Automated generation of a sandbox configuration for malware detection
A method that automatically generates blacklists for a sandbox application. The method first obtains a set of disassembled operating system (OS) dynamic-link libraries (DLLs) and then identifies application programming interfaces (API) functions that have respective kernel interruptions. The identified API functions that have kernel instructions are saved to an interrupt list. Based on the interrupt list, a processor generates a blacklist that includes for each of the DLLs, the identified API functions in the interrupt list, all API functions that directly or indirectly invoke one of the identified API functions in the interrupt list via one or more nested API functions. The method outputs the blacklist to the sandbox application that operates on a sample file to emulate API functions of the sample file that match the blacklist. All other APIs not identified as being blacklisted, are then considered whitelisted and are allowed to run natively.
1. A method for automatically generating a blacklist for a sandbox application, the method comprising:
obtaining a set of disassembled operating system dynamic-link libraries;
identifying, in the disassembled operating system dynamic-link libraries, a set of API functions;
identifying, from the set of API functions, a subset of API functions the subset of API functions including instructions that cause kernel interrupts;
storing the identified subset of API functions having the instructions that cause kernel interrupts to an interrupt list;
generating, by a processor device, based on the interrupt list, the blacklist that includes for each of the disassembled operating system dynamic-link libraries, the identified API functions in the interrupt list, all API functions that directly invoke one of the identified API functions in the interrupt list, and all API functions that indirectly invokes one of the identified API functions in the interrupt list via one or more nested API functions, wherein generating the blacklist comprises:
identifying an initial set of API functions in the disassembled operating system dynamic-link libraries that each invokes one of the identified API functions in the interrupt list; and
performing a plurality of iterative updates to the blacklist, wherein performing each iteration comprises:
identifying at least one additional API function not on the blacklist that calls one of the API functions on the blacklist; and
adding the at least one additional API function to the blacklist; and
outputting the blacklist to the sandbox application, wherein the sandbox application operates on a sample file to emulate API functions of the sample file that match the blacklist.
2. The method of claim 1 , wherein generating the blacklist further comprises:
detecting that all API functions in the disassembled operating system dynamic-link libraries are either on the blacklist or do not call one of the API functions on the blacklist; and
stopping the plurality of iterative updates for the disassembled operating system dynamic-link libraries.
3. The method of claim 1 , further comprising:
identifying API functions in the disassembled operating system dynamic-link libraries that are not on the blacklist;
storing the API functions that are not on the blacklist to a whitelist; and
outputting the whitelist to the sandbox application.
4. The method of claim 3 , wherein sandbox application natively executes API functions invoked by the sample file that match the whitelist.
5. The method of claim 1 , wherein storing the identified API functions to an interrupt list comprises:
storing, for each of the disassembled operating system dynamic-link libraries, respective partial lists; and
concatenating the partial lists into the interrupt list.
6. The method of claim 1 , wherein identifying the API functions that have the respective kernel interrupt functions comprises:
identifying the API functions that include instructions matching a predefined syntax associated with the respective kernel interrupt functions.
7. A non-transitory computer readable storage medium storing instructions for automatically generating a blacklist for a sandbox application, the instructions when executed by one or more processors causing the one or more processors to perform steps comprising:
obtaining a set of disassembled operating system dynamic-link libraries;
identifying, in the disassembled operating system dynamic-link libraries, a set of API functions;
identifying, from the set of API functions, a subset of API functions the subset of API functions including instructions that cause kernel interrupts;
storing the identified subset of API functions having the instructions that cause kernel interrupts to an interrupt list;
generating, by a processor device, based on the interrupt list, the blacklist that includes for each of the disassembled operating system dynamic-link libraries, the identified API functions in the interrupt list, all API functions that directly invoke one of the identified API functions in the interrupt list, and all API functions that indirectly invokes one of the identified API functions in the interrupt list via one or more nested API functions, wherein generating the blacklist comprises:
identifying an initial set of API functions in the disassembled operating system dynamic-link libraries that each invokes one of the identified API functions in the interrupt list; and
performing a plurality of iterative updates to the blacklist, wherein performing each iteration comprises:
identifying at least one additional API function not on the blacklist that calls one of the API functions on the blacklist; and
adding the at least one additional API function to the blacklist; and
outputting the blacklist to the sandbox application, wherein the sandbox application operates on a sample file to emulate API functions of the sample file that match the blacklist.
