Patent Description:
The present disclosure relates to information security, and more specifically, to systems and methods for modifying a malicious code detection rule.

Rapid development of computer technologies in the last decade and the widespread use of computer systems (personal computers, notebooks, tablets, smartphones, etc.) has resulted in such devices being used in various areas of activity and used to perform a large number of tasks (from Internet surfing to bank transfers and electronic document/record keeping). Similarly, with the growth of the amount of computer systems and software, the number of malicious programs is growing rapidly as well.

Currently, there are a very large number of types of malicious programs. Some malicious programs steal personal and confidential data from user devices (e.g. logins and passwords, banking information, electronic documents). Others build so-called botnets from user devices, which they then use to attack an outside computer system with the purpose of achieving a DDoS (Distributed Denial of Service) or to force passwords using the "brute force" method. Still others offer users paid content through intrusive advertising, texting to toll numbers, etc..

In order to detect applications containing malicious code, various technologies and methods are used, such as: statistical analysis, behavior analysis, analysis and comparison of databases of trusted applications and of applications containing malicious code, etc. Each technology involves the use of signatures or sets of conditions in order to detect the presence of malicious code. The above-mentioned technologies or methods have their advantages and disadvantages, which influence the occurrence of first and second type errors during detection of malicious applications (the so-called "detection rate") and the use of computing resources for detecting malicious applications (the so-called "performance"). In turn, malicious applications evolve based on the detection tools and become harder to detect.

Existing solutions are intended to analyze the efficiency of detection of malicious code using a technology; namely, a check of the correct functioning of the signatures used in the technology. For example, <CIT> describes a system detecting incorrectly functioning signatures, using hidden signatures. Rules based on signature triggering statistics allow the signature functioning quality to be determined. If a signature works correctly, it is moved to the active state; otherwise, its use is canceled. Although such systems are partially successful in detecting an incorrectly working signature, they do not involve an analysis of the error caused by the use of the signature, or consider the possibility of a modification of the signature, which can affect the efficiency of detecting malicious code when using the above-mentioned signature.

Document <CIT> refers to a system and a method for optimization of execution of anti-malware (AV) applications. A number of false-positive determinations by an AV system are reduced by correcting malware detection rules using correction coefficients. A number of malware objects detected by the AV system are increased by correction of ratings determined by the rules using correction coefficients. An automated testing of new detection rules used by the AV system is provided. The new rules having zero correction coefficients are added to the rules database and results of application of the new rules are analyzed and the rules are corrected or modified for further testing.

Document <CIT> describes a system and a method for correcting antivirus records. In the method, during analysis of a software object for malware, an antivirus application retrieves from an antivirus database an antivirus record associated with the analyzed object, which identifies the object as malicious or clean. The application also checks if there is a correction for the antivirus record in an antivirus cache and use the correction for analysis of the software object. If no correction is found in the cache, the application checks correctness of the antivirus record with an antivirus server. The antivirus server uses statistical information about software objects collected from antivirus applications deployed on different computers to validate correctness of antivirus records. If the antivirus server provides a correction for the antivirus record, the application uses the provided correction for analysis of the software object for malware.

The present disclosure solves such problems.

Embodiments described herein substantially meet the aforementioned needs of the industry. In particular, embodiments overcome the existing drawbacks of the known approaches to rule-based malicious code detection.

Systems and methods for managing rules of detection of malicious code described herein include modifying a rule for the detection of malicious code. The technical result of the present disclosure ensures information security by maintaining malicious code detection rules in their current state, through detection of an error during the use of a malicious code detection rule and modification thereof.

The present invention is directed to subject-matter as disclosed by the appended claims.

Subject matter hereof may be more completely understood in consideration of the following detailed description of various embodiments in connection with the accompanying figures, in which:.

During an analysis to determine the presence of malicious code, an anti-virus program can utilize malicious code detection rules. In general, a heuristic analyzer in an anti-virus program can utilize or include a certain set of rules. Such an analyzer uses rules in order to make a decision on the basis of the data received during the analysis as to whether the application being analyzed contains malicious code.

