Source: https://patents.google.com/patent/US9106694B2/en
Timestamp: 2018-05-27 01:54:16
Document Index: 119033946

Matched Legal Cases: ['Application No. 60', 'Application No. 60', 'Application No. 60', 'art 1', 'art-1', 'Application No. 127743151']

US9106694B2 - Electronic message analysis for malware detection - Google Patents
US9106694B2
US9106694B2 US13089191 US201113089191A US9106694B2 US 9106694 B2 US9106694 B2 US 9106694B2 US 13089191 US13089191 US 13089191 US 201113089191 A US201113089191 A US 201113089191A US 9106694 B2 US9106694 B2 US 9106694B2
US13089191
US20110314546A1 (en )
This application is a continuation-in-part of U.S. patent application Ser. No. 11/717,474, filed Mar. 12, 2007, entitled “Systems and Methods for Malware Attack Prevention”, which is a continuation-in-part of U.S. patent application Ser. No. 11/494,990, filed Jul. 28, 2006, now U.S. Pat. No. 8,375,444, issued Feb. 12, 2013 entitled “Dynamic Signature Creation and Enforcement”, which is a continuation-in-part of U.S. patent application Ser. No. 11/471,072, filed Jun. 19, 2006, entitled “Virtual Machine with Dynamic Flow Analysis”, which is a continuation-in-part of U.S. patent application Ser. No. 11/409,355, filed Apr. 20, 2006, now U.S. Pat. No. 8,171,553, issued May 1, 2012 entitled “Heuristic Based Capture with Replay to Virtual Machine”, which is a continuation-in-part of U.S. patent application Ser. No. 11/096,287, filed Mar. 31, 2005, entitled “System and Method of Detecting Computer Worms”, and is a continuation-in-part of U.S. patent application Ser. No. 11/151,812, filed Jun. 13, 2005, entitled “System and Method of Containing Computer Worms,” and is a continuation-in-part of U.S. patent application Ser. No. 11/152,286, Jun. 13, 2005, now U.S. Pat. No. 8,006,305, issued Aug. 23, 2011 entitled “Computer Worm Defense System and Method”, U.S. patent application Ser. No. 11/096,287 claims the benefit of U.S. Provisional Application No. 60/559,198 filed on Apr. 1, 2004, U.S. patent application Ser. No. 11/151,812 claims the benefit of U.S. Provisional Application No. 60/579,953 filed on Jun. 14, 2004, and the U.S. patent application Ser. No. 11/152,286 claims the benefit of U.S. Provisional Application No. 60/579,910 filed on Jun. 14, 2004, all of which are incorporated by reference herein.
Additionally, malicious network content may be distributed by electronic messages, including email, using such protocols as POP, SMTP, IMAP, and various forms of web-based email. Malicious content may be directly attached to the message (for example as a document capable of exploiting a document reading application, such as a malicious Microsoft Excel document). Alternatively, electronic messages may contain URL links to malicious content hosted on web servers elsewhere on the network. When target users click on such links, they may be infected from the web in the manner described above. These techniques for infecting user computers via electronic messages are often used to make targeted attacks on particular “high-value” users at organizations, such as executives or key technical or operational staff.
FIG. 1 is a block diagram of an exemplary system for detecting malicious electronic messages.
The present technology analyzes electronic messages for malware contained in the message. Systems that analyze electronic messages typically analyze attached files for malware in synthetic environments such as a virtual environment. Unlike prior systems, the present technology may analyze the content of an electronic message to detect malware in the message content. For example, the content may include a uniform resource locator (URL) address. The URL address may be analyzed to determine if the URL address is associated with malware. Additionally, the present technology may analyze attachments in a real operating system running in an instrumented virtual environment. In addition to analyzing the content within an email itself, the present technology may process attachments for emails that provide a location associated with malware. The attachments may include one or more files compatible with common applications, including Word, Excel and Powerpoint applications by Microsoft Corporation, of Redmond, Wash., and Adobe Reader application, by Adobe Systems Inc., of San Jose, Calif.
