System, apparatus and method for automatically verifying exploits within suspect objects and highlighting the display information associated with the verified exploits
According to one embodiment, a threat detection system comprising an intrusion protection system (IPS) logic, a virtual execution logic and a reporting logic is shown. The IPS logic is configured to receive a first plurality of objects and analyze the first plurality of objects to identify a second plurality of objects as potential exploits, the second plurality of objects being a subset of the first plurality of objects and being lesser or equal in number to the first plurality of objects. The virtual execution logic including at least one virtual machine configured to process content within each of the second plurality of objects and monitor for anomalous behaviors during the processing that are indicative of exploits to classify that a first subset of the second plurality of objects includes one or more verified exploits. The reporting logic configured to provide a display of exploit information associated with the one or more verified exploits.
1. A method for highlighting exploits verified through a plurality of analyses, comprising:
conducting one or more analyses on received objects to determine whether each of a plurality of objects from the received objects corresponds to an exploit, wherein the plurality of objects includes (i) a first subset of objects from the plurality of objects identified as a first type of exploit constituting a verified exploit and (ii) a second subset of objects from a remainder of the plurality of objects identified as a second type of exploit constituting a non-verified exploit; and
generating a report to be provided to one or more endpoint devices for display on a display device, the report is configured to highlight each of the first subset of objects associated with the first type of exploit to visibly denote and distinguish the first subset of objects from the second subset of objects associated with the second type of exploit.
2. The method of claim 1 , wherein information associated with the first subset of objects pertaining to the first type of exploit is highlighted by at least altering locations of the information associated with the first subset of objects to a particular location on a screen display that is different from locations for information associated with the second subset of objects pertaining to the second type of exploit.
3. The method of claim 1 , wherein information associated with the first subset of objects pertaining to the first type of exploit is highlighted by at least modifying a font used in display of the information associated with the first subset of objects to be different from a font used in display of the information associated with the second subset of objects pertaining to the second type of exploit.
4. The method of claim 3 , wherein the modifying of the font used in display of the information associated with the first subset of objects includes modifying a color or a size of the font used in the display of the information associated with the first subset of objects from a color or size of the font used in the display of the information associated with the second subset of objects pertaining to the second type of exploit.
5. The method of claim 3 , wherein the modifying of the font used in display of the information associated with the first subset of objects includes modifying a type or a style of the font used in the display of the information associated with the first subset of objects from a type or a style of the font used in the display of the information associated with the second subset of objects pertaining to the second type of exploit.
6. The method of claim 1 , wherein information associated with the first subset of objects pertaining to the first type of exploit is highlighted by altering an ordering of a display of the information associated with the first subset of objects to emphasize the first subset of objects over the second subset of objects pertaining to the second type of exploit.
7. The method of claim 1 , wherein information associated with the first subset of objects pertaining to the first type of exploit is highlighted by placing one or more additional images proximate to a display of information associated with each of the first subset of objects while no additional images are placed proximate to a display of information associated with the second subset of objects.
8. The method of claim 1 , wherein the one or more analyses performed on each of the plurality of objects includes a dynamic analysis that identifies behaviors produced in response to execution of an exploit.
9. The method of claim 1 , wherein an exploit is information that attempts to take advantage of a vulnerability in computer software by adversely influencing or attacking operations of a targeted computer.
10. The method of claim 1 , wherein an exploit pertains to malware adapted to harm or co-opt operation of an electronic device or misappropriate, modify or delete data.
11. The method of claim 1 , wherein the conducting of the one or more analyses on the received objects comprises generating one or more scores associated with a suspect object of the received objects that is used to verify that the suspect object is likely an exploit.
12. A non-transitory storage medium including software that, when executed by one or more processors, highlights displayed data associated with detected exploits verified through a plurality of analyses and perform operations, comprising:
conducting one or more analyses on received objects to determine whether each of a plurality of objects from the received objects is associated with an exploit, wherein the plurality of objects includes (i) a first subset of objects from the plurality of objects identified as a first type of exploit constituting a verified exploit and (ii) a second subset of objects from a remainder of the plurality of objects identified as a second type of exploit constituting a non-verified exploit; and
generating a report to be provided to one or more endpoint devices for display on a display device, the report is configured to highlight each of the first subset of objects associated with the first type of exploit to visibly denote and distinguish the first subset of objects from the second subset of objects associated with the second type of exploit.
13. The non-transitory storage medium of claim 12 , wherein displayed data associated with the first subset of objects pertaining to the first type of exploit is highlighted by altering locations of the displayed data to a particular location on a screen display that is different from locations for displayed data associated with the second subset of objects pertaining to the second type of exploit.
14. The non-transitory storage medium of claim 12 , wherein displayed data associated with the first subset of objects pertaining to the first type of exploit is highlighted by modifying a font used in display of the displayed data associated with the first subset of objects to be different from a font used for displayed data associated with the second subset of objects pertaining to the second type of exploit.
