Malware detection system

Inventors: Austin James Gadient (Albuquerque, NM); Donald Benson Reaves (Pittsford, NY); Anthony James Gadient (Charlottesville, VA)

Assignee: Vali Cyber, Inc.

G06F21/554 G06F11/1469 G06F21/552 G06F21/565 G06F21/566

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12,141,277
App. No.: 17/650,149
Granted: Nov 12, 2024
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A behavioral monitor executing in user space generates a plurality of filters corresponding to a plurality of processes executing in the user space. A first process transmits a system call to a corresponding filter of the plurality of filters in kernel space. The first process receives a signal from the corresponding filter. The first process analyzes the arguments submitted in the system call. The first process determines that the arguments may be associated with malicious activity. The first process generates an event and transmitting the event to the behavioral monitor. The behavioral monitor analyzes the event to determine whether the event is associated with malicious activity. The behavioral monitor causes a process group associated with the first process to cease executing and restores a previous version of the at least one file modified by the process group.

Claims (75)

1. A method for detecting malicious activity in a computing system comprising a user space and a kernel space, the method comprising:

generating, by a behavioral monitor executing in the user space, a plurality of filters in the kernel space, the plurality of filters corresponding to a plurality of processes executing in the user space, the plurality of filters generated by injecting code into the plurality of processes executing in the user space, the code creating signal handlers for each process;

transmitting, by a first process of the plurality of processes, a system call to the kernel space;

intercepting, by a first filter of the plurality of filters, the system call, wherein the first filter in the kernel space was created in association with the first process;

analyzing, by the first filter, the system call to determine how to process the system call based on one or more predefined rules stored at the first filter;

based on the analyzing, sending, by the first filter, a signal to a first signal handler associated with the first process, the signal prompting the first process to analyze arguments submitted in the system call;

responsive to receiving the signal from the first filter, analyzing, by the first process, the arguments submitted in the system call, wherein analyzing the arguments comprises:

determining that the first process or a process related to the first process has modified at least one file and/or data;

determining, by the first process, that the arguments may be associated with malicious activity;

responsive to the determining, generating, by the first process, an event and transmitting the event to the behavioral monitor, the event indicating that the first process has modified at least one file and/or data;

analyzing, by the behavioral monitor, the event to determine whether the event is associated with malicious activity, wherein analyzing the event comprises:

generating a copy of the at least one file and/or data prior to being modified by the first process, and

saving the copy and/or data of the at least one file to a backup folder or a system;

responsive to determining that the event is associated with malicious activity,

causing, by the behavioral monitor, a process group associated with the first process to cease executing, and

restoring, by the behavioral monitor, a previous version of the at least one file from the backup folder or the system.

2. The method of claim 1 , further comprising:

saving, by the behavioral monitor, copies of files and/or data that the first process has modified.

3. The method of claim 1 , further comprising:

saving, by the behavioral monitor, copies of files and/or data that the first process has deleted.

4. The method of claim 1 , wherein injecting the code into the first process comprises:

overwriting at least a first portion of code associated with the first process; and

after the corresponding filter is generated in the kernel space, restoring the first portion of the code.

5. The method of claim 1 , wherein the first process is executing in a container.

6. The method of claim 1 , wherein the process group is a collection of processes that share a child/parent relationships.

7. A non-transitory computer readable medium comprising instructions which, when executed by one or more processors, causes a computing system to perform operations, comprising:

generating, by a behavioral monitor executing in a user space of a computing system comprising the user space and a kernel space, a plurality of filters in the kernel space, the plurality of filters corresponding to a plurality of processes executing in the user space, the plurality of filters generated by injecting code into the plurality of processes executing in the user space, the code creating signal handlers for each process;