Dynamically adaptive framework and method for classifying malware using intelligent static, emulation, and dynamic analyses

摘要

Techniques for malware detection are described herein. According to one aspect, control logic determines an analysis plan for analyzing whether a specimen should be classified as malware, where the analysis plan identifies at least first and second analyses to be performed. Each of the first and second analyses identified in the analysis plan including one or both of a static analysis and a dynamic analysis. The first analysis is performed based on the analysis plan to identify suspicious indicators characteristics related to processing of the specimen. The second analysis is performed based on the analysis plan to identify unexpected behaviors having processing or communications anomalies. A classifier determines whether the specimen should be classified as malicious based on the static and dynamic analyses. The analysis plan, the indicators, the characteristics, and the anomalies are stored in a persistent memory.

主权项

1. A computer implemented method of detecting malware in a specimen of computer content or network traffic, the method comprising:
responsive to receiving a specimen, determining, by a hardware controller, an analysis plan identifying an order for at least a first analysis and a second analysis to be performed, the first analysis comprises a static analysis and the second analysis comprises a dynamic analysis; performing the first analysis in accordance with the analysis plan to identify one or more suspicious indicators associated with malware and one or more characteristics related to processing of the specimen; performing the second analysis in accordance with the analysis plan, including processing of the specimen in a virtual environment including with one or more monitors to identify one or more unexpected behaviors each having one or more anomalies; responsive to a result of one of the first analysis or the second analysis, unpacking an object determined to be present in the specimen and performing a third analysis, wherein the third analysis comprises a static analysis on the object and is different from the first analysis and the second analysis when the first analysis is conducted prior to the second analysis; determining by a classifier whether the specimen should be classified as malicious based on at least one of (i) the one or more identified suspicious indicators, (ii) the one or more identified anomalies, or (iii) a result of the static analysis on the unpacked object; and storing one or more of (a) the analysis plan, (b) the one or more identified indicators, (c) the one or more characteristics, or (d) the one or more identified anomalies in a persistent memory.