Method and system for proactive detection of malicious shared libraries via a remote reputation system

摘要

A method for proactively detecting shared libraries suspected of association with malware includes the steps of determining one or more shared libraries loaded on an electronic device, determining that one or more of the shared libraries include suspicious shared libraries by determining that the shared library is associated with indications that the shared library may have been maliciously injected, loaded, and/or operating on the electronic device, and identifying the suspicious shared libraries to a reputation server.

主权项

1. A method for proactively detecting shared libraries suspected of association with malware, comprising the steps of:
determining one or more shared libraries loaded on an electronic device; determining that one or more of the shared libraries comprise suspicious shared libraries by determining that the shared library is associated with indications in memory that the shared library was maliciously injected on the electronic device, including:
determining that the shared library is not identified in a list of trusted modules or in a list of malware;determining whether a hook points to the shared library; anddetermining whether the shared library is associated with an open network port of the electronic device; and identifying the suspicious shared libraries to a reputation server, including:
identifying any executable objects that include the hook that points to the suspicious shared library; andidentifying any executable objects that are associated with the open network port of the electronic device.