Patent ID: 12189771

DETAILED DESCRIPTION

The following detailed description is provided to enable anyone skilled in the art to implement and use the non-limiting embodiments of the present technology. Specific details are provided merely for descriptive purposes and to give insights into the present technology, and in no way as a limitation. However, it would be apparent to a person skilled in the art that some of these specific details may not be necessary to implement certain non-limiting embodiments of the present technology. The descriptions of specific implementations are only provided as representative examples. Various modifications of these embodiments may become apparent to the person skilled in the art; the general principles defined in this document may be applied to other non-limiting embodiments and implementations without departing from the scope of the present technology.

System

With reference toFIG.1, there is provided a schematic diagram of a system10configurable for detecting malicious activity by analyzing behavior of objects in a non-isolated environment, in accordance with certain non-limiting embodiments of the present technology. The system10comprises:a detection module (S10) installed in a given host of a plurality of hosts of the non-isolated environment, which, according to certain non-limiting embodiments of the present technology, can be configured to collect information about at least one event flow of events occurred at the given host and to transmit the at least one event flow to a computing device (S20) for analyzing;the computing device (S20) configured to implement a method, such as a method100, for detecting, based on the received event flow, malicious activity by analysis of object behavior in the non-isolated environment, described below with reference toFIG.2; anda reporting module (S30).

According to certain non-limiting embodiments of the present technology, the computing device S20can comprise a computing environment300described below with reference toFIG.3. To that end, the computing device S20can include a processor301.

It should be understood that the system10described herein is completely scalable, that is, it can operate as in local as in global network.

Method

With reference toFIG.2, there is depicted a method100for detecting malicious activity by analyzing behavior of objects in a non-isolated environment, in accordance with certain non-limiting embodiments of the present technology. The method100can be executed, for example, by the processor301of the computing device S20.

It should be noted that, according to certain non-limiting embodiments of the present technology, the processor301can be coupled to data collection software, for example, security event detection modules or security event monitors, such as those of the detection module S10, which are installed at the given host of the plurality of hosts and are configured for maintaining logs and recording suspicious events in the network.

It should be noted that, in the context of the present specification, the given host denotes a network node. Thus, the given host can comprise a physical devices—such as computers, servers, laptops, smartphones, tablets, game consoles, TV sets, printers, network hubs, switches, routers, unspecified devices combined by IoT (Internet of Things), etc., or hardware-software solutions enabling to implement functionality of several network nodes at a single physical device.

Step110: Receiving, by the Processor, From a Given Host of the Plurality of Hosts, an Event Flow Including Data Representative of Events Occurred at the Given Host

The method100commences at step110with the processor301being configured to receive at least one event flow having been collected by the detection module (S10) of the system10. For example, in some non-limiting embodiments of the present technology, the at least one event flow can include data representative of events having occurred at the given host.

According to certain non-limiting embodiments of the present technology, the event flow comprises at least one event having occurred at the given host including, for example, without limitation, file creation, file deletion, file renaming, registry key creation, recording of values into the registry, deleting of values from the registry, deleting of the registry key, process creation and termination, process thread creation and termination, log event, creating a kernel object, and the like.

Further, in some non-limiting embodiments of the present technology, along with the event flow, the processor301can be configured to receive form the detection module S10, additional information on the given host, such as a sandbox verdict on files in it or host screen video, if it is equipped with a screen, and other information.

It should be expressly understood that the non-limiting embodiments of the present technology are based on a premise that, initially, all events in the event flow are not trusted and potentially malicious.

Therefore, the raw event flow received by the computing device (S20) from the host monitors is stored in a memory, such as a storage303thereof described below with reference toFIG.3.

The method100thus proceeds to step111.

Step111: Analyzing, by the Processor, a Given Event Sequence of the Event Flow Having Been Generated for a Predetermined Period, to Generate, for a Given Event of the Given Event Sequence, a Respective Internal Event, the Respective Internal Event Being Format-Invariant to Other Events in the Event Flow

Further, at step111, the processor301can be configured to identify, from the event flow, a given event sequence including data representative of the events having occurred at the given host over a predetermined period. Further, the processor301can be configured to generate, for a given event of the given event sequence, a respective internal event.

According to certain non-limiting embodiments of the present technology, the respective internal event is an event that is format-invariant to other events in the event flow and signature-based rules to be applied thereto, as will be described below.

Further, the processor301can be configured to store the respective internal events for each one of the given event sequence in the storage301as a pipeline of internal events. For example, the processor301can be configured to organize the pipeline of internal events as a process tree.

For example, if the processor301inputs the respective internal event, such as ProcessCreated #1, the pipeline, the processor301can further be configured to store information of the process in the process tree. Also, the processor301can be configured to store, in the process tree, additional information associated with the respective internal event, which has been received at step110, such as sandbox verdict on the files, screen video, and the like.

