Managing the loading of sensitive modules
The present disclosure relates to systems and methods for identifying highly sensitive modules and taking a remediation or preventative action if such modules are accessed by malicious software. For example, the likelihood that a module is used for an exploit, and is thus sensitive, is categorized as high, medium, or low. The likelihood that a module can be used for an exploit can dictate whether, and to what degree, an application accessing the module is “suspicious.” However, in some instances, a sensitive module may have legitimate reasons to load when used in certain non-malicious ways. The system may also consider a trust level when determining what actions to take, such that an application and/or user having a higher trust level may be less suspicious when accessing a sensitive module as compared to an application or user having a lower trust level.
1. A computer-implemented method for managing loading of sensitive modules, comprising:
based on an application attempting to access a module, scanning the module to obtain module attributes;
generating a sensitivity level of the module based on the module attributes;
analyzing a computing environment of the application to generate a trust level associated with the application;
determining whether to prevent access to the module by the application based on the sensitivity level and the trust level;
when the determination is to prevent access, blocking access to the module, otherwise when the determination is to not prevent access:
determining whether to monitor the application attempting to access the module;
when the determination is to monitor the application:
analyzing activity of the application;
determining whether to terminate the application based on the analyzed activity of the application, wherein the analyzed activity of the application indicates suspicious activity;
when the determination is to terminate the application, terminating the application, otherwise permitting the application to continue execution.
2. The computer-implemented method of claim 1 , wherein, when determining whether to prevent access to the module by the application is to not prevent access, sending security information to a security server.
3. The computer-implemented method of claim 1 , wherein scanning the module comprises identifying one or more files associated with the module, the one or more files comprising an executable file, an object code file, or dynamic link libraries.
4. The computer-implemented method of claim 1 , wherein generating a sensitivity level of the module based on the module attributes comprises categorizing the module attributes into one of a group of predefined sensitivity levels.
5. The computer-implemented method of claim 1 , wherein the sensitivity level comprises a range of sensitivity level values from a low sensitivity level to a high sensitivity level and the trust level comprises a range of trust level values from a low trust level to a high trust level and determining whether to prevent access by the application to the module based on the sensitivity level and the trust level comprises:
cross-correlating a sensitivity level value of the range of the sensitivity level values to a trust level value of the range of the trust level values to arrive at a combined sensitivity and trust level combination and basing whether to prevent access to the module by the application on the sensitivity and the trust level combination.
6. The computer-implemented method of claim 1 , wherein analyzing activity of the application comprises analyzing a plurality of application function calls.
7. The computer-implemented method of claim 2 , wherein sending security information to the security server comprises sending environmental attributes, security attributes, security levels, trust attributes, application activity, or module activity to the security server, the security server determining whether to update the security information.
8. A system for managing loading of sensitive modules, comprising:
a processor;
a computer storage device in electronic communication with the processor, the computer storage device storing instructions that, when executed by the processor, perform a method of:
based on an application attempting to access a module, scanning the module to obtain module attributes;
generating a sensitivity level of the module based on the module attributes;
analyzing a computing environment of the application to generate a trust level associated with the application;
determining whether to prevent access to the module by the application based on the sensitivity level and the trust level;
when the determination is to prevent access, blocking access to the module, otherwise when the determination is to not prevent access:
determining whether to monitor the application attempting to access the module;
when the determination is to monitor the application:
analyzing activity of the application;
determining whether to terminate the application based on the analyzed activity of the application, wherein the analyzed activity of the application indicates suspicious activity;
when the determination is to terminate the application, terminating the application, otherwise permitting the application to continue execution.
9. The system of claim 8 , wherein, when determining whether to prevent access to the module by the application is to not prevent access, sending security information to a security server.
10. The system of claim 8 , wherein scanning the module comprises identifying one or more files associated with the module, the one or more files comprising an executable file, an object code file, or dynamic link libraries.
11. The system of claim 8 , wherein generating a sensitivity level of the module based on the module attributes comprises categorizing the module attributes into one of a group of predefined sensitivity levels.
12. The system of claim 8 , wherein the sensitivity level comprises a range of sensitivity level values from a low sensitivity level to a high sensitivity level and the trust level comprises a range of trust level values from a low trust level to a high trust level and determining whether to prevent access by the application to the module based on the sensitivity level and the trust level comprises:
cross-correlating a sensitivity level value of the range of sensitivity level values to a trust level value of the range of trust level values to arrive at a combined sensitivity and trust level combination and basing whether to prevent access to the module by the application on the sensitivity and the trust level combination.
13. The system of claim 8 , wherein analyzing activity of the application comprises analyzing a plurality of application function calls.
14. The system of claim 9 , wherein sending security information to the security server comprises sending environmental attributes, security attributes, security levels, trust attributes, application activity, or module activity to the security server, the security server determining whether to update the security information.
15. A computer storage device storing instructions that, when executed, are capable of performing a method for managing loading of sensitive modules, the method comprising:
based on an application attempting to access a module, scanning the module to obtain module attributes;
generating a sensitivity level of the module based on the module attributes;
analyzing a computing environment of the application to generate a trust level associated with the application;
determining whether to prevent access to the module by the application based on the sensitivity level and the trust level;
when the determination is to prevent access, blocking access to the module, otherwise when the determination is to not prevent access:
determining whether to monitor the application attempting to access the module;
when the determination is to monitor the application:
analyzing activity of the application;
determining whether to terminate the application based on the analyzed activity of the application, wherein the analyzed activity of the application indicates suspicious activity;
when the determination is to terminate the application, terminating the application, otherwise permitting the application to continue execution.
16. The computer storage device of claim 15 , wherein, when determining whether to prevent access to the module by the application is to not prevent access, sending security information to a security server.
17. The computer storage device of claim 15 , wherein scanning the module comprises identifying one or more files associated with the module, the one or more files comprising an executable file, an object code file, or dynamic link libraries.
18. The computer storage device of claim 15 , wherein the sensitivity level comprises a range of sensitivity level values from a low sensitivity level to a high sensitivity level and the trust level comprises a range of trust level values from a low trust level to a high trust level and determining whether to prevent access by the application to the module based on the sensitivity level and the trust level comprises:
cross-correlating a sensitivity level value of the range of the sensitivity level value to a trust level value of the range of the trust level values to arrive at a combined sensitivity and trust level combination and basing whether to prevent access to the module by the application on the sensitivity and the trust level combination.
19. The computer storage device of claim 15 , wherein analyzing activity of the application comprises analyzing a plurality of application function calls.
20. The computer storage device of claim 16 , wherein sending security information to the security server comprises sending environmental attributes, security attributes, security levels, trust attributes, application activity, or module activity to the security server, the security server determining whether to update the security information.