A method, apparatus and computer-readable medium for detecting suspicious software

Abstract

This invention relates to the field of security technology, and more particularly to a method, apparatus, and computer-readable medium for detecting suspicious software, enabling rapid and effective detection of suspicious software. A method (200) for detecting suspicious software includes: determining (S201) at least one file (40) in a device (30) that has changed; searching (S202) for an executable file (41) from the at least one file (40); for each executable file (41) found, performing the following operations: determining (S203) first information (51), the first information including information about the operation that caused the executable file (41) to change; determining (S204) second information (52), the second information indicating the attributes of the executable file (41); and determining (S205) the degree of suspiciousness of the executable file (41) based on the first information (51) and the second information (52).

Description

Technical Field

[0001] The present invention relates to the field of security technology, and in particular to a method, apparatus and computer-readable medium for detecting suspicious software. Background Technology

[0002] One task of security analysis is to detect suspicious software installed on devices. Attackers can maliciously install such software to tamper with sensitive data, modify configuration files, and so on, so it is essential to detect this suspicious software effectively.

[0003] However, with the development of computer technology, the capacity of device storage media is getting larger and larger, making it as difficult to find suspicious software as finding a needle in a haystack. Therefore, there is an urgent need to find an effective method to detect suspicious software.

[0004] Currently, suspicious software detection primarily employs whitelists and blacklists. A software whitelist is a method of allowing only specific software and applications to run to maintain security. It's a collection of trusted software. In other words, software not on the whitelist is considered untrustworthy, or at least suspicious. A software blacklist, on the other hand, is a method of prohibiting only specific software and applications from running to maintain security. It's a collection of untrustworthy software, or even highly suspicious or malicious software. Using whitelists and blacklists for suspicious software detection via signatures requires maintaining a large signature database, and for detection on a specific device, a significant amount of information in the signature database is redundant. Summary of the Invention

[0005] Considering that most data on the device is clean, filtering out as much clean data as possible can narrow the detection range and reduce the amount of data to be detected, thereby achieving rapid and effective detection of suspicious software. Therefore, embodiments of the present invention provide a method, apparatus, and computer-readable medium for detecting suspicious software. Using the solution provided by the embodiments of the present invention, the detection range of suspicious software can be effectively narrowed, and the detection efficiency is higher.

[0006] Firstly, a method for detecting suspicious software is provided. This method may include:

[0007] - Identify at least one file that has changed within a device;

[0008] - Locate the executable file from at least one of the files;

[0009] For each executable file found, perform the following operations: determine first information, which includes information about operations that would change the executable file; determine second information, which indicates the attributes of the executable file; and determine the degree of suspicion of the executable file based on the first information and the second information.

[0010] Secondly, a suspicious software detection device is provided, the device may include:

[0011] - A search module is configured to identify at least one file that has changed in a device, and to search for an executable file from said at least one file;

[0012] - A detection module is configured to perform the following operations for each executable file found: determine first information, the first information including information about operations that change the executable file; determine second information, the second information indicating the attributes of the executable file; and determine the degree of suspicion of the executable file based on the first information and the second information.

[0013] Thirdly, a suspicious software detection device is provided, comprising: at least one memory configured to store computer-readable code; and at least one processor configured to invoke the computer-readable code to perform the steps provided in the first aspect.

[0014] Fourthly, a computer-readable medium storing computer-readable instructions that, when executed by a processor, cause the processor to perform the steps provided in the first aspect.

[0015] This method involves acquiring information about file changes on the device under test, then searching for executable files among the changed files, and finally detecting suspicious software within those executable files. This effectively narrows down the scope of suspicious software detection and improves detection efficiency.

[0016] Optionally, for any of the above aspects, third information used to record the file status in the device at various points in time within a time period can be obtained, and by comparing the third information at each point in time, at least one file that has changed in the device during the time period can be determined. In this way, existing third information can be used to quickly and easily identify changed files, effectively narrowing down the detection range of suspicious software. For example, changed files can be identified by comparing VSS snapshot files at different points in time. VSS snapshot files are designed for data recovery; here, VSS snapshot files at different points in time are cleverly used to obtain information about file changes, thereby narrowing down the detection range of suspicious software, which is both convenient and efficient.

[0017] Furthermore, the third information at each point in time can be compared to determine information about the operations that caused changes to each found executable file within the time period. This operation information can be used to determine the degree of suspicion of the executable file.