The method100thus advances to step112.

Step112: Applying, by the Processor, to the Respective Internal Event, a Plurality of Signature-Based Rules to Determine at Least One Internal State Marker of the Given Host Associated With the Given Event Sequence

Further, at step112, the processor301can be configured to apply, to the respective internal event, a plurality of signature-based rules. Further, in response to the respective internal event corresponding to at least one of the plurality of signature-based rules, the processor301can be configured to determine at least one internal state marker of the given host during occurrence of the given event sequence.

For example, the processor301can be configured to apply the signature wer_dump to the respective internal event ProcessCreated #2. In response to the respective internal event corresponding to this signature, the processor301can be configured to determine a failed process in the process tree and create the at least one internal state marker being “process failed”.

Also, in additional non-limiting embodiments of the present technology, to determine the at least one internal state marker of the given host, the processor301can be configured to use the additional information received from the detection module S10at step110.

Therefore, at step112, the processor301can be configured to store the respective internal event and the at least internal state marker associated therewith. By way of example, in some non-limiting embodiments of the present technology, the processor301can be configured to store BootTime in order to determine the computer rebooting time of the given host, and also create a respective internal state marker, which in combination with the other internal state markers could be indicative of the given event sequence being associated with the malicious activity and/or malicious object detected in the network or at the given host of the plurality of hosts. Accordingly, if no such information is detected, the processor301does not determine the respective internal state marker.

According to certain non-limiting embodiments of the present technology, the internal state of the given host indicated by the at least one internal state marker could comprise at least one of set of flags indicative of a current state of the given host, file paths, registry, processes, their signatures, mutexes, events (synchronization objects), networking, and also different counters. Also, the internal state has a predetermined validity period, which could be infinite as well as finite, such as of a predetermined duration.

Further, according to certain non-limiting embodiments of the present technology, each internal state marker of the at least one internal state marker can be pre-assigned with a respective weight value and a predetermined validity period. Besides, the predetermined validity period can be pre-determined based on test results for how indicative the respective internal state markers are of the malicious activity. More specifically, when the processor301has detected a malicious activity, it may further be configured to identify periods, during which a minimum number of errors of first and second kind have been occurred.

In the context of the present specification, errors of first kind are errors of denying a correct null hypothesis. For example, when a given internal state marker has been determined as being indicative of a non-malicious activity.

Further, in the context of the present specification, errors of second kind are errors of accepting an incorrect null hypothesis. For example, when the given internal marker has been determined as being non-indicative of a malicious activity or object.

Additionally, the processor301can be configured to store, such as in the storage303, all the information having determined at step112, such as the respective internal state markers and data of the respective internal states associated therewith with indication of their validity periods. The information is deleted, if its validity period has expired, and the internal state is then changed. In some non-limiting embodiments of the present technology, when the internal state is changed, the processor301can further be configured to determine a new respective internal state marker.

The method100hence advances to step113.

Step113: Feeding, by the Processor, the Respective Internal State Markers to a Trained Machine-Learning Algorithm (MLA) to Determine a Prediction Outcome Thereof of Whether the Given Event Sequence is Associated With the Malicious Activity

At step113, according to certain non-limiting embodiments of the present technology, the processor301can be configured to feed the respective internal state markers associated with each one of the given event sequence to a trained machine-learning algorithm (MLA) to determine a prediction outcome indicative of whether the given event sequence is associated with a malicious activity and/or object or not.

According to certain non-limiting embodiments of the present technology, the trained MLA has been trained, such as by the processor301, to determine whether the given event sequence is associated with the malicious activity based on a training set of data including, for example: (1) respective arrays of training internal state markers associated with training event sequences; and (2) respective labels assigned to the training event sequences indicative of whether these training event sequences are associated with one the malicious activity and object or not.

According to certain non-limiting embodiments of the present technology, the trained MLA comprises at least one of: a linear model (such as an SVM model), a classifier (such as a decision tree-based model, for example, a Random Forest model), and a neural network.

The method100thus proceeds to step114.

Step114: In Response to the Prediction Outcome Exceeding a Predetermined Threshold Value, Determining, by the Processor, the Given Event Sequence Having Been Occurred at the Given Host as Being Associated With the Malicious Activity

At step114, according to certain non-limiting embodiments of the present technology, the processor301can be configured to compare the prediction outcome of the trained MLA so determined at step113with a predetermined threshold value. Further, in response to the predicted outcome exceeding the predetermined threshold value, the processor301can be configured to determine that the given event sequence having occurred at the given host is associated with the one of the malicious activity and object.

In one example where the trained MLA comprises the linear model, the processor301can be configured to determine that the given event sequence is associated with the one of the malicious activity and object if a total weight of the respective internal state markers associated with the given event sequence is greater than a predetermined weight threshold.

