Systems and methods for automatically generating malware countermeasures

1. A method comprising:

running a virtual machine (VM) that has an operating system configured with a monitoring subsystem, the monitoring subsystem configured to generate event data based on a plurality of events occurring on the virtual machine;

running a classifier configured to detect a malware based on the plurality of events;

running a sample on the virtual machine, the classifier detecting the malware in the sample;

running a countermeasure compiler that uses the event data to generate a countermeasure data for a countermeasure to the malware; and

producing the countermeasure by storing the countermeasure data in a resource data section of a precompiled template that includes executable code configured to interpret the countermeasure data,

wherein the countermeasure is an executable file, and

wherein executing the countermeasure on a computer executes the executable code to thereby inoculate the computer from infection by the malware or disinfect the computer by removing the malware from the computer,

wherein the monitoring subsystem is configured to:

run within a kernel of the operating system,

monitor a first process not associated with the sample,

monitor a second process,

monitor a tripwire file,

monitor a system file, and

to monitor an operating system registry; and

wherein the classifier is configured to:

run within the kernel of the operating system,

detect the malware based on the sample modifying the tripwire file,

detect the malware based on the sample modifying the system file,

detect the malware based on the sample terminating the first process,

detect the malware based on a type of access to the second process requested by the sample,

detect the malware based on an identity of the second process accessed by the sample, and

detect the malware based on the sample modifying or deleting a registry entry that the sample did not create.

2. The method of claim 1 wherein the classifier is run within a kernel of the operating system.

3. The method of claim 1 wherein detecting the malware triggers generating the countermeasure.

4. The method of claim 1 wherein:

the countermeasure compiler is configured to-generate the countermeasure data by compiling an analysis log file comprising the event data; and

the VM cannot read the analysis log file.

5. The method of claim 1 , the classifier configured to detect the malware based on the sample terminating a process monitored by the monitoring subsystem and that is not associated with the sample.

6. The method of claim 1 , wherein running the countermeasure on the computer detects that the computer is infected with the malware.

7. The method of claim 1 , wherein running the countermeasure on the computer removes the malware from the computer.

8. The method of claim 1 , wherein running the countermeasure on the computer inoculates the computer from infection by the malware.

9. A system comprising:

a memory configured to store a precompiled template that includes executable code and a resource data section;

a processor operatively coupled to the memory and configured to run a virtual machine (VM) that is running an operating system, the VM configured to run a sample comprising a malware;

a monitoring subsystem running on the VM, the monitoring subsystem configured to generate event data based on a plurality of events occurring on the VM;

a classifier configured to detect the malware based on the plurality of events; and

a countermeasure compiler configured to generate a countermeasure data for a countermeasure to the malware from the event data,

wherein the countermeasure is an executable file produced by storing the countermeasure data in the resource data section,

wherein the executable code is configured to interpret the countermeasure data,

wherein executing the countermeasure on a computer executes the executable code and inoculates the computer from infection by the malware,

wherein the monitoring subsystem is configured to:

run within a kernel of the operating system,

monitor a first process not associated with the sample,

monitor a second process,

monitor a tripwire file,

monitor a system file, and

to monitor an operating system registry; and

wherein the classifier is configured to:

run within the kernel of the operating system,

detect the malware based on the sample modifying the tripwire file,

detect the malware based on the sample modifying the system file,

detect the malware based on the sample terminating the first process,

detect the malware based on a type of access to the second process requested by the sample,

detect the malware based on an identity of the second process accessed by the sample, and

detect the malware based on the sample modifying or deleting a registry entry that the sample did not create.

10. The system of claim 9 , further including a classifier bitmap that includes a plurality of event identifiers, wherein:

each of the event identifiers includes an engine identifier that indicates a source of an event and an event code that indicates an event type; and

the classifier is configured to two of the event identifiers to detect the malware.

11. The system of claim 9 wherein the classifier is run within a kernel of the operating system.

12. The system of claim 9 wherein generating the countermeasure is triggered by detecting the malware.

13. The system of claim 9 wherein the countermeasure is configured to:

detect the malware on the computer,

remove the malware from the computer, and

prevent the computer from running a malware process.

14. A non-transitory computer readable medium storing computer readable instructions, that when executed on one or more processors, implements a method comprising:

running a virtual machine with an operating system configured with a monitoring subsystem, the monitoring subsystem configured to generate event data based on a plurality of events occurring on the virtual machine;

running a classifier configured to detect a malware based on the plurality of events;

running a sample on the virtual machine, the classifier detecting the malware in the sample; and

running a countermeasure compiler that generates a countermeasure to the malware, the countermeasure based on the event data,

wherein the countermeasure includes at least one executable instruction,

wherein executing the at least one executable instruction on a computer inoculates the computer from infection by the malware,

wherein the monitoring subsystem is configured to:

run within a kernel of the operating system,

monitor a first process not associated with the sample,

monitor a second process,

monitor a tripwire file, and

monitor a system file; and

wherein the classifier is configured to:

detect the malware based on the sample modifying the tripwire file,

detect the malware based on the sample modifying the system file,

detect the malware based on the sample terminating the first process,

detect the malware based on a type of access to the second process requested by the sample, and

detect the malware based on an identity of the second process accessed by the sample.

15. The non-transitory computer readable medium storing computer readable instructions of claim 14 , wherein the countermeasure is stored on a second non-transitory computer readable medium storing additional computer readable instructions, that when executed by a computer, implement a countermeasure method comprising:

detecting the malware on the computer, and

removing the malware from the computer.