Systems and methods for tracking malicious behavior across multiple software entities
Described systems and methods allow protecting a computer system from malicious software. In some embodiments, a security application organizes a set of monitored executable entities (e.g., processes) into a plurality of groups, wherein members of a group are related by filiation and/or code injection. The security application may further associate a malice-indicative entity score with each monitored entity, and a malice-indicative group score with each entity group. Group scores may be incremented when a member of the respective group performs certain actions. Thus, even though actions performed by individual members may not be malware-indicative per se, the respective group score may capture collective malicious behavior and trigger malware detection.
1. A computer system comprising at least one hardware processor and a memory, the at least one hardware processor configured to execute an entity manager and a scoring engine, wherein:
the entity manager is configured to organize a collection of monitored executable software entities into a plurality of entity groups according to inter-entity relations selected from a group of relations consisting of a filiation relation and a code injection relation, wherein at least one entity of the collection simultaneously belongs to more than one entity group of the plurality of entity groups; and
the scoring engine is configured, in response to a detected action of the at least one entity, to:
select a first entity group from the plurality of entity groups based on determining that the at least one entity belongs to the first entity group,
select a second entity group from the plurality of entity groups based on determining that the at least one entity belongs to the second entity group, and
in response to selecting the first and second groups, determine whether the computer system comprises malware according to a first action of a first member of the first entity group, and further according to a second action of a second member of the second entity group, the first and second members distinct from the at least one entity, the first action of the first member distinct from the second action of the second member.
2. The computer system of claim 1 , wherein the scoring engine is further configured, in response to the detected action of the at least one entity to:
update a first group score determined by the scoring engine for the first entity group, the first group score indicative of a likelihood that the first entity group is malicious, the first group score determined according to the first action;
update a second group score determined by the scoring engine for the second entity group, the second group score indicative of a likelihood that the second entity group is malicious, the second group score determined according to the second action; and
determine whether the computer system comprises malware according to the updated first and second group scores.
3. The computer system of claim 2 , wherein the scoring engine is further configured, in response to the detected action of the at least one entity to:
update an entity score determined by the scoring engine for the at least one entity, the entity score indicative of a likelihood that the at least one entity is malicious; and
determine whether the computer system comprises malware further according to the updated entity score.
4. The computer system of claim 2 , wherein the scoring engine is further configured, in response to the detected action of the at least one entity, and in preparation for updating the first and second scores, to:
determine whether the detected action belongs to a pre-determined category of actions;
in response, when the detected action belongs to a pre-determined category of actions, update the first and second group scores; and
when the detected action does not belong to the pre-determined category of actions, update an entity score determined by the scoring engine for the at least one entity, the entity score indicative of a likelihood that the at least one entity is malicious.
5. The computer system of claim 1 , wherein organizing the collection comprises:
in response to detecting a creation of the at least one entity by a parent entity of the collection,
adding a new entity group to the plurality of entity groups; and
assigning the at least one entity to the new group.
6. The computer system of claim 5 , wherein organizing the collection further comprises, in response to detecting a creation of a child entity by the at least one entity, assigning the child entity to the new group.
7. The computer system of claim 1 , wherein organizing the collection comprises:
in response to detecting a code injection event wherein an injector entity of the collection has injected code into the at least one entity, selecting a third entity group from the plurality of entity groups, the third entity group having the injector entity as a member; and
in response, assigning the at least one entity to the third entity group.
8. The computer system of claim 7 , wherein organizing the collection further comprises:
in response to detecting the code injection event, selecting a fourth entity group from the plurality of entity groups, the fourth entity group having the injector entity as a member; and
in response, assigning the at least one entity to the fourth entity group.
9. The computer system of claim 1 , wherein the scoring engine is configured to determine whether the computer system comprises malware according to an order in which the detected action, first action, and second action have occurred.
