Filtering malware related content

[0001] This application is related to co-pending patent application Ser. No. 12/393,957, titled “Identifying Originators of Malware,” filed on Feb. 26, 2009, and having the same assignee (“The Identifying Originators of Malware Application.”).

[0002] This invention pertains generally to computer security, and more specifically to filtering malware related content.

[0003] Malware, such as computer viruses, worms and Trojan horses, is a serious threat to both business and personal computing. Various software vendors provide anti-malware products, which can detect, block and/or remove malware on a user's computer. Anti-malware products use various techniques to protect users from malware, such as, but not limited to, intrusion prevention, web browser defense, signature based detection, heuristic based detection and behavior based detection. When an anti-malware product detects malware, the anti-malware product can make a copy of the malware to analyze it, to learn more about both how it works and how to identify and disarm similar threats in the future. Additionally, users sometimes proactively submit suspect files to anti-malware vendors (e.g., over the Internet) to have them checked for malware. Such directly submitted files can also be analyzed by the anti-malware product.

[0004] Some commercial anti-malware products have very large foot prints in the security market. These products can receive so much detected malware and directly submitted suspected malware that limited hardware resources prevent the analysis of all of it. Therefore, such products only analyze a subset of the received malware (both detected and suspected). By not analyzing all of the received malware, important new malware could be overlooked, in favor of malware which is already well known. It would be desirable to address these issues.

[0005] A submission filtering component filters malware related content received for analysis. The submission filtering component determines an analysis priority rating for each source from which malware related content is received. An analysis priority ratings is based on various factors indicative of how likely the source is to transmit malware related content that is important to analyze. The malware filtering component transforms the received stream of malware related content into a subset to be analyzed, based on the analysis priority ratings associated with sources from which malware related content is received. A malware analysis component analyzes the subset of malware related content.

[0006] The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.

[0010] The Figures depict embodiments of the present invention for purposes of illustration only. One skilled in the art will readily recognize from the following discussion that alternative embodiments of the structures and methods illustrated herein may be employed without departing from the principles of the invention described herein.

[0011] FIG. 1 illustrates a submission filtering component 111 receiving information 109 concerning detected malware 103 from a plurality of user computers 107, according to some embodiments of the present invention. It is to be understood that although the submission filtering component 111 is illustrated in FIG. 1 as a separate entity, the submission filtering component 111 represents a collection of functionalities which can be implemented as software, hardware, firmware or any combination of these. Where the submission filtering component 111 is implemented as software, it can be implemented as a standalone program, but can also be implemented in other ways, for example as part of a larger program, as a plurality of separate programs, as a kernel loadable module, as one or more device drivers or as one or more statically or dynamically linked libraries.

[0012] As illustrated in FIG. 1, an anti-malware product 105 is installed on the computers 107 of multiple users, and checks for and detects malware 103 thereon. The anti-malware product 105 can be instantiated in any known form or combinations of forms, such as, but not limited to an intrusion prevention system, a web browser defense system and/or a signature, heuristic and/or behavior based detection system. A user computer 107 can comprise any computing device operated by a user in a business or personal context. In FIG. 1, the anti-malware product 105 is illustrated as being installed on the user computers 107 themselves, but it is to be understood that an anti-malware product 105 and/or components thereof can also be installed on a server, a proxy or other computing devices depending upon the specific installation scenario. Also, only three user computers 107 running the anti-malware product 105 are shown for the sake of illustration, but in practice typically many orders of magnitude more would be deployed.

[0013] When the anti-malware product 105 detects malware 103 installed on a user's computer 107, the anti-malware product 105 sends information 109 concerning the detection of the malware 103 to a submission filtering component 111 for subsequent analysis. The submission filtering component 111 is located at a central location, for example a server computer 113 as illustrated. The information 109 that is sent to the submission filtering component 111 concerning the malware 103 detection can, but need not, include an actual copy of the malware 103 itself. An identification of the infected computer 107 is typically included in the information 109 (or determined by the submission filtering component 111). Additionally, users that suspect a given file 115 is infected with or comprises malware 103 submit suspect files 115 to the submission filtering component 111 to be checked for malware 103. Upon receipt, the submission filtering component 111 can note information 110 concerning submitted files 115, such as the source and content.

