Monitoring and Validating File Associations

A system and method for computer security of a protected device that has a processor and an operating system software running on the processor includes security software that runs on the protected device and has local data for control of the security software. Upon initialization of the security software, the security software loads the local data and periodically reads file-type associations from the operating system software. For each file-type association, the security software determines if that file type is permitted by the local data and if that file type is not permitted by the local data, the security software removes that file-type association from the operating system software.

FIELD

This invention relates to the field of computer security and more particularly to a system for monitoring and preventing perturbation of file-type associations for malicious reasons.

BACKGROUND

For many operating systems, files have an application type embedded in the filename itself. For example, a Microsoft® Windows® file that ends in “.exe” signifies that the file is executable and is to be open and run by the operating system, compared with a file that ends in “.gif” which signifies that the file is an image file which is to be opened with an image viewer program to which it is associated. For example, when the file ending in “.gif” is selected (e.g., opened), the operating system finds an association to a program for all files that end in “.gif”. The operating system runs the program and presents the file to that program for opening and manipulating, in this case, for displaying an image.

In this example, the extension (the part of the file name that follows the last period or dot) is used by the operating system to determine how to interact with the file. A user, administrator, or installation script has the ability to set an association, for example, when a new file type is created. There are operating system tools for setting up such associations. For example, when a user or administrator installs a new web browser, the user or installation scrip must associate web browser extensions with the new browser so that when the user opens a web page (e.g., http://www.homepage.htlm), the new browser is used to open the web page.

Unfortunately, there is no enforcement of extension associations. For example, the user (or a malicious entity) is able to associate files that end in “.gif” with a program that processes spreadsheets. This opens the door for a malicious entity to create an executable file that has a suffix of “.gif”. As image files are often benign, users and security software will classify such a file as innocuous, indicating it is harmless, when it in fact is now executable and certainly not benign.

Operating systems provide support for new file types, typically those that are not native to the system. Most operating systems provide a mechanism to associate any extension with any handling program. So where a user may be suspicious of a file that ends in “.wsf,” which is typically associated with a script, they may be less suspicious of a file that ends in “.zyx”; unaware that behind the scenes a malicious entity has associated the “.zyx” file extension with a scripting engine. Such an association will cause that file to be executable code instead of a harmless image, and when accessed, invoke a scripting engine instead of an image viewer. From there, this malicious script is able to install further malware on the computer or access files and data as desired.

What is needed is a system that will detect unauthorized associations and disable the unauthorized associations until proven to be safe.

SUMMARY

Elements of the disclosed invention include monitoring software installed on a protected device (e.g., computer) that periodically monitors associations by reading operating system files and checking each association to determine if that association is safe (e.g., the association is known or is not known to be malicious). In order to determine if each association is safe, in some embodiments, files such as whitelists and blacklist are deployed to each protected device, each containing known safe associations (whitelists) or known malicious associations (blacklists), for example, a whitelist containing a list of all allowed file-type associations. In the whitelist example, when the monitor software periodically scans the set of associations, the whitelist is searched for each association and when an association is found that is not in the whitelist, that association is disabled or removed. In some embodiments, the potentially malicious association is reported and, in some embodiments, the potentially malicious association is forwarded to a server for further analysis. Then, if the further analysis concludes that the association is not malicious, the whitelist is updated to include the disabled association and the monitoring software running on the device on which the potentially malicious association was discovered is informed so that the disabled association will be reinstated.

In one embodiment, a system for computer security is disclosed including a protected device that has a processor and an operating system software running on the processor. Security software running on the protected device has local data for control of the security software. Upon initialization of the security software, the security software loads the local data and periodically, the security software reads file-type associations from the operating system software. For each file-type association, the security software determines if that file type is permitted by the local data and if that file type is not permitted by the local data, the security software removes that file-type association from the operating system software.

In another embodiment, a method of protecting a protected device is disclosed. The protected device has a processor and an operating system running on the processor. The method includes installing security software on the protected device. The security software runs on the processor after the protected device is initialized and reads a local data file to control file-type associations. The security software periodically reads a list of file-type associations from the operating system and for each of a file-type association in the list of file-type associations, the security software determines when the file-type association is blocked by the local data file and when the file-type association is blocked by the local data file, the security software removes the file-type association from the operating system.

