RU96267U1 - SYSTEM OF COMPLETING ANTI-VIRUS DATABASES UNDER THE DETECTION OF UNKNOWN MALIGNANT COMPONENTS - Google Patents

Abstract

 1. A system for replenishing anti-virus databases by detecting unknown malicious components in a computer system, containing:! a) an event monitor designed to track events occurring in the operating system associated with the logging subsystem; ! b) a logging subsystem designed to detect suspicious events from events occurring in the operating system associated with the analysis module and anti-virus system; ! c) an analysis module designed to track the history of events that occurred during the creation of processes and child processes and to build a parent-child hierarchy associated with the antivirus system; ! d) an anti-virus system designed for:! (i) checking executable computer files of a computer; ! (ii) after detecting a known malicious component, calling the analysis module to determine in which event the detected malicious component participated, using a parent-child hierarchy; ! (iii) creating information about the list of processes participating in the event in which the found malicious component participated, as well as created or modified files, and processes launched from such files, based on relationships in the parent-child hierarchy; ! (iv) termination of all active participant processes belonging to the event in which the detected malicious component participated; ! (v) removing or quarantining executable files that were used as part of the event in which the detected malicious component participated; ! while the anti-virus system is connected to the anti-virus system database update server; ! d) the server is updated

Description

Technical field

The utility model relates to systems for counteracting computer viruses, namely to technologies for replenishing anti-virus databases when unknown unknown components are detected.

State of the art

Currently, various means of transmitting information and data through computer networks are actively developing, including the increase in electronic mail forwarding. At the same time, the risks of viruses infecting computers and computer networks through such means of communication are growing, which should be given appropriate attention. Virus threats take various forms, but, in essence, remain computer viruses - trojans, worms and other types of malicious code.

Various systems for detecting and preventing the spread of malware have already been described in patents and applications such as US 7310817, US 7058975, US 20030120947, US 6772345, WO 03052564, US 20050188272. However, these systems are not able to deal with those malicious programs that represent not one file, but several modules, each of which performs a specific function.

The seriousness of the situation with such programs at present cannot be underestimated, since multicomponent malware poses a serious danger, because when they infect a computer, they act as follows: a small downloader program enters the computer system, after which it communicates with the server and downloads the second downloader program, which downloads malicious components with a total of 10-20 components. Such components are designed to send spam, trojans, collect personal data, etc. After the release of a new malicious virus, it takes some time until the anti-virus databases are updated to take into account the new threat.

Moreover, part of the many components is already described in anti-virus databases, which are provided by suppliers of anti-virus protection systems. However, not all of these components can be quickly added to the anti-virus database, which means that only those malicious components that are described in the anti-virus database will be recognized in the computer system. After the end of treatment, the antivirus system falsely assumes that all threats have been eliminated, and in the meantime some of the components of the malicious program remain in the computer system and continue to work unhindered. Moreover, some of these components are able to recognize that the anti-virus protection system has removed some of the components of the malicious program, and then download and install them again. Thus, the user gets into a vicious circle until the anti-virus system provider updates its databases to detect all components of the malicious program.

Thus, it is necessary to develop a system to protect against such situations when multicomponent viruses are loaded into the system, and not all of their components are recognized by the antivirus system, which leads to lengthy and unsuccessful attempts to cure them.

Utility Model Disclosure

This useful model is designed to replenish anti-virus databases by detecting unknown malicious components in a computer system.

The technical result consists in replenishing anti-virus databases by detecting unknown malicious components in a computer system. This result is achieved through the use of a system that contains:

an event monitor designed to track events occurring in the operating system associated with the logging subsystem;

a logging subsystem designed to detect suspicious events from events occurring in the operating system associated with the analysis module and anti-virus system;

an analysis module designed to track the history of events that occurred during the creation of processes and child processes, and to build a parent-child hierarchy associated with the antivirus system;

anti-virus system designed for: checking executable computer files of a computer; after detecting a known malicious component, calling the analysis module to determine in which event the detected malicious component participated, using a parent-child hierarchy; creation of information about the list of processes participating in the event in which the found malicious component participated, as well as created or modified files, and processes launched from such files, based on the relationships in the parent-child hierarchy; completion of all active participant processes belonging to the event in which the detected malicious component participated; removing or quarantining executable files that were used as part of the event in which the detected malicious component participated; while the anti-virus system is connected to the anti-virus system database update server;

An anti-virus system database update server designed to use information received from the anti-virus system on the list of processes participating in the event in which the detected malicious component participated, as well as created or modified files, and processes launched from such files, to replenish anti-virus databases with taking into account the detection of unknown malicious components, based on the information received from the anti-virus system.