[0018] Optionally, for any of the above aspects, it can be determined whether a file is an executable file based on the metadata of each of the at least one file.

[0019] For any of the above aspects, optionally, the first information includes at least one of the following:

[0020] - File creation operation information;

[0021] - Modify file operation information;

[0022] - Information about deleting files.

[0023] For any of the above aspects, optionally, the second information includes at least one of the following:

[0024] -File name;

[0025] -File storage path;

[0026] -File creation time;

[0027] -File type;

[0028] - Digital signature. Attached Figure Description

[0029] Figure 1 This is a schematic diagram of the suspicious software detection device provided in an embodiment of the present invention.

[0030] Figure 2 A flowchart of a suspicious software detection method provided in an embodiment of the present invention.

[0031] Figure 3 This is a flowchart illustrating the process of determining the suspiciousness of a file based on file operations in an embodiment of the present invention.

[0032] Figure 4 This is a flowchart illustrating the process of determining the suspiciousness of a file based on its attributes, as described in an embodiment of the present invention.

[0033] List of reference numerals in the attached diagram:

[0034] Detailed Implementation

[0035] The subject matter described herein will now be discussed with reference to exemplary embodiments. It should be understood that these embodiments are discussed merely to enable those skilled in the art to better understand and implement the subject matter described herein, and are not intended to limit the scope, applicability, or examples set forth in the claims. The function and arrangement of the elements discussed may be changed without departing from the scope of the embodiments of the invention. Various processes or components may be omitted, substituted, or added as needed in the various examples. For example, the described methods may be performed in a different order than described, and steps may be added, omitted, or combined. Furthermore, features described in some examples may be combined in other examples.

[0036] As used herein, the term "comprising" and its variations are open terms meaning "including but not limited to". The term "based on" means "at least partially based on". The terms "one embodiment" and "an embodiment" mean "at least one embodiment". The term "another embodiment" means "at least one other embodiment". The terms "first", "second", etc., may refer to different or the same objects. Other definitions, whether explicit or implicit, may be included below. Unless explicitly indicated by the context, the definition of a term shall remain consistent throughout the specification.

[0037] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0038] In this embodiment of the invention, the device for detecting suspicious software is referred to as the suspicious software detection device 10. The suspicious software detection device 10 can acquire information about file changes on the device 30 to be tested, search for executable files from the changed files, and then detect suspicious software from the executable files. By acquiring information about file changes, the scope of suspicious software detection is narrowed, greatly improving detection efficiency. The device 30 to be tested can be any computer device or a device with a computer architecture, including computers, laptops, tablets, industrial control computers, servers, embedded devices, etc. It can be used for the detection of various devices such as industrial control equipment and home appliances.

[0039] The suspicious software detection device 10 can be implemented as a network of computer processors to execute the suspicious software detection method 200 in this embodiment of the invention. The suspicious software detection device 10 can also be as follows: Figure 1The single computer shown acquires information 53 about the file status on the device under test 30 via communication module 103. The suspicious software detection device 10 may also include at least one memory 101, which includes computer-readable media, such as random access memory (RAM). The device 10 also includes at least one processor 102 coupled to at least one memory 101. Computer-executable instructions are stored in at least one memory 101 and, when executed by at least one processor 102, can cause at least one processor 102 to perform the steps described herein. At least one processor 102 may include a microprocessor, application-specific integrated circuit (ASIC), digital signal processor (DSP), central processing unit (CPU), graphics processing unit (GPU), state machine, etc. Embodiments of computer-readable media include, but are not limited to, floppy disks, CD-ROMs, magnetic disks, memory chips, ROMs, RAMs, ASICs, configured processors, all-optical media, all magnetic tapes or other magnetic media, or any other media from which a computer processor can read instructions. Furthermore, various other forms of computer-readable media can send or carry instructions to a computer, including routers, private or public networks, or other wired and wireless transmission devices or channels. Instructions can include code in any computer programming language, including C, C++, C, Visual Basic, Java, and JavaScript.

[0040] When executed by at least one processor 102 Figure 1 At least one memory 101 shown may contain a suspicious software detection program 20, causing at least one processor 102 to execute the suspicious software detection method 200 described in this embodiment of the invention. The suspicious software detection program 20 may include:

[0041] - A search module 201 is configured to determine at least one file 40 that has changed in the device 30, and to search for an executable file 41 from the at least one file 40;

[0042] - A detection module 202 is configured to perform the following operations for each executable file 41 found:

[0043] - Determine the first information 51, which includes information about the operation that causes the executable file 41 to change;

[0044] - Determine the second information 52, which is used to indicate the attributes of the executable file 41;

[0045] - Determine the degree of suspicion of the executable file 41 based on the first information 51 and the second information 52.