In another embodiment, computer readable instructions for providing security to a protected device are tangibly embodied in a non-transitory storage medium are disclosed including computer readable instructions running on a processor of the protected device after the protected device is initialized, the computer readable instructions read a local data file to control file-type associations. Upon initialization, the computer readable instructions running on the processor periodically read a list of file-type associations from an operating system of the protected device. For each file-type association in the list of file-type associations, the computer readable instructions running on the processor uses the local data file to determine if the file-type association is blocked and when the file-type association is blocked, the computer readable instructions running on the processor removes the file-type association from the operating system.

DETAILED DESCRIPTION

In general, the system for expedited delivery initiates fast downloads of cloud files that have been recently updated, in particular, virus protection files.

Throughout this description, the term, “protected” refers to any device that has a processor and runs software. One example of such is a personal computer. Another example is a smartphone or tablet. The term, “user” refers to a human that has an interest in the computer, perhaps a user who is using the computer.

Referring toFIG.1illustrates a data connection diagram of the exemplary system for monitoring and validating file associations on a target device. In this example, a master file110M is stored in a storage of a server500and manipulated by an administrator device10, by an administrator. As an example, the master file110M includes a master list of approved file-type associations which are permitted for one or many protected devices12, as for example, a whitelist of approved associations. The administrator edits/manages the master file110M and, once ready, transfers the master file110M to the protected devices12where the list of approved file-type associations is stored locally as local data110A (e.g., in memory, a file). The security software16running on the protected device12periodically retrieves a list of file-type associations from the operating system running on the protected device12, for example, every ten minutes. For each file-type association in the list, the security software16checks the file-type association against the local data110A to determine if the current file-type association is approved (e.g., the current file-type association is in a whitelist of the local data110A) or if the current file-type association is banned (e.g., the current file-type association is in a blacklist of the local data110A).

If the current file-type association from the list is not approved or is banned, the security software16disables or deletes the current file-type association from the operating system and sends a transaction to the server500that describes details of the current file-type association such as the suffix (e.g., “.gif”), the association (e.g., script editor), and other available information such as the time/date when this file-type association was made. In some embodiments, the security software16also notifies a user of the protected device12, for example by a message (e.g., SMS or email) or a pop-up message.

When the transaction containing the details is received by the server500, software running on the server500performs an analysis of the association to determine if the file-type association is good, if it is malicious, or if such cannot be determined.

If the analysis determines that the file-type association is good, the file-type association is added to the whitelist of the master file110M which will eventually be distributed to the protected devices12and such file-type association will be permitted on the protected devices12. A transaction is also sent to the security software16running on the protected device12that reported the file-type association so that the deleted file-type association will be reinstated by the security software16.

If the analysis determines that the file-type association is malicious, the file-type association is added to the blacklist of the master file110M which will eventually be distributed to the protected devices12and such file-type association will be blocked on the protected devices12.

If the analysis cannot determine whether the file-type association is malicious or not, the file-type association is queued for a researcher at a researcher device8. The researcher analyzes the file-type association and adds the file-type association to the whitelist (if deemed a good file-type association by the researcher) or to the blacklist (if deemed a malicious file-type association) of the master file110M which will eventually be distributed to the protected devices12and such file-type association will be allowed or blocked on the protected devices12.

Referring toFIG.2, a schematic view of an exemplary protected device12is shown. The exemplary protected device12is a processor-based device that is protected from malware by security software16(seeFIG.1). The present invention is in no way limited to any particular protected device12, as many other processor-based devices are equally anticipated including, but not limited to smart phones, cellular phones, portable digital assistants, routers, thermostats, fitness devices, etc.