In one embodiment, events occurring in the operating system may include events related to the creation, modification of executable files, and changes in the system registry.

In a private embodiment, there is an additional backup storage subsystem associated with the event monitor and anti-virus system, designed to save files before changing them.

In another private embodiment, the anti-virus system restores files from the backup storage subsystem when they are modified by malicious components.

In another particular embodiment, suspicious events are those that have a certain level of danger from the point of view of the anti-virus system and may be actions that include attempts to create and / or modify files in system folders, change or delete important registry branches, work with processes, download files from the network without warning the user.

In yet another particular embodiment, the anti-virus database update server updates the databases of all users after updating the anti-virus databases, taking into account the detection of unknown malicious components.

Additional advantages of the utility model will be disclosed later in the description of the implementation options of the utility model. Also note that all the materials in this description are aimed at a detailed description of the technical proposal, which is set out in the utility model formula.

Brief Description of the Drawings

Additional objectives, features and advantages of this utility model will be disclosed further in the description with reference to the accompanying drawings.

Figure 1 shows an example implementation of a utility model.

Figure 2 displays the sequence of implemented steps performed by this technical solution.

Figure 3 shows the tracking of events detected cases of malicious activity in the system.

Figure 4, displays additional details of the mechanism for identifying relationships between objects and executable files / processes.

Figure 5 shows an exemplary diagram of a general purpose computer on which the present technical solution is deployed.

Description of Embodiments of a Utility Model

The main advantages of this solution arise from the logging of all events associated with suspicious files so that the case of malware infection can be reconstructed from the log entries, if not all components of the malicious software were known in advance by the anti-virus system. Of interest are attempts to write to the system registry or create and / or modify executable files, such as. exe files, scripts (scripts), batch batch files, etc. With a log of such events, it is possible to reconstruct the chain of events of the past at the right date, and not only to reveal the facts of infection or substitution of some files with a relatively high probability of containing malicious or infected files.

We also note that the number of such executable files in a typical computer system reaches several hundred executable files. Attempts to write to such files are quite complicated compared to writing to a regular file. Thus, most computers contain hundreds and thousands of files at any given time (for example, when searching the Internet with a browser, a lot of small files are created), but such files are not intended for execution, and in the general case are not of interest in the framework of the problem under consideration. On the other hand, attempts to create new files are quite rare events (users rarely download and install new programs - this is a rare event that is usually performed by the user most often only during the initial setup of the computer or when reinstalling the operating system).

Similarly, attempts to modify an existing executable file are also quite unusual. Most Microsoft system fixes that relate to the operating system or other software, such as MS Word, MS Excel, etc., are quite rare. With this in mind, the program and event log file of the program updates and recordings will not be too large.

If an infection is detected, the fact of infection should be confirmed by identifying at least one known malicious component. Subsequently, events are reconstructed to determine the initial moment of the threat penetration into the computer system. In other words, they identify the parent process that created the file (or, if the malicious component is located in memory, determine the process that created the malicious or infected process). Also, all executable files and processes created and modified by the parent process, or participating in the hierarchy tree of interactions with the suspected process, are identified. As a result, a list of all processes in contact with a known infected process is created.

In most cases, the creation of many such files in a short moment of time, when several known malicious files appear, with a high probability means that the remaining files are also malicious, even if they are not known as malicious for the anti-virus system. Such suspicious files can be deleted or quarantined, or they can be sent to the antivirus company for analysis, and / or the user can delete such files at his discretion (when a notification about an infection event is displayed). Thus, having discovered unknown malicious components, you can calculate their hash immediately, and then send this information to the antivirus company. Additionally, you can also determine which files were modified by unknown malicious components in order to identify potential vulnerabilities in existing licensed software (software). Such information can be used to update the anti-virus databases as soon as possible in order to detect unknown malicious components from all other users.

Note that the purpose of the utility model is still another problem that occurs after infection and after a system reboot. In this case, any information that is associated with events that occurred before the reboot is lost. Usually, it is not possible to recover events that preceded such a rare incident, and one can only hope that all malicious components were known to the antivirus system, which they successfully got rid of. Thus, if the system rebooted, then the log files can shed light on the events that happened before and will allow you to remove recently installed new components, or restore from backup copies of those executable program files that are necessary for the operating system or user applications. In this area, antivirus technologies relate to computer forensics that try to reconstruct the sequence of events of a computer system that has been infected. Often, computer investigations are a time-consuming process, the accuracy of which depends heavily on the completeness of the information in the log files, which describes the chronology of events on file creation, their modification and process creation, including the parent-child hierarchy of relationships. Such information can be presented in the form of a hierarchical tree, which makes the task of computer investigation as a result much easier.