[0046] Optionally, when the lookup module 201 determines that at least one file 40 has changed in the device 30, it is configured to:

[0047] - Obtain the third information 53 used to record the file status of device 30 at various time points within a time period;

[0048] - Compare the third information 53 at various points in time to identify at least one file 40 that has changed in the device 30 during that time period.

[0049] The first information 51 (including information about operations that cause changes to the executable file 41), the second information 52 (information indicating the attributes of the executable file 41), and the third information 53 (information for recording the file status in the device 30) can all be stored in at least one memory 101.

[0050] For example, the first information 51 may include at least one of the following:

[0051] - File creation operation information 511;

[0052] - Modify file operation information 512;

[0053] - File deletion operation information 513.

[0054] The second information 52 may include at least one of the following:

[0055] -File name 521;

[0056] -File storage path 522;

[0057] -File processing time: 523;

[0058] -File type 524;

[0059] - Digital signature 525.

[0060] It should be mentioned that embodiments of the present invention may include those having different... Figure 2 The apparatus shown is an example. The above architecture is merely exemplary and is used to explain the method 200 provided in the embodiments of the present invention. For example, the suspicious software detection apparatus 10 can be implemented as software, including a suspicious software detection program 20, which can be deployed on the device to be detected 30 for detecting suspicious software on the device 30.

[0061] In addition, the above modules can also be regarded as functional modules implemented by hardware, used to implement various functions involved in the execution of the suspicious software detection method by the suspicious software detection device 10. For example, the control logic of each process involved in the method can be pre-burned into a chip such as a field-programmable gate array (FPGA) or a complex programmable logic device (CPLD), and these chips or devices can execute the functions of the above modules. The specific implementation method can be determined according to engineering practice.

[0062] like Figure 2 As shown, an exemplary method 200 according to an embodiment of the present invention includes the following steps:

[0063] -S201: Identify at least one file 40 that has changed in a device 30;

[0064] -S202: Locate an executable file 41 from at least one of the aforementioned files 40. For each executable file 41 found, perform the following operation:

[0065] -S203: Determine the first information 51, the first information including information about the operation that causes the executable file 41 to change;

[0066] -S204: Determine the second information 52, which is used to indicate the attributes of the executable file 41;

[0067] -S205: Based on the first information 51 and the second information 52, determine the degree of suspicion of the executable file 41.

[0068] Optionally, in step S201, the suspicious software detection device 10 can acquire third information 53 for recording the file status in the device 30 at various time points within a time period, and determine at least one file 40 that has changed in the device 30 during the time period by comparing the third information 53 at each time point; while in step S203, information on the operation that caused each found executable file 41 to change during the time period can be determined by comparing the third information 53 at each time point.

[0069] Taking the device under test 30 running Volume Snapshot Service (VSS) as an example, in step S201, VSS snapshot files at various points in time over a period of time can be obtained. By sorting these VSS snapshot files by time and comparing adjacent VSS snapshot files one by one, the changed files 40 can be identified, and information about the operations that caused these changes can be identified. These operations include: creation, deletion, and modification.

[0070] In step S202, the file's executable nature can be determined based on its metadata, such as its format. For example, in the Windows operating system, different file types have different formats; the file type can be determined by parsing the file format. Executable files can include scripts, binary executables, etc. This further narrows down the detection scope of suspicious software.

[0071] In step S205, the degree of suspicion of the executable file 41 can be determined based on the determined first information 51 and second information 52. For example, the degree of suspicion of an executable file 41 can be measured by scoring; the lower the score, the higher the degree of suspicion. One possible implementation is to score based on the first information 51 to obtain a first score value 71; and score based on the second information 52 to obtain a second score value 72. Then, a total score value is calculated based on the first score value 71 and the second score value 72 (e.g., the sum or weighted sum of the two scores), and the degree of suspicion of the executable file 41 is determined based on this total score value.