8. The non-transitory computer readable storage medium of claim 7 , wherein generating the blacklist further comprises:
detecting that all API functions in a disassembled operating system dynamic-link library are either on the blacklist or do not call one of the API functions on the blacklist; and
stopping the plurality of iterative updates for the disassembled operating system dynamic-link library.
9. The non-transitory computer readable storage medium of claim 7 , wherein the instructions when executed further cause the one or more processors to perform steps including:
identifying API functions in the disassembled operating system dynamic-link libraries that are not on the blacklist;
storing the API functions that are not on the blacklist to a whitelist; and
outputting the whitelist to the sandbox application.
10. The non-transitory computer readable storage medium of claim 9 , wherein sandbox application natively executes API functions invoked by the sample file that match the whitelist.
11. The non-transitory computer readable storage medium of claim 7 , wherein storing the identified API functions to an interrupt list comprises:
storing, for each of the disassembled operating system dynamic-link libraries, respective partial lists; and
concatenating the partial lists into the interrupt list.
12. The non-transitory computer readable storage medium of claim 7 , wherein identifying the API functions that have the respective kernel interrupt functions comprises:
identifying the API functions that include instructions matching a predefined syntax associated with the respective kernel interrupt functions.
13. A computer system comprising:
one or more processors; and
a non-transitory computer readable storage medium storing instructions for automatically generating a blacklist for a sandbox application, the instructions when executed by one or more processors causing the one or more processors to perform steps comprising:
obtaining a set of disassembled operating system dynamic-link libraries;
identifying, in the disassembled operating system dynamic-link libraries, a set of API functions;
identifying, from the set of API functions, a subset of API functions the subset of API functions including instructions that cause kernel interrupts;
storing the identified subset of API functions having the instructions that cause kernel interrupts to an interrupt list;
generating, by a processor device, based on the interrupt list, the blacklist that includes for each of the disassembled operating system dynamic-link libraries, the identified API functions in the interrupt list, all API functions that directly invoke one of the identified API functions in the interrupt list, and all API functions that indirectly invokes one of the identified API functions in the interrupt list via one or more nested API functions, wherein generating the blacklist comprises:
identifying an initial set of API functions in the disassembled operating system dynamic-link libraries that each invokes one of the identified API functions in the interrupt list; and
performing a plurality of iterative updates to the blacklist, wherein performing each iteration comprises:
identifying at least one additional API function not on the blacklist that calls one of the API functions on the blacklist; and
adding the at least one additional API function to the blacklist; and
outputting the blacklist to the sandbox application, wherein the sandbox application operates on a sample file to emulate API functions of the sample file that match the blacklist.
14. The computer system of claim 13 , wherein generating the blacklist further comprises:
detecting that all API functions in a disassembled operating system dynamic-link library are either on the blacklist or do not call one of the API functions on the blacklist; and
stopping the plurality of iterative updates for the disassembled operating system dynamic-link library.
15. The computer system of claim 13 , wherein the instructions when executed further cause the one or more processors to perform steps including:
identifying API functions in the disassembled operating system dynamic-link libraries that are not on the blacklist;
storing the API functions that are not on the blacklist to a whitelist; and
outputting the whitelist to the sandbox application.
16. The computer system of claim 15 , wherein sandbox application natively executes API functions invoked by the sample file that match the whitelist.
17. The computer system of claim 13 , wherein storing the identified API functions to an interrupt list comprises:
storing, for each of the disassembled operating system dynamic-link libraries, respective partial lists; and
concatenating the partial lists into the interrupt list.
18. The computer system of claim 13 , wherein identifying the API functions that have the respective kernel interrupt functions comprises:
identifying the API functions that include instructions matching a predefined syntax associated with the respective kernel interrupt functions.