Figure 1 presents an example implementation of a utility model. As shown in FIG. 1, in a computer system, an event monitor 104 is installed so as to monitor all events 107 for creating, changing executable files, entries in the system registry, and other actions that occur in the operating system 106. Event monitor 104 detects suspicious events, records events in the audit event log 102 and saves file versions before changing them in the form of backups 105. Suspicious events can be determined in advance - these can be events that eyut a certain level of danger from the point of view of the anti-virus system 101. Such events may be attempts to create and / or modify files in the system folders, modification or deletion of important registry branches, working with processes, download files from the network without warning the user, etc. Audit event log 102 is used by analysis module 103, which is used to track the history of events that occurred during the creation of processes and child processes (descendants), and to build a parent-parent hierarchy and so on. Antivirus system 101 is responsible for detecting the presence of known malicious programs. Also, using the audit event log 102 and analysis module 103, the anti-virus system 101 deletes, quarantines, or disinfects infected files. For example, if a file that the operating system needed, such as the system file used during the boot of the operating system (for example, the Explorer process), was infected, then the anti-virus system 101 restores the trusted version of such a file from backup 105. The anti-virus system 101 uses the anti-virus database data 108, which contains data on malicious program files, and adds those from the files that were identified during the investigation, as part of a single event, if such files were not yet marked as malicious Software components. Then the anti-virus system 101 reboots from the trusted storage device.

Further, the anti-virus system 101 is connected via a network, for example, using the Internet 109, to the anti-virus server 110, which is owned by the anti-virus software provider, to transmit information that describes the event (for example, a copy of the log file, a copy of malicious components or suspected malicious components have not been transmitted known, but participating in a suspicious event). Thus, it is possible to form a package containing information about all interconnected malicious components, as well as about those files or registry branches that were changed during their work.

After that, the anti-virus server 110 can send a description (for example, a hash) of unknown malicious components to other users, for which you can immediately arrange for the presence of previously undetected malicious components, as well as restore damaged files from backup copies 105.

Figure 2 describes the sequence of actions used by this technical solution. As shown in FIG. 2, the system expects the occurrence of an event, such that the system application programming interface (API) is activated in the API call search block (position 201) when creating or modifying a file, or writing to the system registry. If a similar event was detected by the filtering subsystem (position 202), then it is processed using the filter 203, i.e. determine the degree of danger (suspicion) of the event. If the monitoring subsystem 204 detects that the event being processed is suspicious, because if it affects the executable file or registry keys, the parameters of this event are written to the database or event log 102 (position 205), after which the control is transferred to the API 201 call search block. It is worth noting that events can be processed either one after the other or taking into account the relationship between them - for example, you can separately track API calls from the selected process. Similarly, you can identify potentially dangerous behavior when an unknown malware starts downloading other components to the hard drive, which can then begin to execute other malicious functionality.

Figure 3 displays the processing of an event that is associated with malicious activity. The malware detection is carried out at step 301 using the anti-virus system 101. At step 302, an analysis is started to detect files that could be affected by the detected malware. At step 303, according to the event records from the event log, a list of files associated with the event is created, the processes that were created or modified by such files, as well as the descendants of such processes, are also listed. At step 304, the user is notified of the presence of such files, after which further system actions are requested. At step 305, infected files or malicious software components are neutralized, for example, deleted, quarantined, or the infected or malicious process is terminated, or the file is restored from a trusted backup. At step 306, information about the detected malicious components is additionally sent to the server of the anti-virus company, after which the anti-virus databases will be updated, and the remaining users will be notified.

Figure 4 displays additional details of the process for identifying objects associated with an event (see step 303 in Figure 3). As shown in FIG. 4, step 401 performs the identification of all relationships between objects suspected from the results of the event log entries 102. At step 402, the computer is checked for objects that have not yet been processed, which should be processed. At 403, the next such raw object is selected. At step 404, the creation time of the object or its modification is compared to determine how close it is to the time when the suspicious event occurred. By step 405, all files associated with the object in the event database 105 are determined. At step 406, a parent-child relationship hierarchy is constructed for the object. At 407, it is looked at that there are such relationships, and then at 408, the relationships and object identifiers are stored. After that, the processing returns to step 402.

5 is an example of a general purpose computer system, a personal computer or server 20 comprising a central processor 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented like any bus structure known in the art, which in turn contains a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS), containing the basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading using the ROM 24.

The personal computer 20, in turn, contains a hard disk 27 for reading and writing, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD- ROM and other optical storage media. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the magnetic disk drive interface 33 and the optical drive interface 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20. This description discloses an implementation of a system that uses a hard disk, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that it is possible to use other types of computer storage media that are capable of storing data in a form readable by a computer (magnetic cassettes tnoj tape, memory card, flash, digital disks, Bernoulli cartridges, random access memory (RAM), read only memories (ROM), etc.).

Some of the software modules, including the operating system 35, are stored on a hard disk, a magnetic disk 29, an optical disk 31, a ROM 24 or a RAM 25. The computer 20 has a file system 36 where a recorded operating system 35 and additional software applications 37 are stored, other program modules 38 and program data 39. The user is able to enter commands and information into the personal computer 20 by means of input devices (keyboard 40, mouse manipulator 42). Other input devices (not displayed): microphone, joystick, game console, satellite dish, scanner, etc. Such input devices are, as usual, connected to the central processor 21 through a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer may be equipped with other peripheral output devices (not displayed), for example, printer speakers, etc. .

The personal computer 20 is capable of operating in a networked environment, using a logical connection with another or several remote computers 49. The remote computer (or computers) 49 are the same personal computers, servers, routers, network stations, peer devices, or another network node, and, as usual, they have most or all of the elements mentioned above when explaining the essence of the personal computer 20 shown in FIG. 5 only as a storage device 50 s when Lodges 37 '. Logical connections mean a local area network (LAN) 51 and a wide area network (WAN) 52. Such networks are common office equipment and are also used in corporate computer networks, internal networks of companies and the Internet.

When using LAN networks, the personal computer 20 is connected to the local network 51 via a network adapter or interface 53.

When using WAN networks, the personal computer 20 has a modem 54 or other means of establishing communication with a wide area network 52, such as the Internet. The modem 54, which is internal or external, is connected to the system bus 23 via the serial port 46. In a networked environment, program modules of the disclosed personal computers 20, or portions of such programs, are stored in remote storage devices. It should be clarified that the network connections are only exemplary, and are not required to display the exact network configuration of the network, i.e. in reality, there are other ways to establish a logical connection, other technical means of communication from one computer to another.

The present description sets forth the main inventive concept of the authors, which cannot be limited to those hardware devices that were mentioned earlier. It should be noted that hardware devices are primarily designed to solve a narrow problem. Over time and with the development of technological progress, such a narrow task becomes more complicated or evolves. New tools are emerging that are able to fulfill new requirements. In this sense, such hardware devices should be considered from the point of view of the class of technical problems they solve, and not purely technical implementation on some element base.

Claims (6)

1. A system for replenishing anti-virus databases by detecting unknown malicious components in a computer system, comprising: a) an event monitor designed to track events occurring in the operating system associated with the logging subsystem; b) a logging subsystem designed to detect suspicious events from events occurring in the operating system associated with the analysis module and anti-virus system; c) an analysis module designed to track the history of events that occurred during the creation of processes and child processes and to build a parent-child hierarchy associated with the antivirus system; d) an anti-virus system designed for: (i) checking executable computer files of a computer; (ii) after detecting a known malicious component, calling the analysis module to determine in which event the detected malicious component participated, using a parent-child hierarchy; (iii) creating information about the list of processes participating in the event in which the found malicious component participated, as well as created or modified files, and processes launched from such files, based on relationships in the parent-child hierarchy; (iv) termination of all active participant processes belonging to the event in which the detected malicious component participated; (v) removing or quarantining executable files that were used as part of the event in which the detected malicious component participated; while the anti-virus system is connected to the anti-virus system database update server; e) an anti-virus system database update server, designed to use information received from the anti-virus system on the list of processes participating in the event, in which the found malicious component participated, as well as created or modified files, and processes launched from such files, to replenish anti-virus databases data taking into account the detection of unknown malicious components based on the information received from the anti-virus system. 2. The system according to claim 1, in which the events occurring in the operating system are events associated with the creation, modification of executable files, changes in the system registry. 3. The system according to claim 1, in which there is additionally a backup storage subsystem associated with the event monitor and anti-virus system, designed to save files before changing them. 4. The system according to claim 4, in which the anti-virus system restores files from the backup storage subsystem when they are modified by malicious components. 5. The system according to claim 1, in which the suspicious events are those that have a certain level of danger from the point of view of the anti-virus system and are actions that include attempts to create and / or modify files in system folders, change or delete important registry branches, work with processes, downloading files from the network without warning the user. 6. The system according to claim 1, in which the anti-virus database update server updates the databases of all users after updating the anti-virus databases, taking into account the detection of unknown malicious components.