In an embodiment, a malicious code detection rule is a set of conditions. When the set of conditions is met, the object being analyzed is considered to contain malicious code. Depending on the object of the analysis, different types of conditions are selected to be used as the basis for building the rules. For example, malicious code in objects such as files can be detected using heuristics built on the basis of an analysis of a known file containing malicious code.

Conditions and attributes typical for files can be used as rule conditions. Example conditions and/or attributes can include: parts of the file in the form of file signature; unique strings contained in the command file; file type; file size; file structure. In addition, malicious code in files can be detected using a behavior signature. In the case of a behavior signature, example conditions and/or attributes can include the application's actions in relation to other programs, the application's actions in relation to the computer system's hardware, and the application's actions in relation to the operating system.

A message sent by email can also be the object of an analysis. In the case of an email, rules can include spam heuristics. In an embodiment, parameters and attributes typical for a message sent by email are used as the conditions; for example: message subject text; header of the message body text; language of the message text, etc..

Various malicious code detection rules can be used for the analysis of a single object. In using the rule, the probability of the presence of malicious code in the object being analyzed is determined. When the threshold probability value is exceeded, the object can be classified as containing malicious code. If the threshold probability value is not exceeded, the object can be classified as not containing malicious code. In either case, there is a probability of an error occurring. An error of first type or a false positive is considered to be a situation where an object which is actually not malicious is classified by the rule as an object containing malicious code. An error of second type is considered to be a situation where an object which is actually a malicious application is classified by the rule as an object not containing malicious code. Embodiments therefore detect the aforementioned first and second types of errors. Further, data related to the errors can be used to correct the relevant malicious code detection rules. Accordingly, embodiments of systems and methods for modifying a malicious code detection rule are described herein.

Referring to <FIG>, a block diagram of a system <NUM> for modifying a malicious code detection rule is depicted, according to an embodiment. The system of <FIG> generally includes an anti-virus program <NUM>, a gathering tool <NUM>, a detection tool <NUM>, a modification tool <NUM>, a rules database <NUM>, and a heuristic rules database <NUM>.

Some of the subsystems of system <NUM> include various engines or tools, each of which is constructed, programmed, configured, or otherwise adapted, to autonomously carry out a function or set of functions. The term engine as used herein is defined as a real-world device, component, or arrangement of components implemented using hardware, such as by an application specific integrated circuit (ASIC) or field-programmable gate array (FPGA), for example, or as a combination of hardware and software, such as by a microprocessor system and a set of program instructions that adapt the engine to implement the particular functionality, which (while being executed) transform the microprocessor system into a special-purpose device. An engine can also be implemented as a combination of the two, with certain functions facilitated by hardware alone, and other functions facilitated by a combination of hardware and software. In certain implementations, at least a portion, and in some cases, all, of an engine can be executed on the processor(s) of one or more computing platforms that are made up of hardware (e.g., one or more processors, data storage devices such as memory or drive storage, input/output facilities such as network interface devices, video devices, keyboard, mouse or touchscreen devices, etc.) that execute an operating system, system programs, and application programs, while also implementing the engine using multitasking, multithreading, distributed (e.g., cluster, peer-peer, cloud, etc.) processing where appropriate, or other such techniques. Accordingly, each engine can be realized in a variety of physically realizable configurations, and should generally not be limited to any particular implementation exemplified herein, unless such limitations are expressly called out. In addition, an engine can itself be composed of more than one sub-engines, each of which can be regarded as an engine in its own right. Moreover, in the embodiments described herein, each of the various engines corresponds to a defined autonomous functionality; however, it should be understood that in other contemplated embodiments, each functionality can be distributed to more than one engine. Likewise, in other contemplated embodiments, multiple defined functionalities may be implemented by a single engine that performs those multiple functions, possibly alongside other functions, or distributed differently among a set of engines than specifically illustrated in the examples herein.

In an embodiment, anti-virus program <NUM> is configured to perform various searching and detecting of malicious code on user computer systems. For example, anti-virus program <NUM> is configured to apply malicious code detection rules from the heuristic rules database <NUM>.

