IP Library › Granted Patent US 11,256,808

Granted Patent B2

US 11,256,808 · App. 16/805,478 · Granted Feb 22, 2022

Detecting malware via scanning for dynamically generated function pointers in memory

Inventor: Robert Jung (Albuquerque, NM)

Assignee: Palo Alto Networks, Inc.

G06F21/566 G06F11/3037 G06F21/563

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 11,256,808
App. No.: 16/805,478
Granted: Feb 22, 2022
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Techniques for detecting malware via scanning for dynamically generated function pointers in memory are disclosed. In some embodiments, a system/process/computer program product for detecting malware via scanning for dynamically generated function pointers in memory includes monitoring changes in memory during execution of a malware sample in a computing environment; detecting a dynamically generated function pointer in memory based on an analysis of the monitored changes in memory during execution of the malware sample in the computing environment; and generating a signature based on detection of the dynamically generated function pointer in memory, wherein the malware sample was determined to be malicious.

Claims (73)

1. A system, comprising:

a processor configured to:

perform dynamic analysis of a malware sample for detecting malware via scanning for dynamically generated function pointers in memory;

monitor changes in memory during execution of a malware sample in a computing environment, wherein a plurality of pages in memory associated with a process launched by executing the malware sample are identified and monitored for changes during execution of the malware sample in the computing environment, and wherein the processor is further configured to:

maintain a list of memory locations of accessible system functions;

search the memory for the list of memory locations;

periodically search the memory after predetermined execution events to detect any memory pointers in the memory;

filter the memory locations where pointers to the system functions were detected in the memory to generate a set of system API function pointers; and

automatically analyze the set of system API function pointers to determine whether the malware sample attempted to obfuscate suspicious or malicious behavior;

detect a dynamically generated function pointer in memory based on an analysis of the monitored changes in memory during execution of the malware sample in the computing environment; and

generate an interface that includes a graphical visualization of a plurality of pages in memory associated with a process launched during execution of the malware sample in a computing environment, wherein the graphical visualization of the plurality of pages in memory indicates detection of the dynamically generated function pointer associated with one or more of the plurality of pages in memory that were modified during execution of the malware sample; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the computing environment comprises a virtual machine instance.

3. The system recited in claim 1 , wherein the processor is further configured to:

identify, in the interface, one or more of the following:

a system call event detected during execution of the malware sample in the computing environment;

a time associated with a snapshot of the memory generated during the execution of the malware sample; and

a type of memory associated with the one or more of the plurality of pages in memory that were modified during execution of the malware sample.

4. The system recited in claim 1 , wherein an output of the monitored changes in memory after a system call event during execution of the malware sample for a predetermined period of time in the computing environment is reassembled and analyzed to identify a potential malware binary, and wherein the potential malware binary is submitted for dynamic analysis and/or static analysis.

5. The system recited in claim 1 , wherein a plurality of pages in memory associated with a process launched by executing the malware sample are identified and monitored for changes after one or more system call events during execution of the malware sample for a predetermined period of time in the computing environment.

6. The system recited in claim 1 , wherein the processor is further configured to:

receive a plurality of malware samples; and

deduplicate the plurality of malware samples.

7. The system recited in claim 1 , wherein the processor is further configured to:

receive a plurality of malware samples;

deduplicate the plurality of malware samples to output a first malware sample; and

execute the first malware sample in the computing environment.

8. The system recited in claim 1 , wherein the processor is further configured to:

identify a plurality of pages in memory associated with a process launched by executing the malware sample in the computing environment; and

perform an initial snapshot of all of the plurality of pages in memory associated with the process at initial time to and cache the initial snapshot of all of the plurality of pages in memory to provide a baseline for contents in memory while executing the malware sample in the computing environment.

9. The system recited in claim 1 , wherein the processor is further configured to:

identify a plurality of pages in memory associated with a process launched by executing the malware sample in the computing environment;

perform an initial snapshot of all of the plurality of pages in memory associated with the process at initial time t 0 and cache the initial snapshot of all of the plurality of pages in memory to provide a baseline for contents in memory while executing the malware sample in the computing environment; and

perform a final snapshot of all of the plurality of pages in memory associated with the process at subsequent time t n after a predetermined period of time or after completion of execution of the malware sample in the computing environment.

