Just in time memory analysis for malware detection
Methods and apparatus consistent with the present disclosure may use instrumentation code that remains transparent to an application program that the instrumentation code has been injected into. In certain instances, data sets that include executable code may be received via packetized communications or be received via other means, such as, receiving a file from a data store. The present technique allows a processor executing instrumentation code to monitor actions performed by the program code included in a received data set. Malware may be detected by scanning suspect program code with a malware scanner, malware may be detected by identifying suspicious actions performed by a set of program code, or malware may be detected by a combination of such techniques.
1 . A method for analyzing program code at a computer device, the method comprising:
analyzing behaviors of program code as the program code is being executed in real time by inserting one or more instructions into the program code as it is executed by a processor and then receiving instruction information associated with the one or more inserted instructions;
classifying context information associated with the program code based on one or more of the behaviors of the program code being executed in real time;
identifying one or more states associated with the context information based on the classification, wherein the one or more states associates with allocating memory that includes allocating a portion of the memory and includes invocation of and operating system program function,
wherein the data written to the memory is written to a newly allocated memory portion;
determining that the identified states are related to malware, wherein the states are further associated with a corrective action for the determined malware, and wherein the determination is based, at least in part, on reviewing the received instruction information to determine if it corresponds to a particular behavior consistent with malware; and
identified states are related to malware.
2 . The method of claim 1 , wherein the context information includes data being passed from instrumentation code injected into the program code and executed as part of the program code.
3 . The method of claim 1 , wherein the context information includes content related to one or more of:
a computer register,
a parameter associated with a process performed based on execution of the program code,
information that relates to a state of memory,
information relating to an allocation of memory, or
an initiation or completion of an operating system operation.
4 . The method of claim 1 , further comprising identifying that the identified states associated with malware include one or more actions to collect information from a first computing device.
5 . The method of claim 1 , further comprising identifying that the identified states associated with malware include preparing collected information to be sent to a second computing device.
6 . The method of claim 1 , further comprising identifying that the states associated with malware include initiating a write to a system registry.
7 . The method of claim 1 , further comprising identifying that the states associated with malware include initiating a write to a system area on a disk drive.
8 . The method of claim 1 , wherein the corrective actions include one or more of:
sequestering a data set associated with the program code;
saving the data set for future analysis;
sending the data set to a second computing device for analysis; or
deleting the data set from one or more locations in a memory.
9 . A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for analyzing program code, the method comprising:
analyzing behaviors of program code as the program code is being executed in real time by inserting one or more instructions into the program code as it is executed by a processor and then receiving instruction information associated with the one or more inserted instructions;
classifying context information associated with the program code based on one or more of the behaviors of the program code being executed in real time;
identifying one or more states associated with the context information based on the classification, wherein the one or more states associates with allocating memory that includes allocating a portion of the memory and includes invocation of and operating system program function,
wherein the data written to the memory is written to a newly allocated memory portion;
determining that the identified states are related to malware, wherein the states are further associated with a corrective action for the determined malware, and wherein the determination is based, at least in part, on reviewing the received instruction information to determine if it corresponds to a particular behavior consistent with malware; and
performing the corrective action based, at least in part, on the determination that the identified states are related to malware.
10 . The non-transitory computer-readable storage medium of claim 9 , wherein the context information includes data being passed from instrumentation code injected into the program code and executed as part of the program code.
11 . The non-transitory computer-readable storage medium of claim 9 , wherein the context information includes content related to one or more of:
a computer register,
a parameter associated with a process performed based on execution of the program code,
information that relates to a state of memory,
information relating to an allocation of memory, or
an initiation or completion of an operating system operation.
12 . The non-transitory computer-readable storage medium of claim 9 , further comprising identifying that the identified states associated with malware include one or more actions to collect information from a first computing device.
13 . The non-transitory computer-readable storage medium of claim 9 , further comprising identifying that the identified states associated with malware include preparing collected information to be sent to a second computing device.
14 . The non-transitory computer-readable storage medium of claim 9 , further comprising identifying that the states associated with malware include initiating a write to a system registry.
15 . The non-transitory computer-readable storage medium of claim 9 , further comprising identifying that the states associated with malware include initiating a write to a system area on a disk drive.
16 . An apparatus for analyzing program code, the apparatus comprising:
a memory; and
a processor that executes instructions out of the memory to:
analyze behaviors of program code as the program code is being executed in real time by inserting one or more instructions into the program code as it is executed by a processor and then receiving instruction information associated with the one or more inserted instructions;
classify context information associated with the program code based on one or more of the behaviors of the program code being executed in real time;
identify one or more states associated with the context information based on the classification, wherein the one or more states associates with allocating memory that includes allocating a portion of the memory and includes invocation of and operating system program function,
wherein the data written to the memory is written to a newly allocated memory portion;
determine that the identified states are related to malware, wherein the states are further associated with a corrective action for the determined malware, and wherein the determination is based, at least in part, on reviewing the received instruction information to determine if it corresponds to a particular behavior consistent with malware; and
perform the corrective action based, at least in part, on the determination that the identified states are related to malware.
17 . The apparatus of claim 16 , wherein the context information includes data being passed from instrumentation code injected into the program code and executed as part of the program code.
18 . The apparatus of claim 16 , wherein the context information includes content related to one or more of:
a computer register,
a parameter associated with a process performed based on execution of the program code,
information that relates to a state of memory,
information relating to an allocation of memory, or
an initiation or completion of an operating system operation.
19 . The apparatus of claim 16 , wherein the processor executes further instructions to identify that the states associated with malware include one or more actions to collect information from a first computing device.
20 . The apparatus of claim 16 , wherein the processor executes further instructions to identify that the states associated with malware include preparing the information to be sent to a second computing device.