Methods and systems for analyzing environment-sensitive malware with coverage-guided fuzzing
View Patent ↗The present invention concerns methods and systems for analyzing a software program as a potential environment-sensitive malware sample. The methods and systems described here may comprise monitoring access to environmental information, altering according to an execution policy the contents of environmental information items before retrieval by the program, recording as coverage information the internal states and the externally observable actions from the program execution, using recoded coverage information to generate in a fuzzing fashion execution policies with new contents for environmental information items, and identifying execution policies that induce previously unseen internal states and externally observable actions for the program.
1 . A method for analyzing an untrusted software program for potential environment-sensitive behavior, the method comprising the use of:
an execution monitor running on an execution system, the execution system including computer hardware and operating system, environmental information items, and having interposition capabilities;
a database of sets of information including rules and execution policies, the rules defining actions to be taken by the execution monitor when interposing on requests of access from a software program to said environmental information items, the database being accessible to said execution monitor;
the following steps being performed by the execution monitor:
A generating a new execution policy by means of random, coverage-guided fuzzing-style mutations of the rules in the execution policy, wherein the random, coverage-guided fuzzing-style mutations are made on the basis of said information about the actions recorded in the external coverage information to generate modifications to the rules in the execution policy, and wherein the new execution policy is set as the current execution policy;
B starting and monitoring an execution of the untrusted software program;
C interposing on accesses requested by the untrusted software program to one or more of the environmental information items;
D altering a response of the execution system to said requested accesses by taking the actions according to the current execution policy;
E recording, as external coverage information for guiding subsequent policy generation:
information about the actions invoked by the untrusted software program and regulated by the execution monitor under the current execution policy when accessing environmental information items; and
information about possible transient and permanent changes done by the untrusted software program's execution to the execution system under the current execution policy;
F recording, as internal coverage information, information about internal program states, including code portions traversed by the untrusted software program's execution under the current execution policy, and data flows of the program, including values for input parameters when the program uses library functions or comparison instructions; and
X1 selecting an execution policy from the database with internal and external coverage information from a previous execution of step E and F, or
X2 setting an execution policy when there is no internal and external coverage information as defined in step E and F, and executing steps B-F before starting step A;
and wherein the following steps are carried out at the end of said execution of the untrusted software program:
G determining if the recorded internal and external coverage information for the current execution policy reveals novel information indicative of previously unobserved program states or actions, thereby providing feedback for adaptive policy generation compared to a plurality of prior executions of the untrusted software program;
H if step G determines no novel information, discarding the current policy, and starting again from steps X1 and X2;
I if step G determines novel information:
I1 saving said novel information into the current execution policy and updating the database by adding the current execution policy to it; and then
I2 if step E detects no transient or permanent changes, performing again steps A-I; or
I3 if step E detects transient and/or permanent changes, reporting to a user that an instance of environment-sensitive behavior has been revealed for the untrusted software program.
2 . The method of claim 1 , wherein the software program is a binary executable.
3 . The method of claim 2 , wherein dynamic binary instrumentation is used for steps B-F.
4 . The method of claim 1 , wherein accesses to environmental information items include one or more of: the invocation of operating system APIs for querying environmental information, the use of CPU instructions that provide direct access to environmental information, and direct accesses to shared-memory regions mapped in the process space of the program.
5 . The method of claim 4 , wherein the operating system APIs for querying environmental information are configured to access or check the existence of one or more of: files, processes, registry contents, hardware interfaces, timing sources, application windows, and configuration parameters of the operating system.
6 . The method of claim 5 , wherein a rule from an execution policy for an access to an environmental information item can prescribe one of: modifying the contents of the item before its retrieval by the program, denying the access, or forging a fake result for the access when it would be denied by the normal operation of the underlying execution system.
7 . The method of claim 1 , where external coverage information of step E include one or more of: attempted network communications, the creation or opening of inter-process communication objects, the creation, modification or removal of files, processes, application windows, and configuration parameters of the operating system.
8 . The method of claim 1 , wherein random, coverage-guided fuzzing-style mutations over the current execution policy can make one or more of the following: adding rules, deleting an existing rule, and modifying an existing rule in its data manipulation criteria.
9 . The method of claim 8 , wherein added and/or deleted and/or modified rules are based on the information about the actions invoked by the software program and regulated by the execution monitor of step E.
10 . The method of claim 9 , wherein added and/or deleted, and/or modified rules are additionally based on the internal coverage information, wherein the internal coverage information of step F includes the data flows from the software program as recorded when the program executes a code that compares strings or other byte sequences, wherein said code is a standard library function or one or more comparison instructions in the code of the untrusted software program.
11 . The method of claim 1 , wherein the information about transient and permanent changes of step E include one or more of: creation, modification or removal of files, processes, application windows, and configuration parameters of the operating system, where applicable, network communications attempts, and the creation or opening of temporary objects such as mutexes and other inter-process communication objects.
12 . A system comprising:
a processor; and
a memory communicatively coupled to the processor, the memory including:
an untrusted software program;
an execution monitor;
a database of execution policies;
wherein the execution monitor is configured to perform the following steps:
A generating a new execution policy by means of random, coverage-guided fuzzing-style mutations of the rules in the execution policy, wherein the random, coverage-guided fuzzing-style mutations are made on the basis of said information about the actions recorded in the external coverage information to generate modifications to the rules in the execution policy, and wherein the new execution policy is set as the current execution policy;
B starting and monitoring an execution of the untrusted software program;
C interposing on accesses requested by the untrusted software program to one or more of the environmental information items;
D altering a response of the execution system to said requested accesses by taking the actions according to the current execution policy;
E recording, as external coverage information for guiding subsequent policy generation: information about the actions invoked by the untrusted software program and regulated by the execution monitor under the current execution policy when accessing environmental information items; and
information about possible transient and permanent changes done by the untrusted software program's execution to the execution system under the current execution policy;
F recording, as internal coverage information, information about internal program states, including code portions traversed by the untrusted software program's execution under the current execution policy, and data flows of the program, including values for input parameters when the program uses library functions or comparison instructions; and
X1 selecting an execution policy from the database with internal and external coverage information from a previous execution of step E and F, or
X2 setting an execution policy when there is no internal and external coverage information as defined in step E and F, and executing steps B-F before starting step A;
and wherein the following steps are carried out at the end of said execution of the untrusted software program:
G determining if the recorded internal and external coverage information for the current execution policy reveals novel information indicative of previously unobserved program states or actions, thereby providing feedback for adaptive policy generation compared to a plurality of prior executions of the untrusted software program;
H if step G determines no novel information, discarding the current policy, and starting again from steps X1 and X2;
I if step G determines novel information:
I1 saving said novel information into the current execution policy and updating the database by adding the current execution policy to it; and then
I2 if step E detects no transient or permanent changes, performing again steps A-I; or
I3 if step E detects transient and/or permanent changes, reporting to a user that an instance of environment-sensitive behavior has been revealed for the untrusted software program.
13 . The method of claim 11 , wherein the temporary objects are mutexes and other inter-process communication objects.