Gathering tool <NUM> configured to gather data related to the use of a malicious code detection rule from heuristic rules database <NUM>. For example, gathering tool <NUM> is configured to perform gathering of data on the use of the malicious code detection rule during the time when anti-virus program <NUM> is conducting an analysis of objects using a malicious code detection rule from heuristic rules database <NUM>. In certain embodiments, gathering tool <NUM> can gather the data as it exists on other components of system <NUM>, or gathering tool <NUM> can itself make determinations related to the data.

In other embodiments, gathering tool <NUM> is configured to gather data prior to use of the malicious code detection rule. Gathering tool <NUM> is further configured to gather data after use of the malicious code detection rule. In embodiments, gathering tool <NUM> is further configured to compare data gathered before and after the malicious code detection rule is used.

In an embodiment, gathering tool <NUM> can determine and/or gather the time of the use of the malicious code detection rule.

In an embodiment, gathering tool <NUM> can determine and/or gather the date the malicious code detection rule was created.

In an embodiment, gathering tool <NUM> can determine and/or gather the result of the functioning of the malicious code detection rule, such as a decision to consider the object of the analysis as containing or not containing malicious code after the use of the malicious code detection rule.

In an embodiment, gathering tool <NUM> can determine and/or gather data related to the object of the analysis. For example, if the object is a file, the following data can be obtained: name, size, extension, checksum of a code area, and/or checksum of a section, etc..

In an embodiment, gathering tool <NUM> can determine and/or gather the settings of anti-virus program <NUM> which used the malicious code detection rule. For example, such settings can include emulation depth, time and date of the latest update of the anti-virus databases, frequency of updates of the anti-virus databases, and/or the set of files to be checked, etc..

In an embodiment, gathering tool <NUM> can determine and/or gather data related to the computer system's software, including the setting(s) for which anti-virus program <NUM> (which used the malicious code detection rule) is active. For example, such settings can include a list of installed programs, program name, data related to the program's developer, program version, and/or the time the program has been used, etc..

In an embodiment, gathering tool <NUM> can determine and/or gather data related to the computer system's hardware, including the setting(s) for which anti-virus program <NUM> (which used the malicious code detection rule) is active. For example, such settings can include a list of installed hardware, a processor model, a motherboard model, and/or a network card model, etc..

In an embodiment, gathering tool <NUM> can determine and/or gather data related to the security policy applied in the computer system where anti-virus program <NUM> (which used the malicious code detection rule) is active. For example, such data can include a list of users and their roles, software use authorizations, and/or hardware use authorizations, etc..

In an embodiment, gathering tool <NUM> can determine and/or gather data related to a response to the result of the use of the rule; for example, what the user does to the object of the analysis after malicious code detection rules are used.

In embodiments, gathering tool <NUM> is further configured to transfer data related to the use of the malicious code detection rule to detection tool <NUM>.

Detection tool <NUM> is configured to detect whether an error is present when a malicious code detection rule is used, using error determination rules. In an embodiment, the detection of an error is done using error detection rules from rules database <NUM>. In an embodiment, an error detection rule is a set of conditions. When the set of conditions is met, detection tool <NUM> determines an error presence ratio after a malicious code detection rule is used. A threshold value can be utilized when analyzing the error presence ratio. For example, when the threshold value is exceeded, an error is detected. In certain embodiments, the error presence ratio can be determined empirically or statistically, and can vary in accordance with detection of new objects of analysis containing malicious code.

The following set of conditions is an example of an error determination rule:
{result of the use of a malicious code detection rule - the object of the analysis contains malicious code; cancellation, by <NUM> different users, of the result of the malicious code detection rule use during analysis of the same object; security policy; the hardware and software of the computer systems on which the rule was canceled coincide for <NUM> percent; the time period the rule was used is <NUM> days}.

When these conditions are met, a first type error presence ratio is considered equal to <NUM>. In the case where the ratio's threshold value is a value of <NUM>, it is considered that a first type error has been detected.

The following set of conditions are another example of an error determination rule:
{result of the use of a malicious code detection rule - the object of the analysis contains malicious code; during the use of the rule, the list of hardware decreased by one device; the object of the analysis was detected on <NUM> computer systems whose lists of hardware and software coincide for <NUM> percent; the list of hardware of the devices similarly decreased by one device, as mentioned earlier}.

