Systems and methods for detecting malicious processes
Disclosed are systems and methods for detecting malicious applications. An exemplary method may comprise detecting that a first process has been launched on a computing device. The method may comprise receiving, from the first process, an execution stack associated with one or more control points of the first process. The method may comprise applying a machine learning classifier on the execution stack, wherein the machine learning classifier is configured to classify whether a process is malicious based on activity on control points captured on a given execution stack, and wherein a feature of a malicious process is detection of a system call to create a remote thread that runs in a virtual address space of a shared-service process configured to import third-party processes to be embedded as separate threads. The method may comprise generating an indication that the execution of the first process is malicious/non-malicious.
1. A method for detecting a malicious application, comprising:
detecting that a first process has been launched and executed on a computing device;
receiving, from the first process, an execution stack associated with one or more control points of the first process,
applying a machine learning classifier on the execution stack, wherein the machine learning classifier is configured to classify whether a process is malicious based on activity on control points captured on a given execution stack, and wherein the malicious activity on the controls points comprises a system call to create a remote thread that runs in a virtual address space of a shared-service process configured to import third-party processes to be embedded in the shared-service process as separate threads; and
generating an indication that the execution of the first process is malicious in response to receiving a malicious classification from the machine learning classifier for the first process.
2. The method of claim 1 , further comprising:
monitoring at least one thread associated with the first process using one or more control points of the first process.
3. The method of claim 2 , wherein monitoring the at least one thread associated with the first process is performed using call stack trace monitoring.
4. The method of claim 2 , wherein detecting the first process has launched and monitoring the at least one thread associated with the first process is performed by a file protector driver module.
5. The method of claim 1 , wherein the one or more control points are further associated with events comprising at least one of: create a file, clean up a file, close a file, duplicate a handle, rename a file, delete a file, and create a thread.
6. The method of claim 1 , further comprising:
responsive to receiving the indication that the execution of the first process is malicious, performing a remedial action comprising restoration of a file modified by the first process and termination of the first process.
7. The method of claim 1 , further comprising:
responsive to receiving the indication that the execution of the first process is malicious, performing a remedial action comprising blocking importation of a dynamically linked library into the shared-service process to prevent injection of malware into the shared-service process.
8. The method of claim 1 , wherein the machine learning classifier is trained using a plurality of execution stacks associated with processes pre-labelled as malicious and non-malicious.
9. A system for detecting a malicious application, comprising:
a hardware processor configured to:
detect that a first process has been launched and executed on a computing device;
receive, from the first process, an execution stack associated with one or more control points of the first process,
apply a machine learning classifier on the execution stack, wherein the machine learning classifier is configured to classify whether a process is malicious based on activity on control points captured on a given execution stack, and wherein the malicious activity on the controls points comprises a system call to create a remote thread that runs in a virtual address space of a shared-service process configured to import third-party processes to be embedded in the shared-service process as separate threads; and
generate an indication that the execution of the first process is malicious in response to receiving a malicious classification from the machine learning classifier for the first process.
10. The system of claim 9 , wherein the hardware processor is further configured to:
monitor at least one thread associated with the first process using one or more control points of the first process.
11. The system of claim 10 , wherein monitoring the at least one thread associated with the first process is performed using call stack trace monitoring.
12. The system of claim 10 , wherein detecting the first process has launched and monitoring the at least one thread associated with the first process is performed by a file protector driver module.
13. The system of claim 9 , wherein the one or more control points are further associated with events comprising at least one of: create a file, clean up a file, close a file, duplicate a handle, rename a file, delete a file, and create a thread.
14. The system of claim 9 , wherein the hardware processor is further configured to:
responsive to receiving the indication that the execution of the first process is malicious, perform a remedial action comprising restoration of a file modified by the first process and termination of the first process.
15. The system of claim 9 , wherein the hardware processor is further configured to:
responsive to receiving the indication that the execution of the first process is malicious, perform a remedial action comprising blocking importation of a dynamically linked library into the shared-service process to prevent injection of malware into the shared-service process.
16. The system of claim 9 , wherein the machine learning classifier is trained using a plurality of execution stacks associated with processes pre-labelled as malicious and non-malicious.
17. A non-transitory computer readable medium comprising computer executable instructions for detecting a malicious application, including instructions for:
detecting that a first process has been launched and executed on a computing device;
receiving, from the first process, an execution stack associated with one or more control points of the first process,
applying a machine learning classifier on the execution stack, wherein the machine learning classifier is configured to classify whether a process is malicious based on activity on control points captured on a given execution stack, and wherein the malicious activity on the controls points comprises a system call to create a remote thread that runs in a virtual address space of a shared-service process configured to import third-party processes to be embedded in the shared-service process as separate threads; and
generating an indication that the execution of the first process is malicious in response to receiving a malicious classification from the machine learning classifier for the first process.