15. The non-transitory storage medium of claim 14 , wherein the modifying of the font used for the displayed data associated with the first subset of objects includes modifying a color or a size of the font used for the displayed data associated with the first subset of objects from a color or size of the font used for the displayed data associated with the second subset of objects pertaining to the second type of exploit.
16. The non-transitory storage medium of claim 14 , wherein the modifying of the font used for the displayed data associated with the first subset of objects includes modifying a type or a style of the font used for the displayed data associated with the first subset of objects from a type or a style of the font used for the displayed data associated with the second subset of objects pertaining to the second type of exploit.
17. The non-transitory storage medium of claim 12 , wherein displayed data associated with the first subset of objects pertaining to the first type of exploit is highlighted by altering an ordering of the displayed data associated with the first subset of objects to emphasize the first subset of objects over the second subset of objects pertaining to the second type of exploit.
18. The non-transitory storage medium of claim 12 , wherein displayed data associated with the first subset of objects pertaining to the first type of exploit is highlighted by placing one or more additional images proximate to the displayed data associated with each of the first subset of objects while no additional images are placed proximate to displayed data associated with the second subset of objects.
19. The non-transitory storage medium of claim 12 , wherein the one or more analyses performed on each of the plurality of objects includes a dynamic analysis that identifies behaviors produced in response to execution of the exploit.
20. The non-transitory storage medium of claim 12 , wherein an exploit is information that attempts to take advantage of a vulnerability in computer software by adversely influencing or attacking normal operations of a targeted computer.
21. The non-transitory storage medium of claim 12 , wherein an exploit pertains to malware adapted to harm or co-opt operation of an electronic device or misappropriate, modify or delete data.
22. The non-transitory storage medium of claim 12 , wherein the conducting of the one or more analyses on the received object comprises generating one or more scores associated with a suspect object of the received objects that is used to verify that the suspect object is likely an exploit.
23. An electronic device operating in part as a cloud-based service, comprising:
logic stored in a non-transitory storage medium, the logic is configured, when executed, to conduct one or more analyses on received objects to determine whether each of a plurality of objects from the received objects is associated with an exploit, wherein the plurality of objects includes (i) a first subset of objects from the plurality of objects identified as a first type of exploit constituting a verified exploit and (ii) a second subset of objects from a remainder of the plurality of objects identified as a second type of exploit constituting a non-verified exploit; and
reporting logic to generate a report to be provided to one or more endpoint devices for display on a display device, the report is configured to highlight each of the first subset of objects associated with the first type of exploit to visibly denote and distinguish the first subset of objects from the second subset of objects associated with the second type of exploit.
24. The electronic device of claim 23 , wherein displayed data associated with the first subset of objects pertaining to the first type of exploit is highlighted by altering locations of the displayed data to a particular location on a screen utilized by the electronic device to display the displayed data associated with the first subset of objects in different locations on the display screen than displayed data associated with the second subset of objects pertaining to the second type of exploit.
25. The electronic device of claim 23 , wherein displayed data associated with the first subset of objects pertaining to the first type of exploit is highlighted by modifying a font used in display of the displayed data associated with the first subset of objects to be different from a font used for displayed data associated with the second subset of objects pertaining to the second type of exploit.
26. The electronic device of claim 25 , wherein the reporting logic to modify the font used for the displayed data associated with the first subset of objects includes modifying a color or a size of the font used for the displayed data associated with the first subset of objects from a color or size of the font used for the displayed data associated with the second subset of objects pertaining to the second type of exploit.
27. The electronic device of claim 25 , wherein the reporting logic to modify the font used for the displayed data associated with the first subset of objects includes modifying a type or a style of the font used for the displayed data associated with the first subset of objects from a type or a style of the font used for the displayed data associated with the second subset of objects pertaining to the second type of exploit.
28. The electronic device of claim 23 , wherein displayed data associated with the first subset of objects pertaining to the first type of exploit is highlighted by (i) altering an ordering of the displayed data associated with the first subset of objects to emphasize the first subset of objects over the second subset of objects pertaining to the second type of exploit or (ii) placing one or more additional images proximate to the displayed data associated with each of the first subset of objects while no additional images are placed proximate to displayed data associated with the second subset of objects.
29. The electronic device of claim 23 , wherein the one or more analyses performed on each of the plurality of objects by the logic, when executed, includes a dynamic analysis that identifies behaviors produced in response to execution of the exploit.
30. The electronic device of claim 23 , wherein an exploit is information that attempts to take advantage of a vulnerability in computer software by adversely influencing or attacking normal operations of a targeted computer.
31. The electronic device of claim 23 , wherein an exploit pertains to malware adapted to harm or co-opt operation of an electronic device or misappropriate, modify or delete data.
32. The electronic device of claim 23 , wherein the conducting of the one or more analyses on the received object by the logic, when executed, comprises generating one or more scores associated with a suspect object of the received objects that is used to verify that the suspect object is likely an exploit.