In another example where the trained MLA comprises the classifier configured to generate, based on the respective internal state markers, a probability value, the processor301can be configured to determine that the given event sequence having occurred at the given host is associated with the one of the malicious activity and object if the probability value is greater than 50%. It is worth noting that, the features fed to the classifiers may include not only the respective internal state markers associated with the given event sequence, but also, in addition, any information from the context, the additional information from the pipeline, that is, stored in the process tree, performance counters, as mentioned above.

In yet another example where the trained MLA is implemented as a set of finite state machines complying with the behavior requirements, the processor301can be configured to determine the malicious activity based on differences from the behavior complying with the requirements.

The method100thus proceeds to step115.

Step115: Generating, by the Processor, a Report Including the Prediction Outcome for Presentation Thereof to a User

Finally, at step115, according to certain non-limiting embodiments of the present technology, the processor301can be configured to generate a report, for example, to the storage303, such as a disk, database, syslog, and the like, including the prediction outcome determined at step113and a respective verdict of analyzing the given event sequence determined, based on the predetermined threshold value, at step114.

For example, the report may also comprise at least one of: at least some of the respective internal state markers associated with the given event sequence, the respective verdict, process tree, host name, content of environment variables, information about connected devices, screenshot, screen video during detection, sequence of user actions, incident graph (the process initiating an incident with relationships-interactions, created files, created network connections, etc.), associated with the given host, and the like.

Alternatively, in lieu of generating the report, the processor301can be configured to store each marker information in the memory, such as the storage303, for further statistical calculation.

The method100hence terminates.

Computing Environment

With reference toFIG.3, there is depicted an example functional diagram of the computing environment300configurable to implement certain non-limiting embodiments of the present technology including the method100, described above.

In some non-limiting embodiments of the present technology, the computing environment300may include: the processor301comprising one or more central processing units (CPUs), at least one non-transitory computer-readable memory302(RAM), a storage303, input/output interfaces304, input/output means305, data communication means306.

According to some non-limiting embodiments of the present technology, the processor301may be configured to execute specific program instructions the computations as required for the computing environment300to function properly or to ensure the functioning of one or more of its components. The processor301may further be configured to execute specific machine-readable instructions stored in the at least one non-transitory computer-readable memory302, for example, those causing the computing environment300to execute the method100, as an example.

In some non-limiting embodiments of the present technology, the machine-readable instructions representative of software components of disclosed systems may be implemented using any programming language or scripts, such as C, C++, C#, Java, JavaScript, VBScript, Macromedia Cold Fusion, COBOL, Microsoft Active Server Pages, Assembly, Perl, PHP, AWK, Python, Visual Basic, SQL Stored Procedures, PL/SQL, any UNIX shell scrips or XML. Various algorithms are implemented with any combination of the data structures, objects, processes, procedures and other software elements.

The at least one non-transitory computer-readable memory302may be implemented as RAM and contains the necessary program logic to provide the requisite functionality.

The storage303may be implemented as at least one of an HDD drive, an SSD drive, a RAID array, a network storage, a flash memory, an optical drive (such as CD, DVD, MD, Blu-ray), etc. The storage303may be configured for long-term storage of various data, e.g., the aforementioned documents with user data sets, databases with the time intervals measured for each user, user IDs, etc.

The input/output interfaces304may comprise various interfaces, such as at least one of USB, RS232, RJ45, LPT, COM, HDMI, PS/2, Lightning, FireWire, etc.

The input/output means305may include at least one of a keyboard, a joystick, a (touchscreen) display, a projector, a touchpad, a mouse, a trackball, a stylus, speakers, a microphone, and the like. A communication link between each one of the input/output means305can be wired (for example, connecting the keyboard via a PS/2 or USB port on the chassis of the desktop PC) or wireless (for example, via a wireless link, e.g., radio link, to the base station which is directly connected to the PC, e.g., to a USB port).

The data communication means306may be selected based on a particular implementation of a network, to which the computing environment300can have access, and may comprise at least one of: an Ethernet card, a WLAN/Wi-Fi adapter, a Bluetooth adapter, a BLE adapter, an NFC adapter, an IrDa, a RFID adapter, a GSM modem, and the like. As such, the connectivity hardware304may be configured for wired and wireless data transmission, via one of a WAN, a PAN, a LAN, an Intranet, the Internet, a WLAN, a WMAN, or a GSM network, as an example.

These and other components of the computing device300may be linked together using a common data bus310.

It should be expressly understood that not all technical effects mentioned herein need to be enjoyed in each and every embodiment of the present technology.

Modifications and improvements to the above-described implementations of the present technology may become apparent to those skilled in the art. The foregoing description is intended to provide certain examples of implementation of the non-limiting embodiments of the present technology rather than to be limiting. The scope of the present technology is therefore intended to be limited solely by the scope of the appended claims.