Web malware detection 130 may communicate with management server 170 and client devices 182-186. Web malware detection 130 may operate to intercept network traffic and analyze intercepted traffic to determine whether the traffic is malware. The intercepted traffic may be copied by web malware detection 130 and analyzed using heuristics and other techniques. The heuristics may be used to identify portions of the network traffic as suspicious. Portions of traffic not identified as suspicious are ignored and passed through web malware detection 130. The suspicious network traffic portions may be analyzed by replaying the traffic in a virtual environment. The replay may be monitored and used to identify malware content by web malware detection 130. A system for re-playing intercepted traffic in a virtual environment using virtual components is described in U.S. patent application Ser. No. 12/359,252, entitled “Detecting Malicious Network Content Using Virtual Environment Components”, filed Jan. 23, 2009, the disclosure of which is incorporated herein by reference.
Virtual environment 250 receives the suspicious URL and virtual environment components and replays the URL within a virtual environment having the virtual components. Replaying the URL may be similar to performing a “click” operation on the suspicious URL. Upon performing a click on the URL, a request is sent to the URL for content, and the network server associated with the URL provides content and a response to the request. The content received in response to the request is then processed by the virtual environment and the environment is monitored to determine if any undesirable behavior occurs. If any undesirable behavior occurs in response to loading content associated with the URL, the URL is determined to be malware and added to a local black list by electronic message malware detection system 150. Undesirable behavior may unauthorized requests for data, sending or receiving data over a network, processing and/or storing data, changing a registry value, installing a file, executing a file, or other operations. The internal malware black list is transmitted to management server 170.
Suspicious URLs are analyzed using virtual environment components to detect a malicious URL at step 425. Analyzing a suspicious URL may include selecting virtual components such as a virtual operating system, virtual applications, and virtual network, populating and configuring a virtual environment with the virtual components, and processing the URL within the virtual environment. Processing the URL within the environment may include replaying the URL within the virtual environment by performing a “click” operation on the URL. The URL may be identified as malicious if content received in response to the click operation on the URL results in an undesirable behavior within the virtual environment. An undesirable behavior may include attempts to change an operating system setting or configuration, execute an executable file within the virtual environment, transmit undesirable data, or other actions. In some embodiments, an undesirable behavior may include an unexpected behavior. If no undesirable behavior occurs in response to clicking the URL, the URL is determined to be acceptable and is added to a white list.
One or more factors may affect how a URL is determined to be suspicious and/or processed to determine if it is associated with malware. In an embodiment, any URL detected in an email may be transmitted by electronic message malware detection 150 to web malware detection 130. Upon detecting that content is being requested from the URL, for example in response to a user selection or “click” on the URL, the web malware detection 130 may increase the priority of the detected URL such that the URL is analyzed to determine if is suspicious and/or associated with malware. In this embodiment, the URL may not be processed by the web malware detection 130 until it is determined that content is actually being requested from the URL.
The present system may configure a virtual environment application, operating system, and network components at step 610. These virtual components may be retrieved from a component pool by a scheduler. A URL may be analyzed in the virtual environment configured with the virtual components at step 615. Analyzing the URL may include replaying the URL by performing a “click” operation on the URL within the virtual environment. Upon performing the click operation, an application may send a content request message to the URL and receive a response message in response to the URL request. For example, a network browser may be executed to provide the content received in response to the URL response received by the application. Actions performed within the virtual environment in response to receiving the URL content may be recorded and analyzed to determine if the URL is malicious.
In some applications of this technology, it may not be desired to fetch content from every URL seen in incoming electronic messages where such “clicks” may have undesired side effects on applications using the web (HTTP) as a communication protocol. Therefore, an alternative method can be used in such cases, in which all URLs received in electronic messages are forwarded to a web malware detection system, and are used to raise the probability of examining any particular piece of web content if it has previously been seen in electronic messages (e.g., email). Thus “targeted spear phishing” attacks in which malicious URLs are sent to particular email addresses in an effort to induce the recipient to click on the link will be examined by the malware detection system only in the event that the recipient does actually so click.
