RU2660643C1 - System and method of detecting the harmful cil-file - Google Patents

Abstract

FIELD: information technology.

SUBSTANCE: invention relates to solutions for identifying malicious applications. Method of detecting an analyzed file containing translated code from high-level languages to intermediate language, malicious, where a set of lines from the analyzed file are selected, calculate the hash of a set of selected rows, reveal the degree of similarity of a set of selected lines of the analyzed file with sets of selected lines of known malicious files, make a decision about the severity of the analyzed file.

EFFECT: increase the safety of the user on the computing device.

5 cl, 3 dwg

Description

Technical field

The invention relates to solutions for detecting malicious applications, and more particularly to systems and methods for detecting malicious CIL files.

State of the art

Currently, the number of files stored on computing devices is growing. Computers and mobile devices of users operate under various operating systems (OS), contain various installed applications and user files. In addition, applications and components of the operating system are regularly updated, as a result of which the same component may have different versions for different users. Also becoming increasingly popular is the .NET platform offered by Microsoft. Many applications adapt to this technology. One of the key features of the .NET platform is that regardless of the high-level language of the .NET platform that is used to create the application, the compiler converts the source code into the Microsoft intermediate language (Microsoft Intermediate Language, MSIL), which is a processor-independent set instructions that can be effectively converted to machine code.

It is worth noting that the number of malicious software (for example, computer viruses, trojans, network worms) is also growing. Often malicious cybercriminals also use the .NET platform.

Security applications (for example, anti-virus applications) use various methods for detecting malicious software, including methods for analyzing files created using the .NET platform.

So, publication US9384364 describes the technology of adding .NET platform assemblies containing CIL code to the white list (English whitelist). On the basis of one assembly on each separate device, its own image is formed (Image) - a precompiled assembly in which the CIL code is already compiled into executable machine code, while the image is not a PE file, the PE header of the image acts as a container for the executable code. These images are machine-dependent, and a unique assembly image is generated for each device configuration, therefore, one parent assembly has many descendant images. The emerging problem is a significant number of uncategorized child images against the background of a smaller number of categorized parent assemblies. The technology mentioned uses assembly metadata to determine the relationship between a categorized parent assembly and a non-categorized child image. When such a relationship is established, the descendants receive the parent category (in particular, if the parent assembly is in the white list, the child image will also be in the white list).

The proposed solution differs from the existing ones in that it uses static analysis to detect the harmfulness of the CIL file. It is well known that static analysis methods are much faster than heuristic analysis methods, which saves the computing resources of the system on which the CIL file is checked, and also reduces the time required to check the harmfulness of the CIL file.

SUMMARY OF THE INVENTION

The technical result of the present invention is to increase the security of the user on the computing device, which is achieved by the detection of malicious CIL files.

Another technical result of the present invention is the implementation of the claimed purpose.

According to one embodiment, a method is provided for detecting an analyzed file containing translated code from high-level languages into an intermediate language as malicious, in which a set of lines is extracted from the analyzed file using the resource allocation tool; using a hash calculator, a hash of a set of selected rows is calculated; using the analysis tool, the degree of similarity of the set of selected lines of the analyzed file with the sets of selected lines of known malicious files containing translated code from high-level languages to an intermediate language is revealed by comparing hashes, and the degree of similarity is a numerical probabilistic value, the higher the higher the higher the similarity of the sets of highlighted lines of the analyzed file and the known malicious file; if the degree of similarity of the said sets of highlighted lines of the analyzed file exceeds a threshold value, a decision is made on the harmfulness of the said file based on the results of the comparison.

According to another embodiment, a method is provided in which randomly generated rows are excluded from a selected set of rows.

In one particular embodiment, a method is provided in which a perceptual hash is calculated.

In one particular embodiment, a method is provided in which a perceptual hash is computed using a discrete cosine transform.

According to one particular embodiment, a method is provided in which a degree of similarity is calculated using a Hamming distance.

Brief Description of the Drawings

Additional objectives, features and advantages of the present invention will be apparent from reading the following description of an embodiment of the invention with reference to the accompanying drawings, in which:

FIG. 1 shows the structure of a system for detecting malicious CIL files.

FIG. 2 displays a method for detecting malicious CIL files.

