Just in time memory analysis for malware detection
Methods and apparatus consistent with the present disclosure may use instrumentation code that remains transparent to an application program that the instrumentation code has been injected into. In certain instances, data sets that include executable code may be received via packetized communications or be received via other means, such as, receiving a file from a data store. The present technique allows a processor executing instrumentation code to monitor actions performed by the program code included in a received data set. Malware may be detected by scanning suspect program code with a malware scanner, malware may be detected by identifying suspicious actions performed by a set of program code, or malware may be detected by a combination of such techniques.
1. A method for analyzing computer data, the method comprising:
allowing instructions of a set of computer data to be executed by a processor;
monitoring actions performed by the execution of the instructions of the set of computer data, the monitoring performed by the processor executing a set of instrumentation code instructions;
pausing execution of the instructions of the computer data based on an identification that the monitored actions include writing data to a memory;
identifying that the monitored actions correspond to an access pattern of the memory that includes allocating a portion of the memory and includes invocation of an operating system program function, wherein the data written to the memory is written to a newly allocated memory portion;
comparing a signature generated from the data written to the allocated memory portion of the memory to a malware signature generated from previously identified malicious code; and
performing a corrective action based on an identification that the generated signature matches the malware signature.
2. The method of claim 1 , further comprising identifying that the monitored actions include de-obfuscating the data written to the allocated memory portion of the memory.
3. The method of claim 1 , further comprising generating the signature by scanning the data written to the allocated memory portion of the memory with a deep packet inspection (DPI) scanner.
4. The method of claim 1 , further comprising identifying that the monitored actions include unpacking of the data from the set of computer data before the data is written to the allocated memory portion of the memory.
5. The method of claim 1 , further comprising identifying that the monitored actions include marking the data written to the allocated memory portion of the memory as executable.
6. The method of claim 1 , further comprising:
identifying that a first action of the monitored actions corresponds to a first memory access state;
identifying that a second action of the monitored actions corresponds to a second memory access state;
identifying that the execution of the instructions of set of computer data has performed a suspicious behavior, the identification based on the first action occurring before the second action and based on a rule that identifies that the signature should be generated when the first memory access state occurs before the second memory access state; and
generating the signature according to the rule.
7. A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for analyzing computer data, the method comprising:
allowing instructions of a set of computer data to be executed by a processor;
monitoring actions performed by the execution of the instructions of the set of computer data, the monitoring performed by the processor executing a set of instrumentation code instructions;
pausing execution of the instructions of the computer data based on an identification that the monitored actions include writing data to a memory;
identifying that the monitored actions correspond to an access pattern of the memory that includes allocating a portion of the memory and includes invocation of an operating system program function, wherein the data written to the memory is written to a newly allocated memory portion;
comparing a signature generated from the data written to the allocated memory portion to a malware signature generated from previously identified malicious code; and
performing a corrective action based on an identification that the generated signature matches the malware signature.
8. The non-transitory computer-readable storage medium of claim 7 , the program further executable to identify that the monitored actions include de-obfuscating the data written to the allocated memory portion.
9. The non-transitory computer-readable storage medium of claim 7 , the program further executable to generate the signature by scanning the data written to the allocated memory portion with a deep packet inspection (DPI) scanner.
10. The non-transitory computer-readable storage medium of claim 7 , the program further executable to identify that the monitored actions include unpacking of the data from the set of computer data before the data is written to the allocated memory portion.
11. The non-transitory computer-readable storage medium of claim 7 , the program further executable to identify that the monitored actions include marking the data written to the allocated memory portion as executable.
12. The non-transitory computer-readable storage medium of claim 7 , the program further executable to:
identify that a first action of the monitored actions corresponds to a first memory access state;
identify that a second action of the monitored actions corresponds to a second memory access state;
identify that the execution of the instructions of set of computer data has performed a suspicious behavior, the identification based on the first action occurring before the second action and based on a rule that identifies that the signature should be generated when the first memory access state occurs before the second memory access state; and
generate the signature according to the rule.
13. An apparatus for analyzing computer data, the apparatus comprising:
a memory; and
a processor that executes instructions out of the memory to:
execute instructions of a set of computer data;
monitor actions performed by the execution of the instructions of the set of computer data, the monitoring performed by the processor executing a set of instrumentation code instructions, pause execution of the instructions of the computer data based on an identification that the monitored actions include writing data to the memory,
identify that the monitored actions correspond to an access pattern of the memory that includes allocating a portion of the memory and includes invocation of an operating system program function, wherein the data written to the memory is written to a newly allocated memory portion,
compare a signature generated from the data written to the allocated memory portion to a malware signature generated from previously identified malicious code, and
perform a corrective action based on an identification that the generated signature matches the malware signature.
14. The apparatus of claim 13 , wherein the execution of the set of instrumentation code instructions allow the processor to identify that the monitored actions include de-obfuscating the data written to the allocated memory portion.
15. The apparatus of claim 13 , further comprising instructions of a set of deep packet inspection (DPI) program code, wherein execution of the instructions of the set of DPI program code generate the signature.