System and method for detecting multi-component malware
Malicious behavior of a computer program is detected using an emulation engine, an event detector and an event analyzer. The emulation engine includes a system emulator configured to emulate, in an isolated computer environment, at least a part of a computer system and a program emulator configured to emulate in the isolated computer environment execution of the computer program, including execution of a plurality of executable components of the computer program, such as execution processes and threads. The event detector is configured to monitor events being generated by two or more of the executable components. The event analyzer is configured to determine, substantially in real time, based at least on one or more events generated by each of two or more of the plurality of executable components whether or not the computer program exhibits malicious behavior, wherein individually one or more of the plurality of executable components may exhibit benign behavior.
1. A computer-implemented method for detecting malicious program behavior, comprising:
emulating at least a part of a computer system in an isolated computer environment;
emulating execution of the computer program in the isolated computer environment, including emulating execution of one or more remote threads of the computer program;
detecting events being generated by the one or more remote threads of the emulated computer program;
determining, substantially in real time, whether each detected event is associated with malicious program behaviors;
storing in a data structure only detected events associated with the malicious program behaviors;
comparing a totality of events stored in the data structure for the emulated computer program with one or more event patterns associated with the malicious program behaviors; and
terminating emulation of the computer program if, based on the comparison, the totality of events stored in the data structure for the emulated computer program corresponds to one of the event patterns associated with the malicious program behaviors.
2. The computer-implemented method of claim 1 , wherein individually events generated by the one or more emulated remote threads of a malicious computer program exhibit benign behavior.
3. The computer-implemented method of claim 2 , wherein emulating execution of two or more remote threads of the computer program includes one or more of:
executing two or more remote threads in parallel; and
executing two or more remote threads sequentially.
4. The computer-implemented method of claim 3 , further comprising continuing emulating execution of one or more remote threads of the computer program even when one or more remote threads are terminated.
5. The computer-implemented method of claim 4 , wherein detecting an event includes detecting at least one of one or more program's system calls and one or more system responses to the program's system calls.
6. The computer-implemented method of claim 1 , wherein the one or more remote threads of the emulated computer program are created by one or more processes of the emulated computer program.
7. The computer-implemented method of claim 6 , wherein the one or more remote threads are created in programs activated by the emulated computer program.
8. A system for detecting malicious program behavior, comprising:
a system memory; and
a processor configured to
emulate in an isolated computer environment of the system memory at least a part of a computer system;
emulate in the isolated computer environment execution of the computer program, including execution of one or more remote threads of the computer program;
detect events being generated by the one or more remote threads of the emulated computer program;
determine, substantially in real time, whether each detected event is associated with malicious program behaviors;
store in a data structure only detected events associated with the malicious program behaviors;
compare a totality of events stored in the data structure for the emulated computer program with one or more event patterns associated with the malicious program behaviors; and
terminate emulation of the computer program if, based on the comparison, the totality of events stored in the data structure for the emulated computer program corresponds to one of the event patterns associated with the malicious program behaviors.
9. The system of claim 8 , wherein individually events generated by the one or more emulated remote threads of a malicious computer program exhibit benign behavior.
10. The system of claim 9 , wherein execution of two or more remote threads of the computer program includes one or more of:
execution of two or more remote threads in parallel; and
execution of two or more remote threads sequentially.
11. The system of claim 10 , wherein the processor is further configured to continue emulating execution of one or more remote threads of the computer program even when one or more remote threads are terminated.
12. The system of claim 11 , wherein the processor is further configured to detect at least one of one or more program's system calls and one or more system responses to the program's system calls.
13. The system of claim 8 , wherein the one or more remote threads of the emulated computer program are created by one or more processes of the emulated computer program.
14. The system of claim 13 , wherein the one or more remote threads are created in programs activated by the emulated computer program.
15. A computer-readable medium comprising computer-executable instructions for detecting malicious program behavior, the computer-executable instructions include:
instructions for emulating in an isolated computer environment at least a part of a computer system;
instructions for emulating execution of the computer program in the isolated computer environment, including instructions for emulating execution of one or more remote threads of the computer program;
instructions for detecting events being generated by the one or more remote threads of the emulated computer program;
instructions for determining, substantially in real time, whether each detected event is associated with malicious program behaviors;
instructions for storing in a data structure only detected events associated with the malicious program behaviors;
instructions for comparing a totality of events stored in the data structure for the emulated computer program with one or more event patterns associated with the malicious program behaviors; and
instructions for terminating emulation of the computer program if, based on the comparison, the totality of events stored in the data structure for the emulated computer program corresponds to one of the event patterns associated with the malicious program behaviors.
16. The computer-readable medium of claim 15 , wherein individually events generated by the one or more emulated remote threads of a malicious computer program exhibit benign behavior.
17. The computer-readable medium of claim 16 , wherein instructions for emulating execution of two or more remote threads includes instruction for one or more of:
executing two or more remote threads in parallel; and
executing two or more remote threads sequentially.
18. The computer-readable medium of claim 17 , further including instructions for continuing emulating execution of one or more remote threads of the computer program even when one or more remote threads are terminated.
19. The computer-readable medium of claim 18 , wherein instructions for monitoring include instructions for monitoring at least one of one or more program's system calls and one or more system responses to the program's system calls.
20. The computer-readable medium of claim 15 , wherein the one or more remote threads of the emulated computer program are created by one or more processes of the emulated computer program.