The following set of conditions are another example of an error determination rule:
{result of the use of a malicious code detection rule - the object of the analysis does not contain malicious code; the object of the analysis is <NUM> percent similar to a previously known object of analysis containing malicious code; the date the malicious code detection rule was created exceeds <NUM> days; the settings of the anti-virus program that used the malicious code detection rule coincide for <NUM> percent}.

When these conditions are met, a second type error presence ratio is considered equal to <NUM>. In the case where the ratio's threshold value is a value of <NUM>, it is considered that a second type error has been detected.

The following set of conditions are another example of an error determination rule:
{result of the use of a malicious code detection rule - the object of the analysis does not contain malicious code; the result of the use of a malicious code detection rule is confirmed on <NUM> computer systems; the object of analysis is removed from the archive of the objects containing malicious code}.

Example <NUM> includes a first type error determination rule for analysis of a file by a behavior signature. The following are the conditions:.

When these conditions are met, the first type error presence ratio is considered equal to Y, where Y = f(a, b). In this case, the second error presence ratio equals <NUM>. In the case where the ratio's threshold value is determined as <NUM>, it is considered that a second type error was detected.

Example <NUM> includes a first type error determination rule for analysis of a file by a behavior signature. The following conditions are used:.

When these conditions are met, the first type error presence ratio is considered equal to Y, where Y = f(a, c). In this case, the second error presence ratio equals <NUM>. In the case where the ratio's threshold value is determined as <NUM>, it is considered that a first type error was detected.

Example <NUM> includes a second type error determination rule for analysis of a file by behavior heuristics. The following conditions are used:.

When these conditions are met, the second type error presence ratio is considered equal to Y, where Y = f(p, q, r, s). In this case, the first type error presence ratio equals <NUM>. In the case where the ratio's threshold value is determined as <NUM>, it is considered that a second type error has been detected.

If one of the conditions is not met, the error presence ratio decreases depending on the condition's influence on the error determination. If one of the conditions has a high influence on the error determination additionally, the error presence ratio increases. The condition's influence ratio can be calculated empirically, statistically, or using machine learning.

In embodiments, detection tool <NUM> is configured to transfer data related to the detected error during the use of a malicious code detection rule to modification tool <NUM>.

Modification tool <NUM> is configured to make one or more changes to the malicious code detection rule during detection of an error when a malicious code detection rule is used.

For example, when a first type error is detected, the used malicious code detection rule is modified. In an embodiment, depending on the object of analysis, a change is made to the list of conditions of which the rule is composed; namely, their number is increased. For example, rule <NUM> contains <NUM> conditions. After rule <NUM> is used and an error of a first type is detected, rule <NUM> is changed by adding at least one additional condition. As a result, the modified rule <NUM> now contains <NUM> conditions, which will decrease the probability of occurrence of an error of first type.

In another embodiment, depending on the object of analysis, a change is made to the value of at least one of the conditions of which the rule is composed; namely, its value is reduced or decreased. For example, rule <NUM> contains <NUM> conditions; one condition had a value range of <NUM>-<NUM> units. After the rule is used and an error of a first type is detected, the rule is changed by reducing the condition's value range to <NUM> units. As a result, the modified rule <NUM> contains <NUM> conditions; one condition already has a value of <NUM>, which will decrease the probability of occurrence of an error of first type.

When an error of second type is detected, the used malicious code detection rule can be modified. In an embodiment, depending on the object of analysis, a change is made to the list of conditions of which the rule is composed; namely, their number is decreased. For example, rule <NUM> contained <NUM> conditions. After the rule is used and an error of a second type is detected, rule <NUM> is changed by removing at least one additional condition of high importance. As a result, the modified rule <NUM> now contains <NUM> conditions, which will decrease the probability of occurrence of an error of second type.

