Malicious direct syscall call detection
Methods, storage systems and computer program products implement embodiments of the present invention for protecting a computer by first deploying in a memory of the computer a hooked version of a syscall used by an operating system kernel of the computer A notification of a call to the hooked version of the syscall from a user mode of the computer is received from the hooked version of the syscall, the notification including a return address in the memory and a set of features extracted from the call. The return address and the received features are analyzed so as to classify the call as benign or malicious, and an alert is generated for the computer upon classifying the new call as malicious.
1 . A method for protecting a computer, comprising:
deploying in a memory of the computer a hooked version of a syscall used by an operating system kernel of the computer;
receiving, from the hooked version of the syscall, a notification of a call to the hooked version of the syscall from a user mode of the computer, the notification comprising a return address in the memory and a set of features extracted from the call;
analyzing the return address and the received features so as to classify the call as benign or malicious; and
generating, for the computer, an alert upon classifying the new call as malicious,
wherein classifying the call as malicious comprises classifying the call as a direct call, and
wherein the call comprises a new call, and wherein the features further comprise additional features from previous direct calls to the hooked version of the syscall by execution entities executing in the memory of the computer and additional computers, wherein the new call and previous calls were conveyed during multiple days, and wherein one or more organizations comprise the computers.
2 . The method according to claim 1 , wherein analyzing the return address comprises identifying the return address as belonging to a specified block in a user-mode segment of the memory.
3 . The method according to claim 2 , wherein the specified block is not allocated to a specified DLL.
4 . The method according to claim 1 , wherein a given feature comprises a mapped block in the memory comprising the execution entities, wherein analyzing the features comprises identifying a number of distinct execution entities that generated the direct calls from the mapped block, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
5 . The method according to claim 1 , wherein a given feature comprises a mapped block in the memory comprising the execution entities, wherein analyzing the features comprises identifying a number of distinct days when any of the computers having the given feature, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
6 . The method according to claim 1 , and further comprising defining a key comprising first and second features, the first feature comprising a given execution entity that conveyed one or more of the direct calls, and the second feature comprising a mapped block in the memory comprising an execution entity that generated one or more of the direct calls, wherein analyzing the features comprises identifying a number of distinct computers having the key, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
7 . The method according to claim 1 , and further comprising defining a key comprising first and second features, the first feature comprising a given execution entity that conveyed one or more of the direct calls, and the second feature comprising a mapped block in the memory comprising an execution entity that generated one or more of the direct calls, wherein analyzing the features comprises identifying a number of distinct days when any of the computers have the key, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
8 . The method according to claim 1 , and further comprising defining a key comprising first and second features, the first feature comprising a given execution entity that conveyed one or more of the direct calls, and the second feature comprising a mapped block in the memory comprising an execution entity that generated one or more of the direct calls, wherein analyzing the features comprises identifying a number of distinct organizations comprising the computers having the key, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
9 . The method according to claim 1 , and further comprising defining a key comprising first and second features, the first feature comprising a given execution entity that conveyed one or more of the direct calls, and the second feature comprising the hooked version of the syscall, wherein analyzing the features comprises identifying a number of distinct memory blocks comprising the key, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
10 . The method according to claim 1 , and further comprising defining a key comprising first and second features, the first feature comprising a process that conveyed one or more of the direct calls, and the second feature comprising the hooked version of the syscall, wherein analyzing the features comprises identifying a number of distinct computers comprising the key, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
11 . The method according to claim 1 , and further comprising defining a key comprising first and second features, the first feature comprising a given execution entity that conveyed one or more of the direct calls, and the second feature comprising the hooked version of the syscall, wherein analyzing the features comprises identifying a number of distinct days when any of the computers have the key, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
12 . The method according to claim 1 , wherein one or more of the computers execute shellcodes comprising respective shellcode headers.