[0014] Turning now to FIG. 2, the filtering operations of the submission filtering component 111 are explained. In conjunction with the discussion of FIG. 2, both information 109 concerning detected malware 103 and files 115 suspected to be infected with malware 103 that are received by the submission filtering component 111 are referred to as malware related content 201. As explained above, the volume of malware related content 201 received by the submission filtering component 111 can be so great that analyzing all of it is often not practicable. For this reason, the submission filtering component 111 determines which received malware related content 201 is to be analyzed, based on factors indicating the likelihood that received malware related content 201 originates from a source 203 (e.g., user computer 107, specific user of a given computer 107, a specific user of multiple computers 107, etc.) that is determined to merit closer attention (due to, e.g., location, previous rates of infection on source 203, rates of infection with new malware 103 on source 203, etc.). Additionally, as explained below in greater detail, in some embodiments the submission filtering component 111 proactively directs instances of the anti-malware product 105 running on various user computers 107 as to whether or not (and/or to what extent) to transmit malware related content 201 to the submission filtering component 111.

[0015] As illustrated in FIG. 2, the submission filtering component 111 determines an analysis priority rating 205 for each source 203 from which malware related content 201 is received. In some embodiments, the submission filtering component 111 determines analysis priority ratings 205 on a group basis (e.g., all user computers 107 and/or users at a given domain, enterprise, etc.) in addition to or instead of on an individual basis. By assigning analysis priority ratings 205 to different sources 203, the submission filtering component 111 can control which malware related content 201 is analyzed, such that priority is given to malware related content 201 received from sources 203 that are determined to be more likely to generate submissions of malware 103 of interest.

[0016] New malware 103 is less likely to have been previously analyzed than malware 103 that has already been in circulation, and is thus of greater interest.

[0017] Therefore, in some embodiments, responsive to determining that a source 203 is more likely to originate new malware 103, the submission filtering component 111 increases the analysis priority rating 205 of that computer accordingly. In different embodiments, different factors are used to determine how likely it is that a given source 203 is an originator of malware 103. For example, it is known that a disproportionate amount of malware 103 originates from certain countries (e.g., China, Lithuania, etc.). Therefore, in some embodiments, the submission filtering component 111 increases the analysis priority ratings 205 by a given amount for sources located in a suspect country. Analysis priority ratings 205 can also be lowered based on a source 203 being located in a more trusted country. The specific amount to adjust analysis priority ratings 205 based on sources 203 being located in specific countries is a variable design parameter. The submission filtering component 111 can determine in which country a source 203 is located, for example, from the country code in the uniform resource locator (URL), which can be included in the received content 201 or determined by the submission filtering component 111 from the transmission thereof.

[0018] The related co-pending Identifying Originators of Malware Application discloses technology for identifying sources 203 that are suspected of being associated with malware 103 origination. As disclosed in the Identifying Originators of Malware Application, that technology can be used to assign suspiciousness levels to sources 203, based on a variety of factors indicative of malware 103 origination, such as the history, content and context of submissions from given sources 203. In some embodiments of the present invention, the submission filtering component 111 uses the technology disclosed in the Identifying Originators of Malware Application to determine a likelihood that a given source 203 is an originator of malware 103, and adjusts the associated analysis priority rating 205 accordingly.

[0019] Other factors can also be used to adjust the analysis priority ratings 205. In one embodiment, instances of the anti-malware product 105 running on user computers 107 can monitor the behavior of the associated users, and rate how safe their network based activity is over time. For example, if a user always runs from behind a reputable firewall, scans his computer 107 for malware on a regular basis and never downloads files from unknown websites, the anti-malware product 105 could rate that user as being generally secure. On the other hand, a user that does not take such precautions would receive a lower security rating. The anti-malware product 105 could transmit the security rating for a given user as part of the malware related content 201, and the security rating could then be taken into account by the submission filtering component 111 in determining the associated analysis priority rating 205.

[0020] It is to be understood that analysis priority ratings 205 can be dynamic. In other words, the submission filtering component 111 can the adjust analysis priority rating 205 associated with a given source up or down responsive to detected and/or determined factors in real time. How suspicious specific characteristics and actions are considered to be is a variable design parameter. Additionally, what analysis priority rating 205 to assign based on various detected and/or determined factors is a variable design parameter, as is ongoing analysis priority rating 205 calculation and adjustment.

