Patent Publication Number: US-10318731-B2

Title: Detection system and detection method

Description:
RELATED APPLICATIONS 
     This application claims priority to Taiwan Application Serial Number 105138306, filed Nov. 22, 2016, which is herein incorporated by reference. 
     BACKGROUND 
     Technical Field 
     The present disclosure relates to a detection system and a detection method. More particularly, the present disclosure relates to a detection system and a detection method related to the behavior of malware program. 
     Description of Related Art 
     With the development of technology, internet becomes an important part in human&#39;s daily life. However, the internet also brings the multiple damages to the information security. For example, a user may receive the malware program in an unknown situation. And, the malware program may steal the user information or attack the electronic device to damage it. 
     Therefore, how to efficiently perform the detection of the malware program in the system becomes a problem to-be solved in the art. 
     SUMMARY 
     To address the issues, one aspect of the present disclosure is to provide a detection system. The detection system comprises a memory space, a central scheduling module, a performance monitoring module, a memory forensics module and an analyzing module. The central scheduling module transmits a to-be tested file to a first testing machine; wherein the first testing machine uses for executing the to-be tested file. The performance monitoring module monitors that whether a component usage of the first testing machine is higher than a default threshold during a period of executing the to-be tested file. When the component usage of the first testing machine is higher than the default threshold, the memory forensics module analyzes the memory space of the first testing machine. The analyzing module determines that whether the to-be tested file comprises a malware program according to an analyzing result of the memory space. 
     Another aspect of the present disclosure is to provide a detection method implemented by a processing device, the detection method comprising: (A) transmitting a to-be tested file to a first testing machine by the processing device; wherein the first testing machine uses for executing the to-be tested file; (B) monitoring that whether a component usage of the first testing machine is higher than a default threshold during a period of executing the to-be tested file by the processing device; and (C) when the component usage of the first testing machine is higher than the default threshold, the memory forensics module analyzes the memory space of the first testing machine to determine that whether the to-be tested file comprises a malware program and generate an analyzing result. 
     Accordingly, the detection system and the detection method can perform the detection to the specific virtual component in multiple meaningful execution stages and avoid the careless omission of the detection during the malware program execution. Besides, the invention can dynamically analyze whether the memory is abnormal without interrupting the operation of the first testing machine. And, the invention does not need to interrupt the first testing machine and then perform memory dump process. Further, the invention monitors that whether the testing machine executed the to-be tested file (e.g. the first testing machine) is abnormal by the monitoring testing machine (e.g. the second testing machine). As such, the invention does not modify the management mechanism of the virtual machine management device. In this manner, the invention also can avoid the anti-detection mechanism performed by the malware program. 
     It is to be understood that both the foregoing general description and the following detailed description are by examples, and are intended to provide further explanation of the disclosure as claimed. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The disclosure can be more fully understood by reading the following detailed description of the embodiment, with reference made to the accompanying drawings as follows: 
         FIGS. 1A-1B  depict a schematic diagram of detection method of malware program according to one embodiment of present disclosure; 
         FIG. 2  depicts a block diagram of a detection system according to one embodiment of the present disclosure; 
         FIG. 3  depicts a flow chart of a detection method according to one embodiment of the present disclosure; 
         FIG. 4  depicts a flow chart of a detection method according to one embodiment of the present disclosure; 
         FIG. 5  depicts a block diagram of a performance monitoring module according to one embodiment of the present disclosure; and 
         FIG. 6  depicts a schematic diagram of a method for configuring the default threshold according to one embodiment of the present disclosure. 
     
    
    
     DETAILED DESCRIPTION 
     Reference will now be made in detail to the present embodiments of the disclosure, examples of which are illustrated in the accompanying drawings. Wherever possible, the same reference numbers are used in the drawings and the description to refer to the same or like parts. 
     References are made to  FIGS. 1A-1B ,  FIGS. 1A-1B  depict a schematic diagram of detection method of malware program according to one embodiment of present disclosure. In  FIGS. 1A-1B , the time line t marks multiple execution stages P 1 -P 6 . Each one of the execution stages P 1 -P 6  respectively represents a partial execution period of the malware program. For example, the execution stage P 1  represents the start execution period. The execution stage P 2  represents the vulnerability searching and using period. The execution stage P 3  represents the program installation period. The execution stage P 4  represents the commanding and controlling period. The execution stage P 5  represents the malware behavior execution period. The execution stage P 6  represents the destroying evidence period. 