Since many URLs seen in electronic messages are also accessed via the web, the present invention also includes a dynamic method for setting the “email priority boost” used to enhance the priority of inspecting web content by noting the fraction of all the efforts of the web malware detection system devoted to examining URLs previously seen by the electronic message malware detection system. This “email priority boost” can be regulated to target a particular fraction of the virtual execution environments available on the web malware detection system, to avoid overloading the latter and causing loss of other web detection functionality, while still allowing complete examination of URLS seen in electronic messages where system load allows.
receiving an electronic email message;
analyzing the electronic email message to detect a uniform resource locator (URL) address within message content of the electronic email message;
determining whether the detected URL address within the message content is suspicious;
in response to a determination that the detected URL address is suspicious, executing, with a computer processing system, the suspicious URL address detected within the message content of the electronic email message, wherein executing the suspicious URL address comprises executing, within a virtual environment, web content received in response to a request for the web content; and
identifying the suspicious URL address detected within the electronic email message content as malicious based on results of the executing of the suspicious URL address detected within the electronic email message content in the virtual environment.
comparing the detected URL address to a first list of URLs; and
identifying the detected URL address as suspicious if the detected URL address is not in the first list of URLs.
3. The method of claim 2, wherein the first list includes URLs associated with malware.
4. The method of claim 2, wherein the first list includes URLs known to not be associated with malware.
5. The method of claim 2, further comprising transmitting one or more malicious URL addresses to a remote device, the remote device configured to receive the one or more malicious URL addresses, consolidating malicious URL addresses, and transmitting an updated list of URL addresses associated with the malicious URL addresses.
receiving one or more detected URL addresses from an electronic message malware detection system at a web malware detection system; and
raising a priority associated with examining one or more of the detected URL addresses received from a network by the web malware detection system, the priority raised based on the received one or more detected URL addresses.
dynamically adjusting a priority for processing URL addresses detected within an email based on the web malware detection system load.
8. The method of claim 1, wherein the virtual environment comprises a virtual application component, one type of virtual application component comprises a virtual network browser application.
9. The method of claim 8, wherein the detected URL address is determined to be suspicious by an electronic message malware detection device, and the detected URL address determined to be suspicious is identified as malicious by a web malware detection device.
10. The method of claim 6, wherein the detected URL address determined to be suspicious is transmitted from the electronic message malware detection device to the web malware detection device.
configuring a virtual environment component within a virtual environment to provide a real application configured to process suspicious network content comprising the web content corresponding to the suspicious URL address, the virtual environment configured within a network content processing system;
12. The method of claim 11, where the suspicious network content includes a file attached to an electronic message, the virtual environment component including an application configured to process the file.
13. The method of claim 12, where the file is a Microsoft Word type document, the virtual environment component including a Microsoft Word program.
14. The method of claim 12, where the file is a Microsoft Excel type document, the virtual environment component including a Microsoft Excel program.
15. The method of claim 12, where the file is a Microsoft Powerpoint type document, the virtual environment component including a Microsoft Powerpoint program.
16. The method of claim 12, where the file is a Portable Document Format (PDF) document, the virtual environment component including an Adobe PDF Reader program.
17. The method of claim 1, further comprising monitoring changes to a virtual environment operating system by an agent, the suspicious URL address detected within the message content of the electronic email message identified as malicious based on detected improper changes to the virtual environment operating system.
18. The method of claim 1, wherein the suspicious URL address is identified as malicious when results of the executing of the suspicious URL address indicate malicious network content is embedded within data associated with a web page referenced by the suspicious URL address.
19. The method of claim 1, wherein executing the suspicious URL address further comprises:
configuring a web browser in the virtual environment; and
sending the content request to the suspicious URL address by the web browser in the virtual environment.
20. The method of claim 1, wherein the received electronic email message is a copy of an electronic email message delivered to a recipient.
21. The method of claim 1, wherein the message content is an electronic email message attachment.
22. The method of claim 1, wherein the virtual environment simulates a particular client device targeted to receive the electronic email message and comprises an operating system corresponding to an operating system of the particular client device.
23. The method of claim 1, wherein the virtual environment simulates a particular client device targeted to receive the electronic email message and comprises an application corresponding to an application that controls selecting of the URL.
