RUNTIME DETECTION OF SELF-REPLICATING MALWARE

摘要

A method for detecting malicious active processes and self replicating executable binary files on a computing device. The method comprises monitoring in runtime active processes running on a computing device, extracting unique identifier(s) of each of the active processes which maps the active process to executable binary file(s) containing executable code of the active process, monitoring in runtime creation and modification of data files hosted by the computing device, identifying executable binary files among the data files, monitoring concurrent operation of logical sensors which detect malicious behavioral patterns of the active processes and maintain one or more lists of malicious behavioral pattern findings, and detecting malicious active process(es) of a malware from the active processes and self-replicating executable binary file(s) of the malicious active process(es) according to a match between the respective unique identifier(s), the malicious behavioral pattern findings and at least one the executable binary files.

主权项

1. A method for detecting malicious active processes and self-replicating executable binary files on a computing device in runtime, the method comprising:
executing a code on at least one hardware processor for:
monitoring at least one of a file creation event and a file modification event held by an operating system executed in a user mode on said at least one hardware processor to detect a plurality of executable binary files;monitoring new process creation events of a plurality of active processes executed by said operating system on said at least one hardware processor;detecting at least one match between one of said plurality of active processes and one of said plurality of executable binary files;detecting at least one self replication event of said plurality of executable binary files according to an analysis of said at least one match; andsuspending or terminating at least one of said plurality of active processes based on a comparison between said at least one self replication event and at least one known suspicious pattern.