     In  FIG. 1A , the to-be tested computer executes the memory dump processes DM 1 -DM 5  in each fixed time interval, so as to obtain all the executed programs, processes, jobs, opened files, etc. of the current memory of the to-be tested computer. For example, each time interval is 10 seconds. By analyzing these data, it can determine that whether the to-be tested computer is attacked by the malware program. The to-be tested computer can be implemented by the panel, notebook, smart phone or other device with transmission function. However, the memory dump process needs to spend extra time and storage space. Therefore, it will be spent too much time and too much storage space for performing the memory dump process when the time interval is configured too short. In contrast, it may cause that not all the execution stages (e.g. the execution stages P 3  and the execution stages P 6  in  FIG. 1 ) can be detected to find the attack by the malware program when the time interval is configured too long. 
     In  FIG. 1B , the to-be tested computer executes the memory dump processes DM 1 -DM 3  when a specific application programming interface (API) is detected, so as to obtain all the executed programs, processes, jobs, opened files, etc. of the current memory of the to-be tested computer. Besides, by analyzing these data, it can determine that whether the to-be tested computer is attacked by the malware program. However, the detection method even cannot detect whether the to-be tested computer attacks by the malware program during each one of the execution stages (e.g. the execution stages P 2 , P 4  and P 6  do not call the specific API. As such, the execution stages P 2 , P 4  and P 6  cannot be detected in  FIG. 1B ). 
     Therefore, the following embodiments provide a detection method and a detection system of malware program. The detection method and the detection system can substantially monitoring the to-be tested file in multiple execution stages. 
     Reference is made to  FIG. 2 .  FIG. 2  depicts a block diagram of a detection system  200  according to one embodiment of the present disclosure. In one embodiment, the detection system  200  includes a second testing machine VM 2 . The second testing machine VM 2  comprises a performance monitoring module  210 , a memory forensics module  220 , a central scheduling module  250  and an analyzing module  260 . In one embodiment, the second testing machine VM 2  further comprises a sample format module  240 . 
     In one embodiment, the performance monitoring module  210  is coupled to the memory forensics module  220  and the central scheduling module  250 . The memory forensics module  220  is coupled to the analyzing module  260 . The analyzing module  260  is coupled to the central scheduling module  250 . The central scheduling module  250  is coupled to the sample format module  240 . 
     In one embodiment, the performance monitoring module  210 , the memory forensics module  220 , the sample format module  240 , the central scheduling module  250 , and the analyzing module  260  can be separately or combined by using a microcontroller, a microprocessor, a digital signal processor, an application specific integrated circuit (ASIC), or a logic circuit to implement. 
     In one embodiment, the detection system  200  comprises the first testing machine VM 1 , the second testing machine VM 2  and virtual machine management device (e.g. hypervisor) VMM. 
     In one embodiment, the first testing machine VM 1  and the second testing machine VM 2  are constructed (installed or executed) on the virtual machine management device VMM. The virtual machine management device VMM uses for executing an operation system HOS. The first testing machine VM 1  and the second testing machine VM 2  can respectively access at least one physical device through the operation system HOS. For instance, the first testing machine VM 1  and the second testing machine VM 2  can respectively access the same physical disk. 
     In one embodiment, the virtual machine management device VMM uses for virtualizing different kinds of physical devices. The virtual machine management device VMM is formed between the physical device and the software. The virtual machine management device VMM can support multiple operation systems executing on a computer. In other words, the virtual machine management device VMM not only can execute the operation system HOS, but also can execute multiple virtual machines (VM) on the same physical device (e.g. computer). For example, each one of the first testing machine VM 1  and the second testing machine VM 2  can execute an operation system by itself, respectively. For example, the first testing machine VM 1  can execute Windows operation system. The second testing machine VM 2  can execute Linux operation system. 
     In one embodiment, first testing machine VM 1  and the second testing machine VM 2  operate independently and respectively, just like respectively having the independent physical environment, even when the first testing machine VM 1  and the second testing machine VM 2  actually executing on the same physical device. 
     In one embodiment, the invention even can run (or operate) the first testing machine VM 1  on a first server and run the second testing machine VM 2  on a second server. And, the second server can be used for monitoring the operation of each component in the first server, so as to analyze whether the first server is attacked by the malware program. 
     In one embodiment, the second testing machine VM 2  includes the performance monitoring module  210  and the memory forensics module  220 . The performance monitoring module  210  is coupled to the memory forensics module  220 . The memory forensics module  220  is communicatively coupled to the memory space VMR of the virtual machine management device VMM. The first testing machine VM 1  and the performance monitoring module  210  of the second testing machine VM 2  are respectively coupled to the virtual components of the virtual machine management device VMM. The virtual components includes: memory space VMR (e.g. virtual memory), virtual disk VDK, virtual network card VIF and virtual processor VCPU. The first testing machine VM 1  and the performance monitoring module  210  of the second testing machine VM 2  can respectively access the data of memory space VMR, virtual disk VDK, virtual network card VIF and virtual processor VCPU. 
     In one embodiment, the memory space VMR can be implemented by using a ROM (read-only memory), a flash memory, a floppy disc, a hard disc, an optical disc, a flash disc, a tape, an database accessible from a network, or any storage medium with the same functionality that can be contemplated by persons of ordinary skill in the art to which this invention pertains. 
     In one embodiment, these virtual components are implemented by software simulation technology. The software can implement the interfaces and the functions similar to the underlying hardware. For example, the software can simulate multiple virtual processors VCPU according to the scheduling algorithm of the physical processor. However, the present invention can apply the existing technologies to create every virtual component. As such, it is not necessary to further describe the details herein. 
     In some embodiment, the first testing machine VM 1  uses for executing the to-be tested file. The second testing machine VM 2  uses for monitoring the operation of the first testing machine VM 1  to analyze whether the to-be tested file will cause the first testing machine VM 1  to be attacked by the malware program. The to-be tested file can be a program, a word file, a figure file, a compressed file or other files that different kinds of the malware programs can be embed in it. 
     Reference is made to  FIG. 3 .  FIG. 3  depicts a flow chart of a detection method  300  according to one embodiment of the present disclosure. In one embodiment, each step of the detection method  300  can be implemented by a processing device. In one embodiment, the processing device includes the performance monitoring module  210 , the memory forensics module  220 , the sample format module  240 , the central scheduling module  250  and the analyzing module  260 . 
     In step  310 , the central scheduling module  250  transmits a to-be tested file to a first testing machine VM 1 . And, the first testing machine VM 1  uses for executing the to-be tested file. 
     In one embodiment, the first testing machine VM 1  includes at least one of a memory, a disk, a network card and a processor. 
     In one embodiment, the component usage comprises at least one of a memory usage, a disk usage, a network card or network usage, and a processor usage. And, the different component usage corresponds to the different default threshold. 
     In one embodiment, the first testing machine VM 1  can be implemented by a virtual machine. The memory can be implemented by the memory space VMR, the disk can be implemented by a virtual disk VDK, the network card can be implemented by a virtual network card VIF, and the processor can be implemented by a virtual processor VCPU. In one embodiment, the second testing machine VM 2  can be another virtual machine. 
     In one embodiment, the sample format module  240  receives the to-be tested file, determines a file format of the to-be tested file, and selects the first testing machine VM 1  corresponding to the file format according to the file format. 
     In step  320 , the performance monitoring module  210  monitors that whether a component usage of the first testing machine VM 1  is higher than a default threshold during a period of executing the to-be tested file. If the component usage of the first testing machine VM 1  is higher than the default threshold, the memory forensics module  220  analyzes the memory space VMR of the first testing machine VM 1 . 
     In one embodiment, the performance monitoring module  210  determines a timing corresponding to an execution stage of the malware program according to the timing when the component usage is higher than the default threshold corresponding to the component usage. The execution stage includes a vulnerability searching and using period, a program installation period, a commanding and controlling period, and a malware behavior execution period. 
     In one embodiment, the performance monitoring module  210  determines the timing that only the network card or network usage is larger than the default threshold corresponding to each the component usage, to be the at least one of the program installation period and the commanding and controlling period. 
     In one embodiment, the performance monitoring module  210  determines the timing that a memory usage, a disk usage, a network card or network usage, and a processor usage are all larger than the default threshold corresponding to each the component usage, to be the at least one of the vulnerability searching and using period and the malware behavior execution period. 
     In step  330 , when the component usage is higher than the default threshold, the memory forensics module  220  analyzes the memory space VMR of the first testing machine VM 1 . 
     In one embodiment, the memory forensics module  220  analyzes the memory space VMR by at least one of a plurality of processing analyzing operations, a dynamic link library analysis, a file operation analysis, a registry operation analysis, a network behavior analysis, a code injection analysis and a rootkit behavior analysis, to generate an analyzing result. 
     In step  340 , the analyzing module  260  determines that whether the to-be tested file includes a malware program according to the analyzing result of the memory space VMR. 
     In one embodiment, the detection system  300  monitors the first testing machine VM 1  by the second testing machine VM 2 . 
     In one embodiment, the first testing machine VM 1  and the second testing machine VM 2  are constructed on the virtual machine management device VMM. The first testing machine VM 1  and the second testing machine VM 2  access at least one physical device by an operation system HOS executing on the virtual machine management device VMM. 
     Reference is made to  FIG. 4 .  FIG. 4  depicts a flow chart of a detection method  400  according to one embodiment of the present disclosure. 
     In step  410 , the sample format module  240  receives a to-be tested file and determines a file format of the to-be tested file. The file format indicates the name of the operation system for opening or executing the to-be tested file. 
     In one embodiment, the second testing machine VM 2  can automatically transmits the to-be tested file (e.g. at least one e-mail or a program) to the sample format module  240 . The sample format module  240  can determine the to-be tested file should be operated by Windows operation system, Linux operation system or other operation system and then notify the central scheduling module  250  to select the correct testing machine to execute the to-be tested file. 
     In step  420 , the central scheduling module  250  transmits the to-be tested file to the first testing machine VM 1  corresponding to the file format. 
     For example, if Windows operation system is used for executing or opening the to-be tested file and the first testing machine VM 1  executes Windows operation system, the central scheduling module  250  transmits the to-be tested file to the first testing machine VM 1  corresponding to the file format. 
     For another example, if Linux operation system is used for executing or opening the to-be tested file and the third testing machine (not shown) executes Linux operation system, the central scheduling module  250  transmits the to-be tested file to the third testing machine corresponding to the file format. 
     In one embodiment, when the sample format module  240  receives multiple to-be tested files, the central scheduling module  250  uses for scheduling the order of these to-be tested files. 
     In step  430 , the first testing machine VM 1  uses for executing the to-be tested file. For example, the first testing machine VM 1  can execute the operations, such as executing the to-be tested file, opening an e-mail, decompressing a compressed file or connecting to a link, etc. 
     In step  440 , the performance monitoring module  210  monitors the execution steps (e.g. the execution steps P 2 -P 5  shown in  FIG. 1A ) during executing the to-be tested file. And, the performance monitoring module  210  determines that whether the component usage of the first testing machine VM 1  is higher than a default threshold during the execution steps P 2 -P 5 . If the performance monitoring module  210  determines that the component usage of the first testing machine VM 1  is higher than a default threshold during the execution steps P 2 -P 5 , the performance monitoring module  210  transmits a forensics signal to trigger the memory forensics module  220 , and the step  450  is performed. If the performance monitoring module  210  determines that the component usage of the first testing machine VM 1  is not higher than a default threshold during the execution steps P 2 -P 5 , the step  440  is performed again. 
     In one embodiment, the execution steps P 2 -P 5  includes the vulnerability searching and using period, the program installation period, the commanding and controlling period, and the malware behavior execution period. 
     The vulnerability searching and using period, for example, can be a time segment of memory overflow causing by the malware program. It will make the memory usage unusual. The program installation period, for example, can be a time segment of downloading the malware program from the internet and installing the malware program. The commanding and controlling period, for example, can be a time segment of the remote controlling by the malware program. It will make the first testing machine VM 1  receive many kinds of malware instructions from internet and cause the network flow abnormal. Besides, the malware behavior execution period indicates the time segment of executing the malware program. For example, the malware program steals the user data during the malware behavior execution period. 
     On another aspect, the execution step P 1  represents a start execution stage. The malicious behavior of to-be tested file may not totally be triggered during the execution step P 1 . And, the execution step P 6  represents the destroying evidence period. The malicious behavior causing by the to-be tested file may be destroyed (e.g. delete the log file) in the execution step P 6 . Thus, the performance monitoring module  210  does not monitor the execution steps P 1  and P 6 . 
     In one embodiment, the performance monitoring module  210  monitors that whether the component usage of the first testing machine VM 1  is higher than a default threshold value during the execution stages P 2 -P 5 . Due to the first testing machine VM 1  is implemented on the virtual machine management device VMM, the first testing machine VM 1  may use the virtual components of virtual machine management device VMM when executing the to-be tested file. For example, the virtual components of virtual machine management device VMM can be the memory space VMR, the virtual disk VDK, the virtual network card VIF, and the virtual processor VCPU. In one embodiment, the component usage includes a memory space usage, a virtual disk usage, a virtual network card usage and/or a virtual processor usage when the first testing machine VM 1  executes the to-be tested file. In other words, the performance monitoring module  210  can respectively regard these virtual component usages as the component usages and monitor these component usages. 
     Reference is made to  FIG. 5 .  FIG. 5  depicts a block diagram of a performance monitoring module  210  according to one embodiment of the present disclosure. The performance monitoring module  210  includes a memory space monitoring module  211 , a virtual disk monitoring module  213 , a virtual network card monitoring module  215  and a virtual processor monitoring module  217 . These monitoring modules are coupled to a verify module  219 , respectively. 
     In one embodiment, the memory space monitoring module  211 , the virtual disk monitoring module  213 , the virtual network card monitoring module  215 , the virtual processor monitoring module  217  and the verify module  219  can be separately or combined by using a processor to implement. 
     In one embodiment, when the component usage includes the memory space usage, the default threshold includes a memory threshold. The memory space monitoring module  211  obtains the memory space usage from the memory space VMR. The verify module  219  determines that whether the memory space usage is higher than the memory threshold. If the memory space usage is higher than the memory threshold, the performance monitoring module  210  transmits a forensics signal to the memory forensics module  220 . If the memory space usage is not higher than the memory threshold, the performance monitoring module  210  substantially monitors the memory space usage. 
     In one embodiment, when the component usage includes the virtual disk usage, the default threshold includes a disk threshold. The virtual disk monitoring module  213  obtains the virtual disk usage from the virtual disk VDK. The verify module  219  determines that whether the virtual disk usage is higher than the disk threshold. If the virtual disk usage is higher than the disk threshold, the performance monitoring module  210  transmits a forensics signal to the memory forensics module  220 . If the virtual disk usage is not higher than the disk threshold, the performance monitoring module  210  substantially monitors the virtual disk usage. 
     In one embodiment, when the component usage includes the virtual network card usage, the default threshold includes a network flow threshold. The virtual network card monitoring module  215  obtains the virtual network card usage from the virtual network card VIF. The verify module  219  determines that whether the virtual network card usage is higher than the network flow threshold. If the virtual network card usage is higher than the network flow threshold, the performance monitoring module  210  transmits a forensics signal to the memory forensics module  220 . If the virtual network card usage is not higher than the network flow threshold, the performance monitoring module  210  substantially monitors the virtual network card usage. 
     In one embodiment, when the component usage includes the virtual processor usage, the default threshold includes a processor threshold. The virtual processor monitoring module  217  obtains the virtual processor usage from the virtual processor VCPU. The verify module  219  determines that whether the virtual processor usage is higher than the processor threshold. If the virtual processor usage is higher than the processor threshold, the performance monitoring module  210  transmits a forensics signal to the memory forensics module  220 . If the virtual processor usage is not higher than the processor threshold, the performance monitoring module  210  substantially monitors the virtual processor usage. 
     In one embodiment, the performance monitoring module  210  configures the default threshold according to an average value of a history record, a standard deviation of a history record or the rule of thumb. The default threshold can comprise the memory threshold, the disk threshold, the network flow threshold and/or the processor threshold. 
     Besides, please refer to  FIG. 6  which is related to the configuration of the default threshold.  FIG. 6  depicts a schematic diagram of a method for configuring the default threshold according to one embodiment of the present disclosure. For example, the performance monitoring module  210  can accumulate the memory space usage during the last week and then calculate the average value and standard deviation of it. And, the performance monitoring module  210  can configure the memory threshold according to the average value and standard deviation. 
     In one embodiment, as shown in  FIG. 6 , the performance monitoring module  210  can configure the memory threshold T by the position which is one standard deviation higher than the average value. When the memory space usage is bigger than the memory threshold T, the performance monitoring module  210  transmits the forensics signal to the memory forensics module  220  for triggering the memory forensics module  220 . 
     In one embodiment, a user can configure the default threshold by the rule of thumb. For example, the user configures the memory threshold T as 70%. Therefore, when the memory space usage is higher than 70%, the performance monitoring module  210  transmits the forensics signal to trigger the memory forensics module  220 . 
     Besides, other default thresholds can be configured by the method above mentioned. 
     Accordingly, when the first testing VM 1  executes the to-be tested file, the second testing VM 2  can monitor that whether the first testing VM 1  is abnormal. The invention does not need to add a detection program to the first testing machine VM 1 . Also, the invention even does not modify the management mechanism in the virtual machine management device VMM. Therefore, the invention can avoid the anti-detection mechanism performing by the first testing machine VM 1  (e.g. the malware program does not operate the malicious behavior, temporally) when the malware program detects something changed in the first testing VM 1  or the virtual machine management device VMM. 
     In step  450 , the memory forensics module  220  analyzes the memory space VMR after receiving the forensics signal to generate an analyzing result. 
     In one embodiment, the memory forensics module  220  analyzes the memory space VMR by at least one of a plurality of processing analyzing operations, a dynamic link library analysis, a file operation analysis, a registry operation analysis, a network behavior analysis, a code injection analysis and a rootkit behavior analysis. 
     For instance, some malware programs may change the relations between the processes. Therefore, the memory forensics module  220  also monitors the relations between the processes in memory space VMR. For example, the memory forensics module  220  detects the relations between the hiding process and the performing process. 
     For instance, some malware programs may change the execution processes or the execution purpose of the normal program by applying code injection to inject the specific codes into the first testing machine VM 1 . As such, the memory forensics module  220  can check that whether the to-be tested file performs the code injection behavior by monitoring the memory space VMR. 
     For instance, some malware programs may upload the data stored in the memory into other remote electronic devices by internet. Therefore, the memory forensics module  220  can monitor the memory space VMR to know the network behavior of the to-be tested file, so as to determine whether the data transmission is abnormal. 
     By the detection method above mentioned, the memory forensics module  220  can generate the analyzing result according to these monitoring result. 
     In step  460 , the analyzing module  260  analyzes the analyzing result to determine that whether the to-be tested file includes a malware program. And then, the analyzing module  260  stores the analyzing result to the database (not shown). 
     For example, the analyzing module  260  determines that the to-be tested file includes a malware program according to the analyzing result when analyzing result shows that the to-be tested file performs the code injection behavior and causes the first testing machine VM 1  operates unusually (e.g. crash down) during the to-be tested file executed by the first testing machine VM 1 . And, the analyzing module  260  stores the analyzing result to the database. 
     Accordingly, the detection system and the detection method can perform the detection to the specific virtual component in multiple meaningful execution stages and avoid the careless omission of the detection during the malware program execution. Besides, the invention can dynamically analyze whether the memory is abnormal without interrupting the operation of the first testing machine. And, the invention does not need to interrupt the first testing machine and then perform memory dump process. Further, the invention monitors that whether the testing machine executed the to-be tested file (e.g. the first testing machine) is abnormal by the monitoring testing machine (e.g. the second testing machine). As such, the invention does not modify the management mechanism of the virtual machine management device. In this manner, the invention also can avoid the anti-detection mechanism performed by the malware program. 
     Although the present disclosure has been described in considerable detail with reference to certain embodiments thereof, other embodiments are possible. Therefore, the spirit and scope of the appended claims should not be limited to the description of the embodiments contained herein. 
     It will be apparent to those skilled in the art that various modifications and variations can be made to the structure of the present disclosure without departing from the scope or spirit of the disclosure. In view of the foregoing, it is intended that the present disclosure cover modifications and variations of this disclosure provided they fall within the scope of the following claims.