Malware management using I/O correlation coefficients
View Patent ↗A malware attack is detected in a computing system by monitoring file I/O and coordinated network I/O traffic and referencing criteria including a correlation coefficient calculated relative to the I/O. If the file I/O and coordinated network I/O was initiated by an executing process that meets criteria indicative of malware, a correlation coefficient is calculated with respect to the file I/O and coordinated network I/O. The executing process is identified as malware if a threshold criteria is met that considers the correlation coefficient.
1. A method of detecting malware in a computing system, comprising:
monitoring, by a device, a first file input/output and a coordinated network input/output traffic in the computing system;
detecting that the first file input/output and the coordinated network input/output traffic are initiated by an executing process that meets a first criteria indicative of malware;
calculating a correlation coefficient, with respect to the first file input/output and coordinated network input/output traffic initiated by the executing process, in an event that the executing process meets the first criteria indicative of malware; and
identifying the executing process as malware in an event that a second threshold criteria is met comprising the correlation coefficient.
2. The method of claim 1 wherein the malware comprises at least one of a ransomware, virus, trojan, worm, adware spyware, or combinations thereof.
3. The method of claim 1 further comprising at least one of copying a data content of a first file to a backup location, identifying a network end-point for the coordinated network input/output traffic, or a combination thereof.
4. The method of claim 1 wherein the first criteria indicative of malware comprises at least one of a program source file of the executing process being recently created within a threshold time period, the executing process causing an abnormal file input/output activity associated with a first file input/output activity, the executing process causing an abnormal network input/output activity associated with a network input/output activity, or combinations thereof.
5. The method of claim 1 further comprising applying a machine learning model to the computing system to identify a system-normal file input/output and network input/output activity of the computing system.
6. The method of claim 5 wherein the machine learning model comprises a clustering based technique, a supervised method, or a combination thereof.
7. The method of claim 5 wherein, in an event the first file input/output and coordinated network input/output does not meet the system-normal file input/output and network input/output activity identified by the machine learning model, then the first file input/output and coordinated network input/output activity is categorized as an abnormal first file input/output and coordinated network input/output activity and defines a component of the first criteria indicative of malware.
8. The method of claim 1 wherein the correlation coefficient is calculated with respect to at least one of:
a first set of data read from a first file as detected from the first file input/output, and a second set of data written to the first file or a second file as detected from the first file input/output; or
a third set of data identifying a file operation associated with the first file, and a fourth set of data associated with the first file as detected over a network from the coordinated network input/output traffic.
9. The method of claim 8 wherein the correlation coefficient comprises at least one of:
a first correlation coefficient calculated with respect to the first set of data and the second set of data;
a second correlation coefficient calculated with respect to the third set of data and the fourth set of data; or
a combination thereof.
10. The method of claim 9 wherein the second threshold criteria is met comprising the correlation coefficient in an event that the first correlation coefficient meets a first correlation threshold value, the second correlation coefficient meets a second correlation threshold value, and a file operation event is detected with respect to the first file input/output.
11. The method of claim 9 wherein the second threshold criteria is met comprising the correlation coefficient in an event that the first correlation coefficient meets a first correlation threshold value, a file operation event occurs with respect to the first file input/output, and the fourth set of data associated with the first file is detected over the network from the coordinated network input/output traffic.
12. The method of claim 1 further comprising, in an event that the executing process is identified as malware, initiating at least one of:
blocking an opening of any new files by the executing process;
allowing a completion of any read, write, and backup activity for any currently opened files in the computing system;
blocking a transmission of data to a network end-point of the coordinated network input/output traffic;
providing information relating to the malware to distributed networked computing devices to take preventative measures; or
combinations thereof.
13. The method of claim 1 further comprising:
queueing a file operation delete call for the first file, returning the file operation delete call as a success, then deleting the first file after confirming with a system administrator of the computing system;
requiring an authentication from the system administrator before deleting the first file;
copying the first file to a safe location before deleting it;
pre-setting the computing system into a salvage mode so that the first file is not deleted and remains recoverable; or
combinations thereof.
14. A malware management system for managing malware in a computing system comprising at least one processor and instructions that when executed by the at least one processor cause the at least one processor to:
monitor a first file input/output and a coordinated network input/output traffic in the computing system;
detect that the first file input/output and the coordinated network input/output traffic are initiated by an executing process that meets first criteria indicative of malware;
calculate a correlation coefficient, with respect to the first file input/output and coordinated network input/output traffic initiated by the executing process, in an event that the executing process meets the first criteria indicative of malware; and
identify the executing process as malware in an event that a second threshold criteria is met comprising the correlation coefficient.
15. The system of claim 14 wherein the first criteria indicative of malware comprises at least one of a program source file of the executing process being recently created within a threshold time period, the executing process causing an abnormal file input/output activity associated with a first file input/output activity, the executing process causing an abnormal network input/output activity associated with a network input/output activity, or combinations thereof.
16. The system of claim 14 further comprising instructions that when executed by the at least one processor cause the at least one processor to apply a machine learning model to the computing system to identify a system-normal file input/output and network input/output activity of the computing system, and in an event that the first file input/output and coordinated network input/output does not meet the system-normal file input/output and network input/output activity, then the instructions, when executed by the at least one processor, cause the at least one processor to categorize the first file input/output and coordinated network input/output activity as an abnormal first file input/output and coordinated network input/output activity indicative of defining a component of the first criteria indicative of malware.
17. The system of claim 14 wherein the correlation coefficient is calculated with respect to at least one of:
a first set of data read from a first file as detected from the first file input/output, and a second set of data written to the first file or a second file as detected from the first file input/output; or
a third set of data identifying a file operation event associated with the first file, and a fourth set of data associated with the first file as detected over a network from the coordinated network input/output traffic.
18. The system of claim 17 wherein the correlation coefficient comprises at least one of:
a first correlation coefficient calculated with respect to the first set of data and the second set of data;
a second correlation coefficient calculated with respect to the third set of data and the fourth set of data; or
a combination thereof.
19. The system of claim 18 wherein the second threshold criteria is met comprising the correlation coefficient in an event of at least one of:
the first correlation coefficient meets a first correlation threshold value, the second correlation coefficient meets a second correlation threshold value, and a file operation event is detected with respect to the first file input/output; or
the first correlation coefficient meets a first correlation threshold value, a file operation event occurs with respect to the first file input/output, and the fourth set of data associated with the first file is detected over the network from the coordinated network input/output traffic.
20. A non-transitory machine-readable storage medium storing instructions that when executed by at least one processor cause the at least one processor to:
monitor a first file input/output and a coordinated network input/output traffic in the computing system;
detect that the first file input/output and the coordinated network input/output traffic are initiated by an executing process that meets initial criteria indicative of malware;
calculate a correlation coefficient, with respect to the first file input/output and coordinated network input/output traffic initiated by the executing process, in an event that the executing process meets the initial criteria indicative of malware; and
identify the executing process as malware in an event that a second threshold criteria is met comprising the correlation coefficient.