13 . The method according to claim 12 , wherein a given feature comprises a given execution entity that one or more of the computers executed from any of the shellcodes, and that conveyed one or more of the direct calls, wherein analyzing the features comprises identifying a number of distinct computers having the given feature, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
14 . The method according to claim 12 , wherein a given feature comprises a given execution entity that one or more of the computers executed from any of the shellcodes, and that conveyed one or more of the direct calls, wherein analyzing the features comprises identifying a number of distinct days when any of the computers have the given feature, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
15 . The method according to claim 12 , wherein a given feature comprises a given execution entity that one or more of the computers executed from any of the shellcodes, and that conveyed one or more of the direct calls, wherein analyzing the features comprises identifying a number of distinct shellcode headers having execution entities identical to the given feature, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
16 . The method according to claim 12 , and further comprising defining a key comprising first and second features, the first feature comprising a given execution entity that one or more of the computers executed from any of the shellcodes, and the second feature a given shellcode header for a given shellcode that spawned a given execution entity, wherein analyzing the features comprises identifying a number of distinct computers having the key, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
17 . The method according to claim 12 , and further comprising defining a key comprising first and second features, the first feature comprising a given execution entity that one or more of the computers executed from any of the shellcodes, and the second feature a given shellcode header for a given shellcode that spawned a given execution entity, wherein analyzing the features comprises identifying a number of distinct days when any of the computers have the key, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
18 . The method according to claim 12 , and further comprising defining a key comprising first and second features, the first feature comprising a given execution entity that one or more of the computers executed from any of the shellcodes, and the second feature a given shellcode header for a given shellcode that spawned a given execution entity, wherein analyzing the features comprises identifying a number of distinct organizations comprising the computers having the key, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
19 . The method according to claim 12 , and further comprising defining a key comprising first and second features, the first feature comprising the hooked version of the syscall, and the second feature a given shellcode header for a given shellcode that spawned a given execution entity, wherein analyzing the features comprises identifying a number of distinct computers having the key, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
20 . The method according to claim 12 , and further comprising defining a key comprising first and second features, the first feature comprising the hooked version of the syscall, and the second feature a given shellcode header for a given shellcode that spawned a given execution entity, wherein analyzing the features comprises identifying a number of distinct days when any of the computers in a given organization have the key, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
21 . The method according to claim 12 , and further comprising defining a key comprising first and second features, the first feature comprising the hooked version of the syscall, and the second feature a given shellcode header for a given shellcode that spawned a given execution entity, wherein analyzing the features comprises identifying a number of distinct execution entities having the key, and wherein classifying the new call as malicious comprises identifying that identified number is less than a specified threshold.
22 . A security server, comprising:
a memory; and
a processor configured:
to deploy, in the memory, a hooked version of a syscall used by an operating system kernel of a computer,
to receive, from the computer, a notification of a call to a hooked version of the syscall from a user mode of the second computer, the notification comprising a return address in the memory and a set of features extracted from the call,
to analyze the return address and the received features so as to classify the call as benign or malicious, and
to generate, for the computer, an alert upon classifying the new call as malicious,
wherein classifying the call as malicious comprises classifying the call as a direct call, and
wherein the call comprises a new call, and wherein the features further comprise additional features from previous direct calls to the hooked version of the syscall by execution entities executing in the memory of the computer and additional computers, wherein the new call and previous calls were conveyed during multiple days, and wherein one or more organizations comprise the computers.
23 . A computer software product for protecting a computer, the computer software product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by the computer, cause the computer:
to deploy in a memory of the computer a hooked version of a syscall used by an operating system kernel of the computer;
to receive, from the hooked version of the syscall, a notification of a call to the hooked version of the syscall from a user mode of the computer, the notification comprising a return address in the memory and a set of features extracted from the call;
to analyze the return address and the received features so as to classify the call as benign or malicious; and
to generate, for the computer, an alert upon classifying the new call as malicious,
wherein classifying the call as malicious comprises classifying the call as a direct call, and
wherein the call comprises a new call, and wherein the features further comprise additional features from previous direct calls to the hooked version of the syscall by execution entities executing in the memory of the computer and additional computers, wherein the new call and previous calls were conveyed during multiple days, and wherein one or more organizations comprise the computers.