FIG. 3 is an example of a general purpose computer system on which the present invention may be implemented.

Description of Embodiments

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The essence described in the description is nothing more than the specific details provided to assist the specialist in the field of technology in a comprehensive understanding of the invention, and the present invention is defined only in the scope of the attached claims.

We introduce a number of definitions and concepts that will be used in the description of embodiments of the invention.

CIL file - an executable file created by a compiler supporting the .NET platform, while containing translated code from high-level languages (for example, the .NET platform) to the CIL intermediate language (English Common Intermediate Language). In general, a CIL file is a named data area on a storage medium. In a particular embodiment, the CIL file is a contiguous memory area containing translated code from high-level languages of the .NET platform to the intermediate CIL language.

System means in the present invention are understood to be real devices, systems, components, groups of components implemented using hardware such as integrated circuits (application-specific integrated circuit, ASIC) or programmable gate arrays (English field-programmable gate array , FPGA), or, for example, in the form of a combination of software and hardware, such as a microprocessor system and a set of software instructions, as well as on neuromorphic chips (English neurosynaptic chips) The functionality of these system tools can be implemented exclusively in hardware, as well as in the form of a combination, where part of the functionality of the system is implemented in software, and part in hardware. In some embodiments, part of the means, or all means, may be executed on a processor of a general-purpose computer (for example, which is shown in Fig. 3). In this case, the components (each of the means) of the system can be implemented within the framework of a single computing device, or distributed between several connected computing devices.

Figure 1 shows the structure of a system for detecting malicious CIL files.

The system for detecting malicious CIL files is part of a security application 140 (for example, an anti-virus application) and comprises a resource allocation tool 110, a hash calculator 120, and an analysis tool 130. In general, the security application 140 is executed on a computing device. Security application 140 detects the CIL file 180, the analysis of which must be performed (hereinafter referred to as the analyzed CIL file), and transfers it to the resource allocation tool 110. In one embodiment, security application 140 detects the CIL file 180 for analysis. which does not have a digital signature from a trusted certification authority. In another embodiment, the security application 140 detects for analysis a CIL file 180 whose size or checksum has changed.

In one embodiment, the resource allocator 110 is executed on a user device. In another embodiment, the resource allocator 110 is executed on a remote server or as a cloud service. Resource allocator 110 is for allocating resources from a parsed CIL file. In general, the resource allocator 110 extracts lines from the resource area of the CIL file. In one embodiment, the resource allocator 110 allocates strings consisting of ANSI characters. In yet another embodiment, the resource allocator 110 determines the linguistic language in which said highlighted lines are composed. After extracting said lines, resource allocator 110 determines, using prior art filters, which of the selected ANSI lines are randomly generated. In the general case, strings generated by random methods are excluded by the resource allocation tool 110 from further analysis of the analyzed CIL file.

A set of allocated ANSI strings that have not been excluded is transmitted by the resource allocator 110 to the hash calculator 120.

In one embodiment, the hash calculator 120 is executed on a user device. In another embodiment, the hash calculator 120 is executed on a remote server or as a cloud service. The hash calculator 120 is intended to calculate the perceptive hash of a set of selected ANSI lines of the analyzed CIL file 180 received from the resource allocator 110. The perceptive hash is a hash calculated in a way designed to create comparable hashes.

Methods for computing perceptual hashes are known in the art. An example of calculating a perceptual hash by means of computing a hash 120 may be a method using a discrete cosine transform (DCT, English Discrete Cosine Transform, DCT).

Let x [m], where m = 0, ..., (N - 1) is a set of strings of length N.

In this case, DCT can be defined as

This expression can be rewritten as

where c [n, m] is an element of the DCT matrix at the intersection of a row with number n and a column with number m.

DCT matrix is defined as

In one embodiment of the DCT, the matrix can be calculated in advance for any desired row length. Thus, DCT can be represented as

DCT = M × I × M '

where: M - DCT matrix, I - a set of rows of square size, M '- inverse matrix.

It is worth noting that low-frequency DCT coefficients are most stable to string manipulations, since most of the information is usually concentrated in several low-frequency coefficients.