In another embodiment, depending on the object of analysis, a change is made to the value of at least one of the conditions of which the rule is composed; namely, its value is increased or added. For example, rule <NUM> contained <NUM> conditions; one condition had a value range of <NUM>-<NUM> units. After rule <NUM> is used and an error of second type is detected, the rule is changed by increasing the condition's value to <NUM> units. As a result, the modified rule <NUM> contains <NUM> conditions; one condition already has a value of <NUM>, which will decrease the probability of occurrence of an error of second type.

Rules database <NUM> is configured to store error determination rules. Heuristic rules database <NUM> is configured to store malicious code detection rules. Various types of databases can be used for storage and processing of data, namely: hierarchical ones (IMS, TDMS, System <NUM>), network-based ones (Cerebrum, Cronospro, DBVist), relational ones (DB2, Informix, Microsoft SQL Server), object-oriented ones (Jasmine, Versant, POET), object-relational ones (Oracle Database, PostgreSQL, FirstSQL/J), function-based ones, etc. Rules can be created using machine learning algorithms and automated processing of large data arrays.

Referring to <FIG>, a flowchart of a method <NUM> for modifying a malicious code detection rule is depicted, according to an embodiment. Embodiments of the method can be implemented with respect to the systems of <FIG> and <FIG>. For example, reference is made with respect to the system of <FIG> in describing the method of <FIG>.

At <NUM>, gathering tool <NUM> gathers data on the use of a malicious code detection rule from heuristic rules database <NUM> and sends the gathered data to detection tool <NUM>.

At <NUM> and <NUM>, detection tool <NUM> checks whether any errors occurred during the use of a malicious code detection rule, using error detection rules from rules database <NUM>. Then, detection tool <NUM> sends the data related to the detected error to modification tool <NUM>.

If an error is detected in the operation of a malicious code detection rule at <NUM>, modification tool <NUM> makes changes to the used malicious code detection rule. If there are no errors at <NUM>, the system ends its operation.

Referring to <FIG>, a diagram illustrating in greater detail a computer system <NUM> on which aspects of the disclosure as described herein may be implemented according to various embodiments is depicted.

The computer system <NUM> can comprise a computing device such as a personal computer <NUM> includes one or more processing units <NUM>, a system memory <NUM> and a system bus <NUM>, which contains various system components, including a memory connected with the one or more processing units <NUM>. In various embodiments, processing units <NUM> can include multiple logical cores that are able to process information stored on computer readable media. The system bus <NUM> is realized as any bus structure known at the relevant technical level, containing, in turn, a bus memory or a bus memory controller, a peripheral bus and a local bus, which is able to interact with any other bus architecture. The system memory can include non-volatile memory such as Read-Only Memory (ROM) <NUM> or volatile memory such as Random Access Memory (RAM) <NUM>. The Basic Input/Output System (BIOS) <NUM> contains basic procedures ensuring transfer of information between the elements of personal computer <NUM>, for example, during the operating system boot using ROM <NUM>.

Personal computer <NUM>, in turn, has a hard drive <NUM> for data reading and writing, a magnetic disk drive <NUM> for reading and writing on removable magnetic disks <NUM>, and an optical drive <NUM> for reading and writing on removable optical disks <NUM>, such as CD-ROM, DVD-ROM and other optical media. The hard drive <NUM>, the magnetic drive <NUM>, and the optical drive <NUM> are connected with system bus <NUM> through a hard drive interface <NUM>, a magnetic drive interface <NUM> and an optical drive interface <NUM>, respectively. The drives and the corresponding computer information media represent energy-independent means for storage of computer instructions, data structures, program modules and other data on personal computer <NUM>.

The system depicted includes hard drive <NUM>, a removable magnetic drive <NUM> and a removable optical drive <NUM>, but it should be understood that it is possible to use other types of computer media, capable of storing data in a computer-readable form (solid state drives, flash memory cards, digital disks, random-access memory (RAM), etc.), connected to system bus <NUM> through a controller <NUM>.