[0021] The submission filtering component 111 uses the analysis priority ratings 205 associated with the various sources 203 submitting malware related content 201 to determine which received malware related content 201 is to be analyzed. In general, a malware analysis component 207 can analyze a specific quantity of malware related content 201, based on available resources. This quantity can be defined in various ways in different embodiments of the present invention (e.g., units of storage size per period of time, percentage of amount received, specific units of storage size as corresponding resources become available, etc.) The submission filtering component 111 submits a subset 209 of the received malware related content 201 equal to the quantity to analyze to the malware analysis component 207, based on analysis priority ratings 205. In other words, if the quantity to be analyzed is, for example, 100 gigabytes per hour, the submission filtering component 111 submits, to the malware analysis component 207, per hour, the 100 gigabytes of malware related content 201 received from sources 203 with the highest analysis priority ratings 205. Whatever the quantity to be analyzed, the submission filtering component 111 submits the correspondingly sized subset 209 of the received malware content 201 with the highest analysis priority ratings 205 to the malware analysis component 207. That is to say, the submission filtering component 111 transforms the totality of the received malware related content 201 into a subset 209 for analysis, based on the associated analysis priority ratings 205. The malware analysis component 207 analyzes the subset 209 of malware related content 201.

[0022] It is to be understood that the quantity of malware related content 201 to analyze can be dynamic. In other words, the malware analysis component 207 can adjust this value up or down responsive to resource availability in real time. It is to be further understood that the malware analysis component 207 is located at a central location, for example a server computer 113 as illustrated. Note that although the malware analysis component 207 is illustrated as residing on the same server computer 113 as the submission filtering component 111, this need not be the case. Like the submission filtering component 111, the malware analysis component 207 represents a collection of functionalities which can be implemented as software, hardware, firmware or any combination of these.

[0023] FIG. 3 illustrates an embodiment of the present invention in which the submission filtering component 111 proactively transmits submission instructions 301 specifying a requested amount of malware related content 201 to instances of the anti-malware product 105 running on individual user computers 107. In this embodiment, the submission filtering component 111 determines an amount of the malware related content to receive from each source 203 (or at least from some sources 203), based on the quantity to be analyzed and the analysis priority ratings 205 of the various sources 203. The submission filtering component 111 transmits corresponding submission instructions 301 to instances of the anti-malware product 105 running on individual user computers 107. The submission instructions 301 specify how much malware related content to submit (e.g., none, up to a specific number of storage units per period of time, all available, etc.), depending upon the corresponding analysis priority rating(s) 205. The instances of the anti-malware product 105 that receive submission instructions 301 submit malware related content 201 to the submission filtering component 111 according to the submission instructions 301. This prevents a certain amount of unnecessary transmission and processing of malware related content 201 that would not be analyzed even if it were transmitted to the submission filtering component 111.

[0024] In some embodiments, the submission filtering component 111 passes all malware related content 201 received from instances of the anti-malware product 105 according to submission instructions 301 to the malware analysis component 207. In other embodiments, the submission filtering component 111 still determines a subset 209 thereof to submit for analysis, for example where the amount received still exceeds the quantity to analyze. Note that in some embodiments the submission filtering component 111 transmits submission instructions 301 to all deployed instances of the anti-malware product 105, whereas in other embodiments only a subset thereof receive such submission instructions 301.

[0025] As will be understood by those familiar with the art, the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Likewise, the particular naming and division of the portions, modules, agents, managers, components, functions, procedures, actions, layers, features, attributes, methodologies, data structures and other aspects are not mandatory or significant, and the mechanisms that implement the invention or its features may have different names, divisions and/or formats. Additionally, software components of the present invention are in no way limited to implementation in any specific programming language, or for any specific operating system or environment. Furthermore, it will be readily apparent to those of ordinary skill in the relevant art that where components of the present invention are implemented in whole or in part in software, the software components thereof can be stored as program code on computer readable storage media as computer program products. Any form of tangible computer readable storage medium can be used in this context, such as magnetic or optical storage media. As used herein, the term “computer readable storage medium” does not mean an electrical signal separate from an underlying physical medium. Additionally, software components of the present invention can be instantiated (for example as object code or executable images) within the memory of any computing device, such that the software component(s) cause(s) the computing device to perform corresponding functionality. As used herein, the terms “computer,” “server” and “computing device” mean one or more computers configured and/or programmed to execute the described functionality. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims.