes in the chain that have respective levels of suspicion each below a predetermined threshold value; and
in response to determining that the first amount of processes is greater than a threshold amount of untrusted processes, determining that the chain of related processes is not trusted.
5. The method of claim 1 , wherein the chain of related processes comprises a first process and a sub-process of the first process, and wherein determining whether the chain of related processes is trusted further comprises:
in response to determining that (1) a first level of suspicion of the first process is less than a predetermined threshold value and (2) a second level of suspicion of the sub-process is greater than the predetermined threshold value:
isolating the sub-process from the chain of related processes; and
determining that the chain of related processes is trusted.
6. The method of claim 1 , further comprising:
in response to determining that the chain of related processes is trusted, deleting the snapshots and ceasing the monitoring.
7. The method of claim 1 , further comprising:
in response to determining that the chain of related processes is trusted, marking the chain of related processes as trusted; and
in response to determining that the chain of related processes is not trusted, marking the chain of related processes as not trusted.
8. The method of claim 1 , wherein the objects comprise one or more of files, records, system settings, task queues, or database records.
9. The method of claim 1 , wherein the AI model is configured to determine the level of suspicion based on training data comprising historic events pre-classified by trustworthiness.
10. A system for malicious behavior detection in processing chains, the system comprising:
a hardware processor configured to:
identify a chain of related processes executing on a computing device;
for each respective process in the chain of related processes:
monitor events generated by the respective process;
store snapshots of data modified by any of the events;
determine a level of suspicion for the respective process by applying an artificial intelligence (AI) model to the snapshots of data, wherein the level of suspicion is a likelihood of the respective process being attributed to malware based on the data modified by any of the events;
determine whether the chain of related processes is trusted based on the determined levels of suspicion;
in response to determining that the chain of related processes is not trusted, restore objects affected by the chain from the snapshots.
11. The system of claim 10 , wherein the hardware processor is configured to identify the chain of related processes by:
identifying at least two processes with a relationship comprising one or more of:
a parent-child relationship;
injector-injected relationship;
a software-component relationship; or
a process-thread relationship.
12. The system of claim 10 , wherein the chain of related processes comprises a first process with a first level of suspicion, and wherein the hardware processor is configured to determine whether the chain of related processes is trusted by:
in response to determining that (1) the first level of suspicion is below a predetermined threshold value and (2) all remaining processes in the chain are sub-processes of the first process, determining that the chain is not trusted.
13. The system of claim 10 , wherein the hardware processor is configured to determine whether the chain of related processes is trusted by:
identifying a first amount of processes in the chain that have respective levels of suspicion each below a predetermined threshold value; and
in response to determining that the first amount of processes is greater than a threshold amount of untrusted processes, determining that the chain of related processes is not trusted.
14. The system of claim 10 , wherein the chain of related processes comprises a first process and a sub-process of the first process, and wherein the hardware processor is configured to determine whether the chain of related processes is trusted by:
in response to determining that (1) a first level of suspicion of the first process is less than a predetermined threshold value and (2) a second level of suspicion of the sub-process is greater than the predetermined threshold value:
isolating the sub-process from the chain of related processes for further monitoring; and
determining that the chain of related processes is trusted.
15. The system of claim 10 , wherein the hardware processor is configured to:
in response to determining that the chain of related processes is trusted, delete the snapshots and cease the monitoring.
16. The system of claim 10 , wherein the hardware processor is configured to:
in response to determining that the chain of related processes is trusted, mark the chain of related processes as trusted; and
in response to determining that the chain of related processes is not trusted, mark the chain of related processes as untrusted.
17. The system of claim 10 , wherein the objects comprise one or more of files, records, system settings, task queues, or database records.
18. The system of claim 10 , wherein the AI model is configured to determine the level of suspicion based on training data comprising historic events pre-classified by trustworthiness.
19. A non-transitory computer readable medium storing thereon computer executable instructions for malicious behavior detection in processing chains, including instructions for:
identifying a chain of related processes executing on a computing device;
for each respective process in the chain of related processes:
monitoring events generated by the respective process;
storing snapshots of data modified by any of the events;
determining a level of suspicion for the respective process by applying an artificial intelligence (AI) model to the snapshots of data, wherein the level of suspicion is a likelihood of the respective process being attributed to malware based on the data modified by any of the events;
determining whether the chain of related processes is trusted based on the determined levels of suspicion;
in response to determining that the chain of related processes is not trusted, restoring objects affected by the chain from the snapshots.