Early malware detection in on-the-fly security sandboxes using recursive neural networks (RNNs)to capture relationships in behavior sequences on data communication networks

A file copy is executed in a virtual runtime environment that tracks behavior using RNN taking runtime behavior of at least a first time into account with current runtime behavior at a second time. This is responsive to not finding a known signature for suspicious activity during virus scanning. A behavior sequence is identified on-the-fly during file copy execution that is indicative of malware, prior to completing the execution, the behavior sequence involving at least two actions taken at different times during file copy execution. Responsive to the identification, the execution is terminated and the virtual runtime environment is returned to the pool of available virtual runtime environments.

FIELD OF THE INVENTION

The invention relates generally to computer network security, and more specifically, to identifying malware by capturing relationships in behavior sequences with recursive neural networks (RNNs) during runtime in a sandbox runtime, without full execution.

BACKGROUND

Virus scanning only offers partial protection from malicious files on the Internet downloaded to computing devices. They can predict behavior but cannot determine actual events that will occur.

On the other hand, sandboxing a file for execution is resource intensive. A partitioned section of hardware has to be reserved for this purpose. Dedicated memory, processing, and other resources are consumed with isolating the sandbox environment from the normal computer operations.

Therefore, what is needed is a robust technique for identifying malware by capturing relationships in behavior sequences with RNNs during runtime in a sandbox, without full execution.

SUMMARY

These shortcomings are addressed by the present disclosure of methods, computer program products, and systems for identifying malware by capturing relationships in behavior sequences with RNNs during runtime in a sandbox, without full execution.

In one embodiment, a request for runtime behavioral analysis of a file is received from a virus detection module of a remote networking device (e.g., sandbox client), along with a copy of the file, and responsive to the malware detection module detecting an anomaly without a matching known malware signature. A virtual runtime environment is invoked to execute the file copy from a pool of available virtual runtime environments.

In an embodiment, the file copy is executed in a virtual runtime environment that tracks behavior using RNN taking runtime behavior of at least a first time into account with current runtime behavior at a second time. A behavior sequence is identified on-the-fly during file copy execution that is indicative of malware, prior to completing the execution, the behavior sequence involving at least two actions taken at different times during file copy execution.

In another embodiment, responsive to the identification, the execution is terminated and the virtual runtime environment is returned to the pool of available virtual runtime environments. The malware detection module of the remote networking device is responded to with a positive result to prevent file execution at the remote networking.

Advantageously, computer performance is improved with more efficient scanning and conserving computer resources.

DETAILED DESCRIPTION

The description below provides methods, computer program products, and systems for identifying malware by capturing relationships in behavior sequences with RNNs during runtime in a sandbox, without full execution. One of ordinary skill in the art will recognize many additional variations made possible by the succinct description of techniques below. For example, although RNNs are referred to herein for illustration, different machine learning algorithms with capabilities to capture dynamics governing a sequence or a time series can also be substituted.

I. Systems for RNN Sandbox Malware Detection (FIG.1-2)

FIGS.1A-1Bare high-level block diagrams illustrating a system100for identifying malware by capturing relationships in behavior sequences with RNNs during runtime in a sandbox, without full execution, according to one embodiment. The system100includes a sandbox server110, a firewall server120, an access point130, and station140, coupled through a wide area network. Many other embodiments are possible, for example, with more access points, more or fewer stations, additional components, such as firewalls, routers, switches, and the like. Hardware and software components can be implemented similar to the example ofFIG.6.

The wide area network links components of the system100with a channel for data communication. The sandbox server110, the firewall server120and the access point130are preferably connected to the wide area network via hardwire. The station140are wirelessly connected to the access points101A-D to access the wide area network indirectly. The wide area network can be a data communication network such as the Internet, a WAN, a LAN, WLAN, can be a cellular network (e.g., 3G, 4G, 5G or 6G), or a hybrid of different types of networks. Thus, the system100can be a LAN or include cloud-based devices.

The sandbox server110receives requests for runtime behavior analysis from malware detection software (remote or local). A virtual runtime environment is invoked to run a suspicious file and observe behavior for correlation. The sandbox server110identifies on-the-fly a behavior sequence during runtime, prior to completing execution. Once identified, the virtual runtime environment can be terminated and returned to availability for a new file. In one embodiment, a pool of virtual runtime environments is administered. A virtual runtime environment, as referred to herein, can be a physically or virtually isolated from processes observing the virtual runtime environment and operation of the sandbox server110in general. Files can be executed immediately, installed to an operating system before execution, or executed over a platform such as Java, Flash, PDF, or Microsoft Word (e.g., macros).

