Granted Patent B1

US 10,050,982 · App. 15/159,187 · Granted Aug 14, 2018

Inventors: Ruben Torres Guerra (Menlo Park, CA); Gaspar Modelo-Howard (Fremont, CA); Alok Tongaonkar (San Jose, CA); Lorenzo De Carli (Madison, WI); Somesh Jha (Madison, WI)

Assignee: Symantec Corporation

H04L63/1416H04L63/0428H04L63/061H04L63/166

Abstract

Claims (103)

1. A computer-implemented method for reverse-engineering malware protocols, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

decrypting, by the computing device, encrypted network traffic generated by a malware program, wherein decrypting the encrypted network traffic comprises:

identifying at least one sequence of instructions in the malware program that generates encrypted network traffic;

identifying an encryption algorithm used by the sequence of instructions by:

identifying data input to the sequence of instructions and data output by the sequence of instructions; and

identifying a known encryption algorithm that produces the data output by the sequence of instructions when provided the data input to the sequence of instructions;

identifying at least one encryption key for the encrypted network traffic; and

decrypting, using the identified encryption key, at least a portion of the encrypted network traffic;

identifying, by the computing device, a message type field in the decrypted network traffic;

identifying, by the computing device, a message in the decrypted network traffic with the identified message type; and

inferring, by the computing device, at least a portion of a malware protocol used by the malware program by analyzing the identified message to identify a field type for a data field of the identified message of the identified message type.

2. The computer-implemented method of claim 1 , wherein identifying the message type field comprises:

identifying a plurality of request and response communication pairs in the decrypted network traffic; and

identifying the message type field by identifying, in at least one subset of the plurality of request and response communication pairs, a request data field value in each request that corresponds to a response data field value in each response.

3. The computer-implemented method of claim 2 , wherein identifying the message in the decrypted network traffic with the identified message type comprises identifying in the decrypted network traffic an additional subset of the plurality of request and response communication pairs, each request and response communication pair included in the additional subset of request and response communication pairs having the request data field value in the message type field of the request.

4. The computer-implemented method of claim 1 , wherein identifying the field type of the data field comprises:

determining that the data field contains context-independent data by determining that a field value in the data field is semantically independent from a context of the field value in the message;

comparing the field value to a range of expected field values for the field type;

identifying the field type based on the field value being within the range of expected field values for the field type.

5. The computer-implemented method of claim 4 , wherein the context-independent data field is at least one of:

a magic number;

a network address;

a time stamp;

an executable file;

an archive file; and

a string.

6. The computer-implemented method of claim 1 , wherein identifying the field type of the data field comprises:

determining that the data field contains context-dependent data by determining that a field value in the data field corresponds to at least one of:

the value of a property of the message;

a property of a context-independent data field;

comparing the field value to a range of expected field values for the identified message; and

identifying the field type based on the field value being within the range of expected field values for the identified message.

7. The computer-implemented method of claim 6 , wherein the context-dependent data field is at least one of:

a cyclic redundancy check value;

a field-length value;

an array-length value; and

an offset value.

8. The computer-implemented method of claim 1 , wherein identifying the field type of the data field comprises determining that the data field contains additionally encrypted data.

9. The computer-implemented method of claim 1 , wherein inferring the portion of the protocol used by the malware program further comprises abstracting a specification for the protocol by at least one of:

reporting whether the protocol encrypts all of each message or a portion of each message;

reporting an encryption algorithm used by the protocol;

reporting at least one encryption key used by the protocol;

reporting message type fields used by the protocol;

reporting message type values used by the protocol; and

reporting data field types used by the protocol.

10. The computer-implemented method of claim 1 , wherein decrypting the encrypted network traffic further comprises:

receiving encrypted network traffic collected from the malware program;

identifying an encryption key for the received encrypted network traffic; and

decrypting the received encrypted network traffic using the identified encryption key for the received encrypted network traffic.