10. The system recited in claim 1 , wherein the processor is further configured to:

identify a plurality of pages in memory associated with a process launched by executing the malware sample in the computing environment;

perform another snapshot of all of the plurality of pages in memory associated with the process at subsequent time t n after a predetermined period of time or after a system call event if any return address in a call stack points to a memory address that has changed since the initial snapshot.

11. A method, comprising:

performing dynamic analysis of a malware sample for detecting malware via scanning for dynamically generated function pointers in memory;

monitoring changes in memory during execution of a malware sample in a computing environment, wherein a plurality of pages in memory associated with a process launched by executing the malware sample are identified and monitored for changes during execution of the malware sample in the computing environment, and wherein the processor is further configured to:

maintaining a list of memory locations of accessible system functions;

searching the memory for the list of memory locations;

periodically searching the memory after predetermined execution events to detect any memory pointers in the memory;

filtering the memory locations where pointers to the system functions were detected in the memory to generate a set of system API function pointers; and

automatically analyzing the set of system API function pointers to determine whether the malware sample attempted to obfuscate suspicious or malicious behavior;

detecting a dynamically generated function pointer in memory based on an analysis of the monitored changes in memory during execution of the malware sample in the computing environment; and

generating an interface that includes a graphical visualization of a plurality of pages in memory associated with a process launched during execution of the malware sample in a computing environment, wherein the graphical visualization of the plurality of pages in memory indicates detection of the dynamically generated function pointer associated with one or more of the plurality of pages in memory that were modified during execution of the malware sample.

12. The method of claim 11 , wherein the computing environment comprises a virtual machine instance.

13. The method of claim 11 , further comprising:

identifying, in the interface, one or more of the following:

a system call event detected during execution of the malware sample in the computing environment;

a time associated with a snapshot of the memory generated during the execution of the malware sample; and

a type of memory associated with the one or more of the plurality of pages in memory that were modified during execution of the malware sample.

14. The method of claim 11 , wherein an output of the monitored changes in memory after a system call event during execution of the malware sample for a predetermined period of time in the computing environment is reassembled and analyzed to identify a potential malware binary.

15. The method of claim 11 , wherein an output of the monitored changes in memory after a system call event during execution of the malware sample for a predetermined period of time in the computing environment is reassembled and analyzed to identify a potential malware binary, and wherein the potential malware binary is submitted for dynamic analysis and/or static analysis.

16. The method of claim 11 , wherein a plurality of pages in memory associated with a process launched by executing the malware sample are identified and monitored for changes after one or more system call events during execution of the malware sample for a predetermined period of time in the computing environment.

17. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

performing dynamic analysis of a malware sample for detecting malware via scanning for dynamically generated function pointers in memory;

maintaining a list of memory locations of accessible system functions;

searching the memory for the list of memory locations;

periodically searching the memory after predetermined execution events to detect any memory pointers in the memory;

filtering the memory locations where pointers to the system functions were detected in the memory to generate a set of system API function pointers; and

automatically analyzing the set of system API function pointers to determine whether the malware sample attempted to obfuscate suspicious or malicious behavior;

detecting a dynamically generated function pointer in memory based on an analysis of the monitored changes in memory during execution of the malware sample in the computing environment; and

18. The computer program product recited in claim 17 , wherein the computing environment comprises a virtual machine instance.

19. The computer program product recited in claim 17 , further comprising computer instructions for:

identifying, in the interface, one or more of the following:

a system call event detected during execution of the malware sample in the computing environment;

a time associated with a snapshot of the memory generated during the execution of the malware sample; and

a type of memory associated with the one or more of the plurality of pages in memory that were modified during execution of the malware sample.

Continuity (2)

Continuation 15828172 · Nov 30, 2017

Related Publication 20200201998A1 · Jun 25, 2020

Cited By (2)

US 12,223,044 US 12,561,434