In this example, the matrix I is a set of selected ANSI strings, which is padded to a square size (the length of the rows is the number of rows, the length is padded with zero characters, empty lines are filled with zero characters). Further, the matrix I is compressed to a size of 32 × 32. In one embodiment, various filters known in the art may be applied to matrix I by means of comparison. The result is a matrix I ', in the upper left corner of which there are low-frequency coefficients, while in one embodiment, a hash calculator 120 extracts a block of 8 × 8 values from the upper left corner (for example, integer values of ANSI characters). Next, the average value for all 64 values is calculated. In the next step, a sequence of 64 bits is created, and for each of 64 values, the corresponding bit is set or reset, depending on whether the value for this bit is greater or less than the average value. In the last step, a perceptual hash is computed, with 64 individual bits converted to a 64-bit value. The order of precedence of the bits does not matter.

The calculated perceptual hash (64-bit value) of the hash calculator 120 passes to the analysis tool 130. In one embodiment, the perceptual hashes of the extracted ANSI strings of known malicious CIL files can be calculated by the hash calculator 120 earlier and stored in the database 190, with this, database 190 also stores the identifier of a known malicious CIL file corresponding to the computed perceptual hash. Moreover, the analysis of known malicious CIL files for malware was carried out earlier by any of the methods known from the prior art, or a combination thereof

In one embodiment, the analysis tool 130 is performed on a user device. In another embodiment, the analysis tool 130 runs on a remote server or as a cloud service. The analysis tool 130 is intended to detect the harmfulness of the analyzed CIL file 180 based on the results of comparing the perceptual hash calculated by the hash calculator 120 of the set of selected ANSI strings of the analyzed file 180 with the perceptual hashes of known malicious CIL files.

In one embodiment, for comparison, the degree of similarity between the sets of selected ANSI strings of the analyzed CIL file 180 and the known malicious CIL file is calculated. In general, the degree of similarity is a numerical probabilistic value, the higher which, the higher the similarity of the sets of selected ANSI strings. In general, the Hamming distance is used to calculate the degree of similarity, using the number of different bits in perceptual hashes to compare. Zero distance means that the sets of selected ANSI strings are probably the same, while the degree of similarity of the sets of compared selected ANSI strings is 1. Distance 5 means that the sets of selected ANSI strings are different, but similar, the degree of similarity high (e.g. 0.75). If the distance is 10 or more, then these are probably completely different sets of selected ANSI strings, the degree of similarity is low (for example, 0.1). In one embodiment, the values of correspondence of the degree of similarity to the Hamming distance can be stored in the database 190. In another embodiment, the comparator 110 uses a threshold value (for the degree of similarity or for the Hamming distance). In another embodiment, the closest Hamming distance perceptual hashes of known malicious CIL files by means of comparison 110 are combined into generic hashes by bitwise union of perceptual hashes.

This can be useful in case of highlighting a group of similar CIL files, if known malicious CIL files (or a family of malicious CIL files) update the ANSI string set from version to version, while the ANSI string set does not change much, but storage all sets of ANSI strings (and, accordingly, comparison with all sets of ANSI strings) corresponding to all versions of a known malicious CIL file is impractical.

If the threshold value is exceeded (for example, the threshold value 0.9, the calculated degree of similarity is 0.99), the ANSI string sets are considered similar, the analysis tool 130 decides that the analyzed CIL file 180 is malicious.

In the General case, the decision about the harmfulness of the analyzed CIL file 180, the analysis tool 130 passes to the security application 140.

Security application 140, in the event of a decision on the harmfulness of the analyzed CIL file 180 from analysis tool 130, performs an action to ensure the security of the computing device. In one embodiment, the security application 140 deletes the parsed CIL file 180. In another embodiment, the security application 140 deletes the parsed CIL file 180 in quarantine. In yet another embodiment, the security application 140 blocks the activity of the CIL file 180, for example, network or file activity.

FIG. 2 displays a method for detecting malicious CIL files.

At step 210, using a resource allocation tool 110, a set of lines is extracted from the analyzed file 180, while the analyzed file contains translated code from high-level languages to an intermediate language. In general, the analyzed file is a CIL file. In one implementation, strings in ANSI format are allocated.

In one embodiment, the resource allocator 110 excludes randomly generated rows from the selected rowset.