The exemplary protected device12represents a typical device used by an end user or employee. This exemplary protected device12is shown in its simplest form. Different architectures are known that accomplish similar results in a similar fashion, and the present invention is not limited in any way to any particular system architecture or implementation. In this exemplary protected device12, a processor70executes or runs programs in a random-access memory75. The programs are generally stored within a persistent memory74and loaded into the random-access memory75when needed. In some protected devices12, a removable storage slot88(e.g., compact flash, SD) offers removable persistent storage. The processor70is any processor, typically a processor designed for phones. The persistent memory74, random access memory75, and SIM card are connected to the processor by, for example, a memory bus72. The random-access memory75is any memory suitable for connection and operation with the selected processor70, such as SRAM, DRAM, SDRAM, RDRAM, DDR, DDR-2, etc. The persistent memory74is any type, configuration, capacity of memory suitable for persistently storing data, for example, flash memory, read only memory, battery-backed memory, etc. In some exemplary protected devices12, the persistent memory74is removable, in the form of a memory card of appropriate format such as SD (secure digital) cards, micro-SD cards, compact flash, etc.

Also connected to the processor70is a system bus82for connecting to peripheral subsystems such as a network interface80, a graphics adapter84and a touch screen interface92. The graphics adapter84receives commands from the processor70and controls what is depicted on the display86. The touch screen interface92provides navigation and selection features.

In general, some portion of the persistent memory74and/or the removable storage88is used to store programs, executable code, phone numbers, contacts, and data, etc. In some embodiments, other data is stored in the persistent memory74such as audio files, video files, text messages, etc.

The peripherals are examples, and other devices are known in the industry such as Global Positioning Subsystems, speakers, microphones, USB interfaces, cameras, microphones, Bluetooth transceivers, Wi-Fi transceivers96, touch screen interfaces92, image sensors, temperature sensors, etc., the details of which are not shown for brevity and clarity reasons.

The network interface80connects the exemplary protected device12to the network506(e.g., the Internet) through any known or future protocol such as Ethernet, WI-FI, GSM, TDMA, LTE, etc., through a wired or wireless medium. There is no limitation on the type of connection used. The network interface80provides data and messaging connections between the exemplary protected device12and the server500through the network506.

Referring toFIG.3, a schematic view of a typical server500is shown. The exemplary server500represents a typical server computer system. Although the exemplary server500is shown as a stand-alone system, it is fully anticipated that the server500be part of a cloud-computing environment or include multiple computers. Different architectures are known that accomplish similar results in a similar fashion and the present invention is not limited in any way to any particular computer system architecture or implementation. In this exemplary computer system, a processor570executes or runs programs in a random-access memory575. The programs are generally stored within a persistent memory574and loaded into the random-access memory575when needed. The processor570is any processor, typically a processor designed for computer systems with any number of core processing elements, etc. The random-access memory575is connected to the processor by, for example, a memory bus572. The random-access memory575is any memory suitable for connection and operation with the processor570, such as SRAM, DRAM, SDRAM, RDRAM, DDR, DDR-2, etc. The persistent memory574is any type, configuration, capacity of memory suitable for persistently storing data, for example, magnetic storage, flash memory, read only memory, battery-backed memory, magnetic memory, etc. The persistent memory574is typically interfaced to the processor570through a system bus582, or any other interface as known in the industry.

Also shown connected to the processor570through the system bus582is a network interface580(e.g., for connecting to a network506—e.g., the Internet), a graphics adapter584and a keyboard interface592(e.g., Universal Serial Bus—USB). The graphics adapter584receives information from the processor570and controls what is depicted on a display586. The keyboard interface592provides navigation, data entry, and selection features.

In general, some portion of the persistent memory574is used to store programs, executable code, master files110M, and other data, etc.

The peripherals are examples and other devices are known in the industry such as pointing devices, touch-screen interfaces, speakers, microphones, USB interfaces, Bluetooth transceivers, Wi-Fi transceivers, image sensors, temperature sensors, etc., the details of which are not shown for brevity and clarity reasons.

Referring toFIGS.4and5, a user interface300for listing file-type associations is shown. In such, to the left are names of file types302, in this example, file name extensions such as “.doc”, “.docx” and “.wsf”. In the right column are default applications304for the corresponding file type302. For example, when a file having a file name ending in “.doc” is selected (e.g., double click in an explorer window), the default application of “WORD” is run to process that file. Likewise when a file having a file name ending in “.wsf”306is selected (e.g., double click in an explorer window), the default application of “Microsoft® Windows Based Script Host”308is run to process that file. InFIG.5, a new filetype association has been added (e.g., by a malicious entity). This association includes files ending in “zyx”310and the default application of “Microsoft® Windows Based Script Host”308. With such, if a user of the computer accesses a file such as “mypicture.zyx”, based upon this association, “Microsoft® Windows Based Script Host”308is launched to process the file, which may include virus script software that is dangerous to the computer. Many computer users are likely to be unaware of the dangers of such rouge application associations. Further, if a bad actor changes a well-known association, for example, “.gif”—the unexpecting use will often click on what is believed to be an image file believing that it is harmless.

Referring toFIGS.6and7, exemplary program flows of the system for monitoring and validating file associations on a device is shown. Note that although the following flow charts indicate software running on the protected device12and running on the server500, any division of functionality is fully anticipated including the entire process running on the protected device12.

In the example ofFIG.6, the security software16initializes200and loads202the list of approved file-type associations (e.g., whitelist) is stored locally as local data110A (e.g., in memory, a file) or in some embodiments the list of prohibited file-type associations (e.g., blacklist) stored locally as local data110A. The security software16running on the protected device12periodically retrieves a list of file-type associations from the operating system running on the protected device12, for example, setting a timer204for ten minutes. When the timer expires210, the security software16starts at the first file-type association220and loads this file-type association222(for example, in MS Windows®, the file-type associations are stored in the registry). If there are no more file-type associations, the check is done224and the above is repeated. If not done224, the security software16checks226the file-type association against the local data110A to determine if the current file-type association is approved (e.g., the current file-type association is in a whitelist of the local data110A) or if the current file-type association is banned (e.g., the current file-type association is in a blacklist of the local data110A).

If the analysis determines that the current file-type association is good226, the next file-type association is addressed228and the above is repeated for this file-type association.

If the analysis determines that the current file-type association is not good226, the current file-type association is blocked230(e.g., the registry entry for the current file-type association is removed from the registry) and a notification is sent232to the server500. As above, the next file-type association is addressed228and the above is repeated for this next file-type association.

InFIG.7, the software running on the server500receives280the file-type association that was determined to be not good by the security software16running on the protected device12(e.g., the association is not on the whitelist or is on the blacklist, or both). In order to algorithmically determine if this association is good or bad, the software running on the server500loads a database of file type counts282which includes total counts found globally (or locally) of all possible file-type associations. For example, the list will have a very high number of associations between “.doc” and WORD and a very small number of associations between “doc” and a spreadsheet program, as spreadsheet programs are not often used to open document files. If the count from the list for this file-type association is greater than a set threshold284(e.g., thousands of other devices use this association), the file-type association is added to the whitelist286(e.g, added to the master file110M) which is eventually distributed288to the protected devices12and such file-type association will then be permitted on the protected devices12. In some embodiments, a transaction is also sent to the security software16running on the protected device12that reported the file-type association so that the deleted file-type association will be reinstated by the security software16(not shown for clarity reasons).

If the count from the list for this file-type association is not greater than a set threshold284, but the count from the list for this file-type association is greater than a second set threshold290, it is assumed that many users are interested in this file-type association and this file-type association is queued for analysis294(e.g., reviewed by a researcher at a researcher device8to determine if this file-type association is dangerous and possibly malicious).

If the count from the list for this file-type association is not greater than a set threshold284, and the count from the list for this file-type association is not greater than a second set threshold290, then this file-type association is declared as malicious and a warning message292is displayed. In embodiments using blacklists, this file-type association is added296to the blacklist in the master data file110M and distributed298to the protected devices12.

It is anticipated that when the researcher analyzes this file-type association, the researcher will add the file-type association to the whitelist (if deemed a good file-type association by the researcher) or to the blacklist (if deemed a malicious file-type association) of the master file110M which will eventually be distributed to the protected devices12and such file-type association will be allowed or blocked on the protected devices12.

The above is an exemplary implementation using a time delay and it is equally anticipated to implement the same or similar functionality using interrupt algorithms or any way to periodically check for valid file-type associations.