Granted Patent B2

US 9,104,868 · App. 13/943,709 · Granted Aug 11, 2015

Inventors: Gregory Dalcher (Tigard, OR); Jonathan Edwards (Portland, OR)

G06F21/56G06F21/564G06F21/566H04L63/1416

Abstract

Claims (66)

1. A non-transitory computer readable medium comprising instructions stored thereon that when executed cause one or more processing units to:

detect an execution of a payload by utilizing interface monitoring;

scan process memory associated with the execution of the payload for a match against at least one of a predefined plurality of signatures representing known unwanted data;

perform a behavioral analysis to determine whether a threshold amount of the payload has executed;

report a violation based on a precise match against at least one of the predefined plurality of signatures representing known unwanted data; and

maintain a level of interface monitoring and a level of process memory scanning based on a partial match against at least one of the predefined plurality of signatures representing known unwanted data, to manage a performance impact of the interface monitoring and process memory scanning.

2. The non-transitory computer readable medium of claim 1 , wherein the payload comprises an executable form of code.

3. The non-transitory computer readable medium of claim 1 , wherein the payload comprises unpacked code.

4. The non-transitory computer readable medium of claim 1 , wherein the instructions that when executed cause one or more processing units to detect the execution of the payload by utilizing interface monitoring comprise instructions that when executed cause one or more processing units to monitor predetermined interfaces.

5. The non-transitory computer readable medium of claim 4 , wherein the instructions that when executed cause one or more processing units to monitor predetermined interfaces comprise instructions that when executed cause one or more processing units to monitor at least one of an interface for loading a module, an interface for allocating and modifying a memory protection, and an interface for spawning a process.

6. The non-transitory computer readable medium of claim 1 , wherein the instructions that when executed cause one or more processing units to detect the execution of the payload by utilizing interface monitoring comprise instructions that when executed cause one or more processing units to detect the execution of the payload by detecting execution of an interface invoked by the execution of the payload.

7. The non-transitory computer readable medium of claim 1 , wherein the instructions that when executed cause one or more processing units to scan the process memory comprise instructions that when executed cause one or more processing units to scan data affected by invocation of a monitored interface.

8. The non-transitory computer readable medium of claim 1 , wherein the instructions that when executed cause one or more processing units to scan process memory comprise instructions that when executed cause one or more processing units to scan only predetermined types of process memory.

9. The non-transitory computer readable medium of claim 1 , wherein the instructions that when executed cause one or more processing units to scan process memory comprise instructions that when executed cause one or more processing units to determine whether the process memory matches only a portion of a signature from the predefined plurality of signatures representing known unwanted data.

10. The non-transitory computer readable medium of claim 9 , wherein the level of interface monitoring and the level of process memory scanning are maintained for subsequent executions of the payload if the process memory matches only the portion of the signature.

11. The non-transitory computer readable medium of claim 1 , wherein the instructions that when executed cause one or more processing units to perform the behavioral analysis comprise instructions that when executed cause one or more processing units to compare a current execution of the payload to previous executions of the payload.

12. The non-transitory computer readable medium of claim 1 , further comprising instructions that when executed cause one or more processors to:

reduce the level of interface monitoring and the level of process memory scanning after a predetermined amount of the payload has executed without matching any of the plurality of signatures.

13. A method, comprising:

detecting, by a processor device using interface monitoring, an execution of a payload;

scanning process memory associated with the execution of the payload for a match against at least one of a predefined plurality of signatures representing known unwanted data;

performing a behavioral analysis to determine whether a threshold amount of the payload has executed; and

maintaining a level of interface monitoring and a level of process memory scanning responsive to at least a partial match of at least one of the predefined plurality of signatures, to manage a performance impact of the interface monitoring and process memory scanning.

14. The method of claim 13 , wherein scanning process memory comprises:

scanning process memory initially at a second level; and

maintaining the second level responsive to a partial match of any of the predefined plurality of signatures.

15. The method of claim 14 , further comprising:

reducing the second level after a predetermined amount of the payload has executed without matching any of the predefined plurality of signatures.

16. The method of claim 13 , further comprising:

reducing the level of interface monitoring after a predetermined amount of the payload has executed without matching any of the predefined plurality of signatures.

17. The method of claim 13 , further comprising:

reporting a violation responsive to a complete match of any of the plurality of signatures.

18. A method, comprising:

detecting, by a processor device utilizing interface monitoring, an execution of a payload;

scanning process memory associated with the execution of the payload for a match against at least one of a predefined plurality of signatures representing known unwanted data;

performing a behavioral analysis to determine whether a threshold amount of the payload has executed;

reporting a violation based on a precise match against at least one of the predefined plurality of signatures representing known unwanted data; and

maintaining a level of interface monitoring and a level of process memory scanning based on a partial match against at least one of the predefined plurality of signatures representing known unwanted data, to manage a performance impact of the interface monitoring and process memory scanning.

19. The method of claim 18 , further comprising:

reducing the level of interface monitoring and the level of process memory scanning when a predetermined amount of the payload has executed and unwanted data has not been detected based on the process memory scanning.

20. A system, comprising:

a hardware processor;

a memory, coupled with the processor, the memory configured to store data associated with execution of a program on the processor;

an operating system, comprising one or more interfaces configured to provide access to functions provided by the operating system; and

a storage unit, coupled to the processor, on which is stored instructions that when executed cause the processor to:

detect an execution of a payload by monitoring one or more of the interfaces;

scan the memory for a match against at least one of a predefined plurality of signatures representing known unwanted data;

perform a behavioral analysis to determine whether a threshold amount of the payload has executed; and

maintain a level of interface monitoring and a level of memory scanning based on a partial match against at least one of the predefined plurality of signatures representing known unwanted data, to manage a performance impact of the interface monitoring and memory scanning.

21. The system of claim 20 , wherein the instructions further comprise instructions that when executed cause the processor to:

reduce the level of interface monitoring and the level of memory scanning after a predetermined amount of the payload has executed without matching any of the plurality of signatures.

22. The system of claim 20 , wherein the instructions further comprise instruction that when executed cause the processor to:

report a violation based on a precise match against at least one of the predefined plurality of signatures representing known unwanted data.

23. A system, comprising:

one or more hardware processors;

a process memory, coupled with the processors, the memory configured to store data associated with execution on the processors;

an operating system that when executed by the one or more processors provides one or more interfaces configured to provide access to functions provided by the operating system; and

a storage unit, coupled to the processors, on which is stored instructions that when executed cause the processors to:

detect an execution of a payload by utilizing monitoring of an interface of the one or more interfaces;

perform a behavioral analysis to determine whether a threshold amount of the payload has executed;

scan the process memory for a match against at least one of a predefined plurality of signatures representing known unwanted data; and

maintain a level of interface monitoring and a level of process memory scanning responsive to a partial match of at least one of the predefined plurality of signatures, to manage a performance impact of the interface monitoring and process memory scanning.

24. The system of claim 23 , wherein the instructions further comprise instructions that when executed cause the processing units to:

adjust the level of interface monitoring or the level of process memory scanning responsive to execution of a predetermined portion of the payload without a match of any of the predefined plurality of signatures.

25. The system of claim 24 , wherein the instructions that when executed cause the processing units to adjust the level interface monitoring or the level of process memory scanning comprise instructions that when executed cause the processing units to:

reduce the level of interface monitoring and the level of process memory scanning.

Assignments (9)

Continuity (2)