24. The method of claim 1, wherein the results of the executing of the suspicious URL address comprises an occurrence of one or more undesirable behaviors during execution of the web content received in response to the request, the one or more undesirable behaviors comprises an attempt to install or execute a file.
25. The method of claim 1, wherein the results of the executing of the suspicious URL address comprises actions that occur responsive to processing of the web content within the virtual environment, the actions include at least changing a configuration of an operating system of the virtual environment.
the analyzing of the electronic email message comprises detecting a plurality of URL addresses including the URL address and assigning priority for analysis to each of the plurality of URL addresses; and
the determining whether the detected URL address within the message content is suspicious comprises determining whether a first URL address of the plurality of URL addresses is suspicious prior to determining whether a second URL of the plurality of URL addresses is suspicious when the first URL address is assigned a higher priority than the second URL address.
27. The method of claim 26, wherein the executing of the first URL address being the suspicious URL address and the identifying the suspicious URL address as malicious is conducted prior to the determining whether the second URL address within the message content is suspicious.
28. A non-transitory computer readable storage medium implemented within a computing device and having stored thereon instructions that, when executed by a processor, performs operations for detecting malicious network content, comprising:
in response to a determination that the detected URL address is suspicious, executing the suspicious URL address detected within the message content of the electronic email message, wherein executing the suspicious URL address comprises executing, within a virtual environment, web content received in response to a request for the web content; and
29. The non-transitory computer readable storage medium of claim 28, where the instructions upon execution by the processor, perform further operations comprising:
30. The non-transitory computer readable storage medium of claim 29, wherein the first list includes URLs associated with malware.
31. The non-transitory computer readable storage medium of claim 29, wherein the first list includes URLs known to not be associated with malware.
32. The non-transitory computer readable storage medium of claim 28, wherein the virtual application component is a virtual network browser application.
33. The non-transitory computer readable storage medium of claim 28, wherein the detected URL address is determined to be suspicious by an electronic message malware detection device, and the detected URL address determined to be suspicious is identified as malicious by a web malware detection device.
34. The non-transitory computer readable storage medium of claim 28, wherein the virtual environment simulates a particular client device targeted to receive the electronic email message and comprises an operating system corresponding to an operating system of the particular client device.
35. The non-transitory computer readable storage medium of claim 28, wherein the results of the executing of the suspicious URL address comprises an occurrence of one or more undesirable behaviors during execution of the web content received in response to the request.
36. The non-transitory computer readable storage medium of claim 35, wherein the one or more undesirable behaviors include an attempt to transmit data from the computing device.
37. The non-transitory computer readable storage medium of claim 28, wherein the instructions, when executed by a processor, perform operations comprising:
the determining whether the detected URL address being the first URL address is suspicious and the identifying that the first URL address is malicious occurs prior to determining whether a second URL of the plurality of URL addresses is suspicious, when the first URL address is assigned a higher priority than the second URL address.
38. A system for detecting malicious network content, comprising:
a processor coupled with the memory and configured to receive an electronic email message;
an electronic message malware detector comprising the processor and configured to
analyze the electronic email message to detect a uniform resource locator (URL) address within message content of the electronic email message, and
determine whether the detected URL address within the message content is suspicious;
a web malware detector coupled with the electronic message malware detector and configured to
in response to a determination that the detected URL address is suspicious, execute the suspicious URL address detected within the message content of the electronic email message, wherein executing the suspicious URL address comprises executing, within a virtual environment, web content received in response to a request for the web content, and
39. The system of claim 38, wherein the processor is further configured to execute the electronic malware detection logic to compare the detected URL address to a first list of URLs, and identify the detected URL address as suspicious if the detected URL address is not in the first list of URLs.
40. The system of claim 39, wherein the first list includes URLs associated with malware.
41. The system of claim 39, wherein the first list includes URLs known to not be associated with malware.
42. The system of claim 39, further comprising a computing device including the electronic message malware detector and the web malware detector.
43. The system of claim 38, wherein the virtual application component is a virtual network browser application.
wherein the web malware detector comprises a virtual environment component within the virtual environment that provides a real application configured to process suspicious network content comprising the web content corresponding to the suspicious URL address, the virtual environment configured within a network content processing system; and
wherein the web malware detector is further configured to process the suspicious network content using the virtual environment component within the virtual environment, and to identify the suspicious network content as malicious network content based on a behavior of the virtual environment component.
45. The system of claim 44, wherein the web malware detector further comprises monitoring changes to the virtual environment by an agent, the suspicious URL address detected within the message content of the electronic email message identified as malicious based on detected improper changes to the virtual environment.
46. The system of claim 38, wherein the web malware detector to execute the web content within the virtual environment that simulates a particular client device targeted to receive the electronic email message and comprises an operating system corresponding to an operating system of the particular client device.
47. The system of claim 38, wherein the results of the executing of the suspicious URL address by the web malware detector comprises an occurrence of one or more undesirable behaviors during execution of the web content received in response to the request, the one or more undesirable behaviors comprises an attempt to install or execute a file.
48. The system of claim 38, wherein the results of the executing of the suspicious URL address by the web malware detector comprises an occurrence of one or more undesirable behaviors during execution of the web content received in response to the request, the one or more undesirable behaviors comprises changing of a registry value.
49. The system of claim 38, wherein the results of the executing of the suspicious URL address by the web malware detector that includes execution of the web content comprises actions that occur responsive to processing of the web content within the virtual environment, the actions include at least changing a configuration of an operating system of the virtual environment.
the analyzing of the electronic email message by the electronic message malware detector comprises detecting a plurality of URL addresses including the detected URL address and assigning priority for analysis to each of the plurality of URL addresses; and
the determining whether the detected URL address is suspicious by the electronic message malware detector comprises determining whether a first URL address of the plurality of URL addresses is suspicious prior to determining whether a second URL of the plurality of URL addresses is suspicious when the first URL address is assigned a higher priority than the second URL address.
51. The system of claim 50, wherein the executing of the first URL address being the suspicious URL address and the identifying the suspicious URL address as malicious by the web malware detector is conducted prior to the determining whether the second URL address within the message content is suspicious by the electronic message malware detector.
US13089191 2004-04-01 2011-04-18 Electronic message analysis for malware detection Active 2025-11-10 US9106694B2 (en)
EP20120774315 EP2700009A4 (en) 2011-04-18 2012-02-23 Electronic message analysis for malware detection
JP2014506405A JP6013455B2 (en) 2011-04-18 2012-02-23 Electronic message analysis for malware detection
EP20170206478 EP3319005A1 (en) 2011-04-18 2012-02-23 Electronic message analysis for malware detection
US11717474 Continuation-In-Part US8898788B1 (en) 2004-04-01 2007-03-12 Systems and methods for malware attack prevention
US14745903 Continuation US20160127393A1 (en) 2004-04-01 2015-06-22 Electronic Message Analysis For Malware Detection
US20110314546A1 true US20110314546A1 (en) 2011-12-22
US9106694B2 true US9106694B2 (en) 2015-08-11
US13089191 Active 2025-11-10 US9106694B2 (en) 2004-04-01 2011-04-18 Electronic message analysis for malware detection
US14745903 Granted US20160127393A1 (en) 2004-04-01 2015-06-22 Electronic Message Analysis For Malware Detection
"Network Security: NetDetector-Network Intrusion Forensic System (NIFS) Whitepaper", ("NetDetector Whitepaper"), 2003.
"When Virtual is Better Than Real", IEEEXplore Digital Library, available at, http://ieeexplore.ieee.org/xpl/articleDetails.jsp?reload=true&arnumber=990073, 2001.
Adetoye, Adedayo , et al., "Network Intrusion Detection & Response System", ("Adetoye"),(Sep. 2003).
AltaVista Advanced Search Results. "Event Orchestrator". Http://www.altavista.com/web/results?Itag=ody&pg=aq&aqmode=aqa=Eventi+Orchestrator . . . Accessed on Sep. 3, 2009.