[0072] Below, for reference Figure 3 This describes sub-step S2051, which determines the first score 71 based on the first information 51. Sub-step S2051 may further include:

[0073] -S20511: Determine the content of the first information 51. If information 51 includes file creation operation information 511, then execute sub-step S20512. If information 51 includes file modification operation information 512, then execute sub-step S20513. If information 51 includes file deletion operation information 513, then execute sub-step S20514.

[0074] -S20512: Determine the first score as 71 minus 2;

[0075] -S20513: Determine the first score as 71 minus 1;

[0076] -S20514: Determine the first score as 71 minus 1.

[0077] The above process of determining the first score 71 based on the first information 51 is merely an example. In reality, there can be multiple methods for determination. As can be seen from the above methods, for operations involving creating files, the executable file 41 is considered highly suspicious; for operations involving modifying or deleting files, the suspicion level of the executable file 41 is slightly lower; and for files that remain unchanged, their suspicion level is not considered. Therefore, as long as the above judgment rules can be implemented, the goal of determining the suspicion level of an executable file based on the type of file operation can be achieved.

[0078] Below, for reference Figure 4 This describes sub-step S2052, which involves determining the second score 72 based on the second information 52. Sub-step S2052 may further include:

[0079] -S20521: Compare the file name 521 of the executable file 41 with the system file name 521'. If the file name judgment condition 61 is met (e.g., the similarity between the two is greater than the preset threshold), it means that the two are similar, and then execute sub-step S20522. Otherwise, skip sub-step S20522 and directly execute sub-step S20523.

[0080] -S20522: Determine the second score of 72 minus 3, then execute sub-step S20523.

[0081] -S20523: Compare the file storage path 522 of the executable file 41 with the specified directory 522', where the specified directory 522' may include, but is not limited to: system directory, user profile directory, temporary directory, etc. If the file storage path judgment condition 62 is met (e.g., the directories are the same), then execute sub-step S20524; otherwise, skip sub-step S20524 and directly execute sub-step S20525.

[0082] -S20524: Determine the second score value as 72 minus 1, then execute sub-step S20525.

[0083] -S20525: Compare the file processing time 523 of executable file 41 with the creation time range 523'. If the file processing time judgment condition 63 is met (for example, the time related to a file includes: file creation time, file modification time, file access time, MFT record change time; if the file creation time is greater than the time of other types of files, or the time of all types of files is 0, either of these two conditions must be met), then execute sub-step S20526. Otherwise, skip sub-step S20526 and directly execute sub-step S20527.

[0084] -S20526: Determine the second score of 72 minus 2, then execute sub-step S20527.

[0085] -S20527: Compare the file type 524 of the executable file 41 with the specified file type 524'. If the file type judgment condition 64 is met (e.g., the file type is a system file, a hidden file, a read-only file, or an archive file), then execute sub-step S20528. Otherwise, skip sub-step S20528 and execute sub-step S20529 directly.

[0086] -S20528: For any of the following types of files: system files, hidden files, read-only files, and archive files, if executable file 41 belongs to any of these file types, then the second score value 72 is reduced by 1. If executable file 41 belongs to three of the above four types, then the second score value 72 is reduced by 3.

[0087] -S20529: Determine whether the digital signature 525 of the executable file 41 meets the digital signature judgment condition 65 (e.g., the digital signature is valid). If it does, execute sub-step S20530; otherwise, skip sub-step S20530 and directly obtain the final second score 72.

[0088] -S20530: Determine the second score as 72 plus 50.

[0089] The process of determining the second score 72 based on the second information 52 described above is merely an example. In reality, there are multiple methods for determination. As can be seen from the above methods, if the name of the executable file 41 that has changed is similar to a system file name, the file storage path is under the specified directory 522', the file creation time meets the preset conditions, and the file type is the specified file type 524', then the degree of suspicion is relatively high. However, if the digital signature is valid, the degree of suspicion will be greatly reduced. Therefore, as long as the above judgment rules can be implemented, the purpose of determining the degree of suspicion of an executable file based on the type of file operation can be achieved.

[0090] Below is an example. An image is created by mirroring a file named scvhost.exe and an application.exe. The above process is used to determine the first score (71) and the second score (72), and the total score is used to determine the suspiciousness of executable file 41. The total scores for the two files are -8 and 50 respectively, indicating that scvhost.exe is more suspicious.

[0091] Table 1 shows the process for determining the second score of 72. Table 2 shows the process for determining the first score of 71 and the total score.