At step 220, a hash calculator 120 calculates the perceptual hash of the set of selected rows.

In one embodiment, the perceptual hash is computed by hash calculator 120 using a discrete cosine transform.

At step 230, using the analysis tool 130, the degree of similarity of the set of selected lines of the analyzed file 180 to the sets of selected lines of known malicious files is determined by comparing perceptual hashes, the degree of similarity being a numerical probabilistic value, the higher which, the higher the similarity of the sets of selected lines of the mentioned file and famous file.

At step 240, using the analysis tool 130, a harmful decision is made based on the results of the comparison. If the degree of similarity of the said set of highlighted lines of the analyzed file 180 exceeds a threshold value, the analyzed file 180 is recognized by the analysis tool 130 as malicious.

FIG. 3 represents an example of a general purpose computer system, a personal computer or server 20 comprising a central processor 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processor 21. The system bus 23 is implemented as any prior art bus structure comprising, in turn, a bus memory or a bus memory controller, a peripheral bus and a local bus that is capable of interacting with any other bus architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input / output system (BIOS) 26, contains basic procedures that ensure the transfer of information between the elements of the personal computer 20, for example, at the time of loading the operating ROM systems 24.

The personal computer 20 in turn contains a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29, and an optical drive 30 for reading and writing to removable optical disks 31, such as a CD-ROM, DVD -ROM and other optical information carriers. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 through the interface of the hard disk 32, the interface of the magnetic disks 33 and the interface of the optical drive 34, respectively. Drives and associated computer storage media are non-volatile means of storing computer instructions, data structures, software modules and other data of a personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that can store data in a form readable by a computer (solid state drives, flash memory cards, digital disks, random access memory (RAM), etc.) that are connected to the system bus 23 through the controller 55.

Computer 20 has a file system 36 where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38, and program data 39. The user is able to enter commands and information into personal computer 20 via input devices (keyboard 40, keypad “ the mouse "42). Other input devices (not displayed) can be used: microphone, joystick, game console, scanner, etc. Such input devices are, as usual, connected to the computer system 20 via a serial port 46, which in turn is connected to the system bus, but can be connected in another way, for example, using a parallel port, a game port, or a universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer can be equipped with other peripheral output devices (not displayed), for example, speakers, a printer, etc. .

The personal computer 20 is capable of operating in a networked environment, using a network connection with another or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the creature the personal computer 20 of FIG. 3. Other devices, such as routers, network stations, peer-to-peer devices, or other network nodes may also be present on the computer network.

Network connections can form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal networks of companies and, as a rule, have access to the Internet. In LAN or WAN networks, the personal computer 20 is connected to the local area network 50 via a network adapter or network interface 51. When using the networks, the personal computer 20 may use a modem 54 or other means of providing communication with a global computer network such as the Internet. The modem 54, which is an internal or external device, is connected to the system bus 23 via the serial port 46. It should be clarified that the network connections are only exemplary and are not required to display the exact network configuration, i.e. in reality, there are other ways to establish a technical connection between one computer and another.

In conclusion, it should be noted that the information provided in the description are examples that do not limit the scope of the present invention defined by the claims. One skilled in the art will recognize that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

Claims (9)

1. A method for identifying an analyzed file containing translated code from high-level languages to an intermediate language, malicious, in which: - using the resource allocation tool, a set of lines is extracted from the analyzed file; - using the hash calculator, the hash of the set of selected lines is calculated; - using the analysis tool, the degree of similarity of the set of selected lines of the analyzed file with the sets of selected lines of known malicious files containing translated code from high-level languages to an intermediate language is revealed by comparing hashes, while the degree of similarity is a numerical probability value, the higher which, the higher similarity of the sets of selected lines of the analyzed file and the known malicious file; - in the event that the degree of similarity of the said sets of highlighted lines of the analyzed file exceeds a threshold value, a decision is made on the harmfulness of the said file based on the comparison results. 2. The method of claim 1, wherein randomly generated rows are excluded from the selected rowset. 3. The method of claim 1, wherein the perceptual hash is calculated. 4. The method of claim 3, wherein the perceptual hash is computed using a discrete cosine transform. 5. The method of claim 1, wherein the degree of similarity is calculated using the Hamming distance.

Images