10. A method comprising:
employing at least one hardware processor of a computer system to organize a collection of
monitored executable entities into a plurality of entity groups according to inter-entity relations selected from a group of relations consisting of a filiation relation and a code injection relation, wherein at least one entity of the collection simultaneously belongs to more than one entity group of the plurality of entity groups;
employing the at least one hardware processor to detect an action of the at least one entity;
in response to the detected action of the at least one entity, employing the at least one hardware processor to select a first entity group from the plurality of entity groups based on determining that the at least one entity belongs to the first entity group;
in response to the detected action of the at least one entity, select a second entity group from the plurality of entity groups based on determining that the at least one entity belongs to the second entity group; and
in response to selecting the first and second groups, employing the at least one hardware processor to determine whether the computer system comprises malware according to a first action of a first member of the first entity group, and further according to a second action of a second member of the second entity group, the first and second members distinct from the at least one entity, the first action of the first member distinct from the second action of the second member.
11. The method of claim 10 , wherein determining whether the computer system comprises malware further comprises, in response to the detected action of the at least one entity:
updating a first group score determined by the scoring engine for the first entity group, the first group score indicative of a likelihood that the first entity group is malicious, the first group score determined according to the first action;
updating a second group score determined by the scoring engine for the second entity group, the second group score indicative of a likelihood that the second entity group is malicious, the second group score determined according to the second action; and
determining whether the computer system comprises malware according to the updated first and second group scores.
12. The method of claim 11 , wherein determining whether the computer system comprises malware further comprises, in response to the detected action of the at least one entity:
updating an entity score determined by the scoring engine for the at least one entity, the entity score indicative of a likelihood that the at least one entity is malicious; and
determining whether the computer system comprises malware according to the updated entity score.
13. The method of claim 11 , wherein determining whether the computer system comprises malware further comprises, in response to the detected action of the at least one entity, and in preparation for updating the first and second scores:
determining whether the detected action belongs to a pre-determined category of actions;
in response, when the detected action belongs to a pre-determined category of actions, updating the first and second group scores; and
when the detected action does not belong to the pre-determined category of actions, updating an entity score determined by the scoring engine for the at least one entity, the entity score indicative of a likelihood that the at least one entity is malicious.
14. The method of claim 10 , wherein organizing the collection comprises:
in response to detecting a creation of the at least one entity by a parent entity of the collection, adding a new entity group to the plurality of entity groups; and
assigning the at least one entity to the new group.
15. The method of claim 14 , wherein organizing the collection further comprises, in response to detecting a creation of a child entity by the at least one entity, assigning the child entity to the new group.
16. The method of claim 10 , wherein organizing the collection comprises:
in response to detecting a code injection event wherein an injector entity of the collection has injected code into the at least one entity, selecting a third entity group from the plurality of entity groups, the third entity group having the injector entity as a member; and
in response, assigning the at least one entity to the third entity group.
17. The method of claim 16 , wherein organizing the collection further comprises:
in response to detecting the code injection event, selecting a fourth entity group from the plurality of entity groups, the fourth entity group having the injector entity as a member; and
in response, assigning the at least one entity to the fourth entity group.
18. The method of claim 10 , comprising determining whether the computer system comprises malware according to an order in which the detected action, first action, and second action have occurred.
19. A non-transitory computer-readable medium storing instructions which, when executed by at least one hardware processor of a computer system, cause the computer system to form an entity manager and a scoring engine, wherein:
the entity manager is configured to organize a collection of monitored executable software entities into a plurality of entity groups according to inter-entity relations selected from a group of relations consisting of a filiation relation and a code injection relation, wherein at least one entity of the collection simultaneously belongs to more than one entity group of the plurality of entity groups; and
the scoring engine is configured, in response to a detected action of the at least one entity, to:
select a first entity group from the plurality of entity groups based on determining that the at least one entity belongs to the first entity group,
select a second entity group from the plurality of entity groups based on determining that the at least one entity belongs to the second entity group, and
in response to selecting the first and second groups, determine whether the computer system comprises malware according to a first action of a first member of the first entity group, and further according to a second action of a second member of the second entity group, the first and second members distinct from the at least one entity, the first action of the first member distinct from the second action of the second member.