In an embodiment, individual non-malicious individual events can be correlated to detect malicious behavior. Machine learning such as RNN uses memory aspects to track evaluate a current event in view of historical events. The current event is matched with various combinations of past events, which together comprise malicious behavior. Behavior patterns can be preprogrammed and derived through experience, i.e., learned. In one embodiment, only part of a file is uploaded to save even more bandwidth, in anticipation of early virus detection. Further file chunks can be uploaded as needed. Additional embodiments of the sandbox server110are set forth below with respect toFIG.2.

Many different network devices can be in communication with the sandbox server110to outsource runtime scanning. First, the firewall server120(e.g., FORTIGATE) refers suspicious files being transmitted for sandbox scanning to the sandbox server110. During operations, the firewall server120examines files and file requests between an internal network (e.g., a LAN) and an external network (e.g., the Internet). If a virus signature cannot be matched to suspicious activity, a copy of the file is uploaded by a sandbox client122. Once the positive result is received, the file can be immediately contained responsive to finding runtime malicious behavior. The process occurs quickly while the file in queue for processing because the sandboxing does not need to completely execute a file to find malicious runtime behavior. Responsive to malignant behavior, the file can be forwarded to its destination.

Next, the access point130(e.g., FORTIAP) can also refer station file uploads from stations to the sandbox server110for sandbox scanning. At this particular network device, files sent by the station140over Wi-Fi for transmission can be selected by the sandbox client132for scanning upstream. Downstream traffic sent to the station140may be examined by the firewall server120, but some embodiments of the system100may not have firewalls and consequentially downstream traffic can be examined by the access point130.

Additionally, some embodiments the station140can actively refer files downloaded by the station or even loaded through a USB drive or other physically connected device source locally. While the firewall server120and the access point130are integrated on the network side, the station140may need to download a client app for easy access to the sandbox server130. The downloaded client can interoperate with local virus scanning, such as sandbox client142, to detect when a referral is needed.

The network components of the system100can implemented in any of the computing devices discussed herein, for example, a personal computer, a laptop computer, a tablet, a smart phone, a smart watch, a mobile computing device, a server, a cloud-based device, a virtual device, an Internet appliance, an IoT (Internet of things) device, or any of the computing devices described herein, using hardware and/or software (see e.g.,FIG.6).

FIG.2is a more detailed block diagram illustrating the sandbox server110of the system ofFIG.1, respectively, according to one embodiment. The sandbox server110comprises a network device registration module210, a virtual environment management module220, an RNN learning module230, and a network communication module240. The components can be implemented in hardware, software, or a combination of both.

The network device registration module210manages communication with network devices for referrals and results. Various network devices can register for scanning services, including the firewall device120, the access point130and in some embodiments the station140. Other implementations also register gateways, routers, switches, network appliances, and Internet of Things (IoT) devices, for instance.

The virtual runtime environment management module220assigns files to be scanned to available virtual runtime environments. For example, virtual machines can be utilized to execute files in virtual isolation. Scanning bandwidth can be monitored, and some scans are queued until the scanning bandwidth is available.

The RNN learning module230detects correlations between individual events. To train an RNN to tag a behavior log as malicious or benign, behavior logs of hundreds of thousands of files with known malware or benign tags are used. During the training phase, parameters of the RNN are tuned such that it can reproduce the correct detection. This offline training phase is performed before deploying sandbox in the field. During actual runtime, a feedback loop takes a current behavior in view of the log of events and feed it into RNN to produce a detection tag. In other embodiments, different machine leaning algorithms utilize the log of events to identify viruses.

Offline parsing of thousands of behavior log is used to train RNN. Each behavior log consists of different operations. Operations that are logged include file operations, traffic over network, registry modifications, memory operations, and executed command lines. As well as these operations, other files can be downloaded or generated during running. Useful information can be extracted from each operation showing how it can affect its host running environment or what capabilities it has. For example, for the following file operation:Operation: ModifyPath: %SYSTEMROOT%\Intelx386\WinAce 3.85 (with Serial).exeSeveral capabilities can be summarized through introduction of the following tokens:Token 1) Modified_exe,Token 2) modified_exe_%SYSTEMROOT%Token 3) modified_exe_%SYSTEMROOT%_Intelx386 These tokens represent that running the file copy in virtual environment has capability of modifying another executable file (exe) inside sensitive SYSTEMROOT folder.

Parsing logs result in tens of thousands of these tokens. Tokens that distinguish the most between malware and clean classes are selected. To this end, we define the following measure and use to it select best tokens that have classification:
Score(token)=absolute
(Freq_in_Malware−Freq_in_Clean)/(Freq_in_Malware+Freq_in_Clean)
Where Freq denotes number of times one token is observed in its corresponding detection class malware or clean.

Examples of other tokens for Network traffic operations include: http_POST, http_GET_exe, udp_PUBLIC, tcp_PRIVATE_445. Also, Windows registry operations comprise another class of important tokens such as Number_of_Registries_Deleted, Created_Registry_in_HKLM_Software_Microsoft_Active_Setup_Path, etc. Other tokens can be defined for memory operations, file operations, and command line details. It should be noted that tokens are not limited to specific operations and can also include statistical information such as memory consumption, number of created processes, total number of file operations, etc.

A good example of statistical information that result in detection of Ransomware malware family are those that provides counts of different file type operations (document, jpeg, etc) or number of files deleted on user's folder.

Tokens of different operations, as shown in Table 1, are concatenated together to form a feature vector. As a sample continues to run, these feature vectors are constructed to form a sequence. Sequences constructed from offline lab data are used to train an RNN.

The network communication module240can provide network protocol services and lower layer services for packetizing data according to Ethernet or other protocols. The network communication module240can include transceivers with modulators, antennae and drivers to exchange data with a physical medium. An operating system can interface applications executing on stations with network services.

FIG.3is a sequence diagram illustrating an example of interactions between components of the system100ofFIG.1. Many other variations are possible given the teachings of the disclosure herein.

At interaction301, a file is transmitted to the firewall server120(or the access point130) from the Internet. Then, at interaction302, a sandbox scan referral message is transmitted from the firewall device120to the sandbox server110. Finally, at interaction303, a decision of positive or negative is sent in messages from the sandbox server to the firewall server120. If approved, at interaction304, the file is transmitted to the access point130and ultimately to the station140.

FIG.4is a high-level flow diagram illustrating a method for referring files from a network device to a sandbox server responsive to virus scanning, according to one embodiment. The method400can be implemented, for example, by the system100ofFIG.1. The steps are merely representative groupings of functionality, as there can be more or fewer steps, and the steps can be performed in different orders. Many other variations of the method400are possible.

At step410, a network device receives a file into a queue for virus scanning. The file can be segmented across several data packets and reassembled.

At step420, malware detection module may not match any known malware signatures while scanning the file, but does identify red flags, at step430. The red flags can be safe actions in isolation, but also be an element in a formula for malicious behavior. In this case, at step440, a copy of the file is sent to a remote (or local) sandbox server for RNN analysis.

At step450, a positive result for a virus or a negative result, is received from the sandbox server based on the RNN analysis.

FIG.5is a high-level flow diagram illustrating a method for identifying malware by capturing relationships in behavior sequences with RNNs during runtime in a sandbox, without full execution, according to one embodiment.

At step510, a request for runtime behavioral analysis of a file is received from a virus detection module of a remote networking device (e.g., sandbox client), along with a copy of the file (e.g., step440), and responsive to the malware detection module detecting an anomaly (e.g., step430) without a matching known malware signature (e.g., step420).

At step520, a virtual runtime environment is invoked to execute the file copy from a pool of available virtual runtime environments.

At step530, the file copy is executed in a virtual runtime environment that tracks behavior using RNN taking runtime behavior of at least a first time into account with current runtime behavior at a second time.

At step540, a behavior sequence is identified on-the-fly during file copy execution that is indicative of malware, prior to completing the execution, the behavior sequence involving at least two actions taken at different times during file copy execution.

At step550, responsive to the identification, the execution is terminated and the virtual runtime environment is returned to the pool of available virtual runtime environments.

At step560, the malware detection module of the remote networking device is responded to with a positive result to prevent file execution at the remote networking (e.g., step450.