The computer <NUM> comprises a file system <NUM>, where the recorded operating system <NUM> is stored, as well as additional program applications <NUM>, other program engines <NUM> and program data <NUM>. The user can input commands and information into the personal computer <NUM> using input devices (keyboard <NUM>, mouse <NUM>). Other input devices (not shown) can also be used, such as: a microphone, a joystick, a game console, a scanner, etc. Such input devices are usually connected to the computer system <NUM> through a serial port <NUM>, which, in turn, is connected to a system bus, but they can also be connected in a different way - for example, using a parallel port, a game port or a Universal Serial Bus (USB). The monitor <NUM> or another type of display device is also connected to system bus <NUM> through an interface, such as a video adapter <NUM>. In addition to monitor <NUM>, personal computer <NUM> can be equipped with other peripheral output devices (not shown), such as speakers, a printer, etc..

Personal computer <NUM> is able to work in a network environment; in this case, it uses a network connection with one or several other remote computers <NUM>. Remote computer(s) <NUM> is (are) similar personal computers or servers, which have most or all of the above elements, noted earlier when describing the substance of personal computer <NUM> shown in <FIG>. The computing network can also have other devices, such as routers, network stations, peering devices or other network nodes.

Network connections can constitute a Local Area Network (LAN) <NUM> and a World Area Network (WAN). Such networks are used in corporate computer networks or in corporate intranets, and usually have access to the Internet. In LAN or WAN networks, personal computer <NUM> is connected to the Local Area Network <NUM> through a network adapter or a network interface <NUM>. When using networks, personal computer <NUM> can use a modem <NUM> or other means for connection to a world area network, such as the Internet. Modem <NUM>, which is an internal or an external device, is connected to system bus <NUM> through serial port <NUM>. It should be clarified that these network connections are only examples and do not necessarily reflect an exact network configuration, i.e. in reality there are other means of establishing a connection using technical means of communication between computers.

Various embodiments of systems, devices, and methods have been described herein. These embodiments are given only by way of example and are not intended to limit the scope of the claimed inventions. It should be appreciated, moreover, that the various features of the embodiments that have been described may be combined in various ways to produce numerous additional embodiments. Moreover, while various materials, dimensions, shapes, configurations and locations, etc. have been described for use with disclosed embodiments, others besides those disclosed may be utilized without exceeding the scope of the claimed inventions.

Persons of ordinary skill in the relevant arts will recognize that the subject matter hereof may comprise fewer features than illustrated in any individual embodiment described above. The embodiments described herein are not meant to be an exhaustive presentation of the ways in which the various features of the subject matter hereof may be combined. Accordingly, the embodiments are not mutually exclusive combinations of features; rather, the various embodiments can comprise a combination of different individual features selected from different individual embodiments, as understood by persons of ordinary skill in the art. Moreover, elements described with respect to one embodiment can be implemented in other embodiments even when not described in such embodiments unless otherwise noted.

Claim 1:
A system (<NUM>) for modifying a malicious code detection rule, the system comprising:
a rules database (<NUM>) configured to store a plurality of error detection rules, wherein each of the plurality of error detection rules includes a set of error conditions to detect an error;
a heuristic rules database (<NUM>) configured to store a plurality of malicious code detection rules, wherein each of the plurality of malicious code detection rules includes a set of detection conditions to detect malicious code;
computing hardware of at least one processor (<NUM>) and a memory (<NUM>) operably coupled to the at least one processor (<NUM>); and
instructions that, when executing on the computing hardware, cause the computing hardware to implement:
an anti-virus tool (<NUM>) configured to detect malicious code for an object under analysis based on at least one of the plurality of malicious code detection rules,
a gathering tool (<NUM>) configured to gather use data about the at least one of the plurality of malicious code detection rules, the use data including information about a security policy of the computing hardware,
a detection tool (<NUM>) configured to determine whether an error is present based on at least one of the plurality of error detection rules by:
calculating an error presence ratio as a function of satisfaction of the set of error conditions; and
comparing the error presence ratio against a threshold value, wherein, when the error presence ratio meets the threshold value, an error is detected, and
a modification tool (<NUM>) configured to change the at least one of the plurality of malicious code detection rules, wherein the modification tool (<NUM>) is configured to change the at least one of the plurality of malicious code detection rules by increasing or decreasing a number of conditions in the set of detection conditions for the at least one of the plurality of malicious code detection rules.