11. The computer-implemented method of claim 10 , wherein identifying the encryption key for the received encrypted network traffic comprises at least one of:

identifying a recognized encryption key known to be used by the malware program;

identifying the encryption key for the received encrypted network traffic by:

applying at least one candidate encryption key included in a set of candidate encryption keys to decrypt at least a portion of the received encrypted network traffic;

calculating an entropy metric for the network traffic decrypted using the candidate encryption key;

identifying the encryption key for the received encrypted network traffic by determining that the entropy metric for the network traffic decrypted using the candidate encryption key is below a threshold.

12. The method of claim 1 , wherein decrypting the encrypted network traffic further comprises determining that the malware program encrypts data to be transferred using at least one of:

a bitwise exclusive-or to combine input data with an encryption key; and

a Rivest Cipher 4 that uses a randomly generated encryption key.

13. A system for reverse-engineering malware protocols, the system comprising:

a decryption module, stored in memory, that decrypts encrypted network traffic generated by a malware program by:

identifying at least one sequence of instructions in the malware program that generates encrypted network traffic;

identifying an encryption algorithm used by the sequence of instructions by:

identifying data input to the sequence of instructions and data output by the sequence of instructions; and

identifying a known encryption algorithm that produces the data output by the sequence of instructions when provided the data input to the sequence of instructions;

identifying at least one encryption key for the encrypted network traffic; and

decrypting, using the identified encryption key, at least a portion of the encrypted network traffic;

a message type module, stored in memory, that identifies a message type field in the decrypted network traffic;

a field type module, stored in memory, that identifies a message in the decrypted network traffic with the identified message type;

an analysis module, stored in memory, that infers at least a portion of a malware protocol used by the malware program by analyzing the identified message to identify a field type for a data field of the identified message of the identified message type; and

at least one physical processor configured to execute the decryption module, the message type module, the field type module, and the analysis module.

14. The system of claim 13 , wherein the message type module identifies the message type field by:

identifying a plurality of request and response communication pairs in the decrypted network traffic; and

identifying the message type field by identifying, in at least one subset of the plurality of request and response communication pairs, a request data field value in each request that corresponds to a response data field value in each response.

15. The system of claim 14 , wherein the field type module identifies the message in the decrypted network traffic with the identified message type by identifying in the decrypted network traffic an additional subset of the plurality of request and response communication pairs, each request and response communication pair included in the additional subset of request and response communication pairs having the request data field value in the message type field of the request.

16. The system of claim 13 , wherein the analysis module identifies the field type of the data field by:

determining that the data field contains context-independent data by determining that a field value in the data field is semantically independent from a context of the field value in the message;

comparing the field value to a range of expected field values for the field type;

identifying the field type based on the field value being within the range of expected field values for the field type.

17. The system of claim 16 , wherein the context-independent data field is at least one of:

a magic number;

a network address;

a time stamp;

an executable file;

an archive file; and

a string.

18. The system of claim 13 , wherein the analysis module identifies the field type of the data field by:

determining that the data field contains context-dependent data by determining that a field value in the data field corresponds to at least one of:

the value of a property of the message;

a property of a context-independent data field;

comparing the field value to a range of expected field values for the identified message; and

identifying the field type based on the field value being within the range of expected field values for the identified message.

19. The system of claim 13 , wherein the analysis module identifies the field type of the data field by determining that the data field contains additionally encrypted data.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

decrypt encrypted network traffic generated by a malware program by:

identifying at least one sequence of instructions in the malware program that generates encrypted network traffic;

identifying an encryption algorithm used by the sequence of instructions by:

identifying data input to the sequence of instructions and data output by the sequence of instructions; and

identifying a known encryption algorithm that produces the data output by the sequence of instructions when provided the data input to the sequence of instructions;

identifying at least one encryption key for the encrypted network traffic; and

decrypting, using the identified encryption key, at least a portion of the encrypted network traffic;

identify a message type field in the decrypted network traffic;

identify a message in the decrypted network traffic with the identified message type; and

infer at least a portion of a malware protocol used by the malware program by analyzing the identified message to identify a field type for a data field of the identified message of the identified message type.

Assignments (2)

Cited By (11)

US 12,225,030 US 12,229,774 US 12,309,192 US 12,323,450 US 12,355,816 US 12,483,384 US 12,580,956 US 12,587,535 US 12,602,501 US 12,647,441 US 12,652,312