FIG.6is a block diagram illustrating an example computing device600for use in the system100ofFIG.1, according to one embodiment. The computing device600is implementable for each of the components of the system100. The computing device600can be a mobile computing device, a laptop device, a smartphone, a tablet device, a phablet device, a video game console, a personal computing device, a stationary computing device, a server blade, an Internet appliance, a virtual computing device, a distributed computing device, a cloud-based computing device, or any appropriate processor-driven device.

The computing device600, of the present embodiment, includes a memory610, a processor620, a storage drive630, and an I/O port640. Each of the components is coupled for electronic communication via a bus699. Communication can be digital and/or analog, and use any suitable protocol.

The memory610further comprises network applications612and an operating system614. The network applications612can include a web browser, a mobile application, an application that uses networking, a remote application executing locally, a network protocol application, a network management application, a network routing application, or the like.

The operating system614can be one of the Microsoft Windows® family of operating systems (e.g., Windows 96, 98, Me, Windows NT, Windows 2000, Windows XP, Windows XP x64 Edition, Windows Vista, Windows CE, Windows Mobile, Windows 6 or Windows 8), Linux, HP-UX, UNIX, Sun OS, Solaris, Mac OS X, Alpha OS, AIX, IRIX32, IRIX64, or Android. Other operating systems may be used. Microsoft Windows is a trademark of Microsoft Corporation.

The processor620can be a network processor (e.g., optimized for IEEE 802.11, IEEE 802.11AC or IEEE 802.11AX), a general purpose processor, an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), a reduced instruction set controller (RISC) processor, an integrated circuit, or the like. Qualcomm Atheros, Broadcom Corporation, and Marvell Semiconductors manufacture processors that are optimized for IEEE 802.11 devices. The processor620can be single core, multiple core, or include more than one processing elements. The processor620can be disposed on silicon or any other suitable material. The processor620can receive and execute instructions and data stored in the memory610or the storage drive630

The storage drive630can be any non-volatile type of storage such as a magnetic disc, EEPROM (electronically erasable programmable read-only memory), Flash, or the like. The storage drive630stores code and data for applications.

The I/O port640further comprises a user interface642and a network interface644. The user interface642can output to a display device and receive input from, for example, a keyboard. The network interface644(e.g. RF antennae) connects to a medium such as Ethernet or Wi-Fi for data input and output.

Many of the functionalities described herein can be implemented with computer software, computer hardware, or a combination.

The phrase “network appliance” generally refers to a specialized or dedicated device for use on a network in virtual or physical form. Some network appliances are implemented as general-purpose computers with appropriate software configured for the particular functions to be provided by the network appliance; others include custom hardware (e.g., one or more custom Application Specific Integrated Circuits (ASICs)). Examples of functionality that may be provided by a network appliance include, but is not limited to, Layer 2/3 routing, content inspection, content filtering, firewall, traffic shaping, application control, Voice over Internet Protocol (VoIP) support, Virtual Private Networking (VPN), IP security (IPSec), Secure Sockets Layer (SSL), antivirus, intrusion detection, intrusion prevention, Web content filtering, spyware prevention and anti-spam. Examples of network appliances include, but are not limited to, network gateways and network security appliances (e.g., FORTIGATE family of network security appliances and FORTICARRIER family of consolidated security appliances), messaging security appliances (e.g., FORTIMAIL family of messaging security appliances), database security and/or compliance appliances (e.g., FORTIDB database security and compliance appliance), web application firewall appliances (e.g., FORTIWEB family of web application firewall appliances), application acceleration appliances, server load balancing appliances (e.g., FORTIBALANCER family of application delivery controllers), vulnerability management appliances (e.g., FORTISCAN family of vulnerability management appliances), configuration, provisioning, update and/or management appliances (e.g., FORTIMANAGER family of management appliances), logging, analyzing and/or reporting appliances (e.g., FORTIANALYZER family of network security reporting appliances), bypass appliances (e.g., FORTIBRIDGE family of bypass appliances), Domain Name Server (DNS) appliances (e.g., FORTIDNS family of DNS appliances), wireless security appliances (e.g., FORTIWIFI family of wireless security gateways), FORIDDOS, wireless access point appliances (e.g., FORTIAP wireless access points), switches (e.g., FORTISWITCH family of switches) and IP-PBX phone system appliances (e.g., FORTIVOICE family of IP-PBX phone systems).