Collecting and analyzing malware data

Abstract

A malware analysis system is described that provides information about malware execution history on a client computer and allows automated back-end analysis for faster creation of identification signatures and removal instructions. The malware analysis system collects threat information on client computers and sends the threat information to a back-end analysis component for automated analysis. The back-end analysis component analyzes the threat information by comparing the threat information to information about known threats. The system builds a signature for identifying the threat family and a mitigation script for neutralizing the threat. The system sends the signature and mitigation data to client computers, which use the information to mitigate the threat. Thus, the malware analysis system detects and mitigates threats more quickly than previous systems by reducing the burden on technicians to manually create environments for reproducing the threats and manually analyze the threat behavior.

Description

Background technique [0001] Antivirus, antispyware, and other antimalware applications seek to protect client computers by identifying unwanted applications or other executable code and removing or at least neutralizing the harmful code. Current anti-malware applications (eg, Microsoft Windows Defender, Microsoft Forefront Client Security, Microsoft OneCare, Microsoft Exchange Server's Forefront Server, etc.) use a signature-based approach to detecting viruses, worms, and spyware. Signature-based approaches rely on one or more distinguishing characteristics of malware to provide positive identification so that anti-malware applications can remove it. For example, a specific malware application may have a specific filename, write specific values ​​to an operating system configuration database (e.g., Microsoft Windows Registry), or contain executable code with specific bytes (e.g., use CRC, password hashes, or other signature algorithm identification) [0002] Signature-based ...

AI Technical Summary

Problems solved by technology

The technician may also not receive a complete picture of the malware being analyzed because the malware expects a dedicated environment, or a combination of user actions that are not apparent or non-existent in the technician's environment

Images