Anonymous, "Inside Adobe Reader Protected Mode-Part 1-Design", Oct. 5, 2010, XP055116424, Retrieved from Internet: URL:http//blogs.adobe.com/security/2010/10/inside-adobe-reader-protected-mode-part-1-design.html [retrieved on May 6, 2014].
Apostolopoulos, George; Hassapis, Constantinos; :"V-eM: A Cluster of Virtual Machines for Robust, Detailed, and High-Performance Network Emulation", 14th IEEE International Symposium on Modeling, Analysism and Simulation of Computer and Telecommunication Systems, Sep. 11-14, 2006, pp. 117-126.
Baldi, Mario; Risso, Fulvio; "A Framework for Rapid Development and Portable Execution of Packet-Handling Applications", 5th IEEE International on Signal Processing and Information Technology, Dec. 21, 2005, pp. 233-238.
Cisco, Configuring the Catalyst Switched Port Analyzer (SPAN) ("Cisco"), 2003.
Didier Stevens, "Malicious PDF Documents Explained", Security & Privacy, IEEE, IEEE Service Center, Los Alamitos, CA, US, vol. 9, No. 1, Jan. 1, 2011, pp. 80-82, XP011329453, ISSN: 1540-7993, DOI: 10.1109/MSP.2011.14.
Excerpt regarding First Printing Date for Merike Kaeo, Designing Network Security ("Kaeo"), 2004.
Extended European Search Report mailed Oct. 30, 2014, Application No. 127743151-1862/2700009, PCT/US2012026402.
Goel et al., Reconstructing System State for Intrusion Analysis, Apr. 2008 SIGOPS Operating Systems Review, vol. 42, Issue 3, pp. 21-28.
IEEE Xplore Digital Library Search Results for "detection of unknown computer worms". Http://ieeexplore.ieee.org/searchresult.jsp?SortField=Score&SortOrder=desc&ResultC . . . Accessed on Aug. 28, 2009.
King, Samuel T., et al., "Operating System Support for Virtual Machines", ("King"), 2003.
Moore, D. et al., "Internet Quarantine: Requirements for Containing Self-Propagating Code", INFOCOM, Mar.30-Apr. 3, 2003, vol. 3, pp. 1901-1910.
Peter M. Chen, and Brian D. Noble , "When Virtual Is Better Than Real, Department of Electrical Engineering and Computer Science", University of Michigan ("Chen"), 2001.
Rautiainen et al., "A look at Portable Document Format Vulnerabilities", Information Security Technical Report, Elsevier Advanced Technology, Amsterdam, NL, vol. 14, No. 1, Feb. 1, 2009, pp. 30-33, XP026144094, ISSN: 1363-4127, DOI: 10.1016/J.ISTR.2009.04.001.
The Sniffers's Guide to Raw Traffic available at: yuba.stanford.edu/~casado/pcap/section1.html.
The Sniffers's Guide to Raw Traffic available at: yuba.stanford.edu/˜casado/pcap/section1.html.
Thomas H. Ptacek, and Timothy N. Newsham "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection", Secure Networks, ("Ptacek"), (Jan. 1998).
United States Patent and Trademark Office, Before the Patent Trial and Appeal Board, Finjan, Inc., Petitioner v. FireEye, Inc., Patent Owner., Case IPR2014-00344, Patent 8,291,499 B2, Before Bryan F. Moore, Lynne E. Pettigrew, and Francis L. Ippolito, Administrative Patent Judges., Ippolito, Administrative Patent Judge., Decision, Institution of Inter Partes Review, 37 C.F.R. 42.108, Entered: Jul. 21, 2014, 36 pages.
US20160127393A1 (en) 2016-05-05 application
EP2700009A1 (en) 2014-02-26 application
WO2012145066A1 (en) 2012-10-26 application
EP3319005A1 (en) 2018-05-09 application
US20110314546A1 (en) 2011-12-22 application
EP2700009A4 (en) 2014-12-03 application
JP2014513834A (en) 2014-06-05 application
JP6013455B2 (en) 2016-10-25 grant
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:AZIZ, ASHAR;UYENO, HENRY;MANNI, JAY;AND OTHERS;SIGNING DATES FROM 20110823 TO 20110831;REEL/FRAME:026853/0896