[0092] Table 1

[0093]

[0094] Table 2

[0095]

[0096] Furthermore, embodiments of the present invention also provide a computer-readable medium storing computer-readable instructions. When executed by a processor, the computer-readable instructions cause the processor to perform the aforementioned suspicious software detection method. Embodiments of the computer-readable medium include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Optionally, the computer-readable instructions can be downloaded from a server computer or the cloud via a communication network.

[0097] In summary, embodiments of the present invention provide a method, apparatus, and computer-readable medium for detecting suspicious software. Traditional methods using whitelists and blacklists require maintaining large and comprehensive datasets, while the solution provided by the present invention does not require prior database maintenance. Furthermore, much of the data in whitelists and blacklists is redundant for detecting specific devices or systems. In the solution provided by the present invention, the detection results are based on the files themselves on the device, resulting in more accurate detection and applicability to various devices and systems. Further, whitelists and blacklists require frequent updates to the signature database, while the solution provided by the present invention can detect suspicious software as long as changes to files on the device are detected, without needing to update the database. Finally, whitelists and blacklists are based on known suspicious software and cannot detect unknown suspicious software, while the solution provided by the present invention summarizes the characteristics of suspicious software and detects it accordingly, thus having the potential to discover various unknown suspicious software.

[0098] It should be noted that not all steps and modules in the above processes and system structure diagrams are mandatory; some steps or modules can be omitted as needed. The execution order of each step is not fixed and can be adjusted as required. The system structure described in the above embodiments can be a physical structure or a logical structure. That is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or they may be jointly implemented by certain components in multiple independent devices.

Claims

1. A method for detecting suspicious software (200), characterized in that, include: - Determine (S201) at least one file (40) in a device (30) that has changed; - Locate (S202) the executable file (41) from the at least one file (40); - For each executable file (41) found, perform the following operation: - Determine (S203) first information (51), the first information including information on the operation that causes the executable file (41) to change; - Determine (S204) the second information (52), which is used to indicate the attributes of the executable file (41); - Based on the first information (51) and the second information (52), the first information (51) and the second information (52) are scored respectively, and based on the scoring results, the degree of suspicion of the executable file (41) is determined (S205).

2. The method as described in claim 1, characterized in that, Determine (S201) at least one file (40) in a device (30) that has changed, including: - Obtain third information (53) used to record the file status in the device (30) at various time points within a time period; - Compare the third information (53) at various points in time to determine at least one file (40) that has changed in the device (30) during the time period.

3. The method as described in claim 2, characterized in that, The determination (S203) of the first information (51) includes: - Compare the third information (53) at each point in time to determine information on the operations that caused changes to each of the found executable files (41) during the time period.

4. The method as described in claim 1, characterized in that, Locating (S202) an executable file (41) from the at least one file (40), including: - Determine whether a file is an executable file based on the metadata of each file in the at least one file (40).

5. The method as described in claim 1, characterized in that, The first information (51) includes at least one of the following: - File creation operation information (511); - Modify file operation information (512); - Operation information for deleting files (513).

6. The method as described in claim 1, characterized in that, The second information (52) includes at least one of the following: - File name (521); - File storage path (522); - File creation time (523); - File type (524); - Digital signature (525).

7. A suspicious software detection device (10), characterized in that, include: - A search module (201) is configured to identify at least one file (40) that has changed in a device (30), and to search for an executable file (41) from said at least one file (40). - A detection module (202) is configured to perform the following operation for each executable file (41) found: - Determine first information (51), the first information including information about the operation that causes the executable file (41) to change; - Determine the second information (52), which is used to indicate the attributes of the executable file (41); - Based on the first information (51) and the second information (52), the first information (51) and the second information (52) are scored respectively, and the degree of suspicion of the executable file (41) is determined based on the scoring results.

8. The apparatus as claimed in claim 7, characterized in that, When the search module (201) determines that at least one file (40) has changed in a device (30), it is configured to: - Obtain third information (53) used to record the file status in the device (30) at various time points within a time period; - Compare the third information (53) at various points in time to determine at least one file (40) that has changed in the device (30) during the time period.

9. A suspicious software detection device (10), characterized in that, include: At least one memory (101) is configured to store computer-readable code; At least one processor (102) is configured to invoke the computer-readable code to perform the method as described in any one of claims 1 to 6.

10. A computer-readable medium, characterized in that, The computer-readable medium stores computer-readable instructions that, when executed by a processor, cause the processor to perform the method as described in any one of claims 1 to 6.

Images