BACKGROUND

Technical Field

The present invention relates to a provenance-based threat detection tool and method, and more particularly a provenance-based threat detection tool and method that identifies fileless attacks in real-time and stops them from completing an attack.

Description of the Related Art

Traditional threat detection tools and techniques such as Antivirus (AV) scanners identify a threat and stop it from acting by looking for specific Indicator(s) of Compromise (IoC). A new genus of malware has emerged recently that breaks the rules of traditional threat detection software such as anti-virus. Unlike other types of malware that require the installation of software on a victim's machine, fileless malware infects a victim host's random access memory (RAM). Fileless malwares has been defined by some as “malware that does not store its body directly onto a disk.” It is very challenging to detect fileless malware using conventional threat detection tools that rely on file signatures because fileless attacks can evade the traditional detection tool by using the victim host's dynamic memory and otherwise legitimate tools to compromise host. This “stealthy malware” uses various techniques to impersonate or use applications and legitimate system tools that can minimize its footprint in a targeted system and be on anti-virus “white lists.” “Living off the land” has been a popular trend in cyberattacks over the last few years. It is characterized by the usage of trusted off-the-shelf applications and pre-installed system tools to conduct such stealthy attacks. Since many of these tools are used by system administrators for legitimate purposes, it is harder for the defenders to completely block access to these tools for attack prevention. Stealthy malware can hide the malware's (or an attacker's) identity by impersonating these well-trusted benign processes. Even security approaches that do not use file signatures for detection can have a hard time discovering elusive fileless attacks. To detect “stealthy” or fileless malware, enterprises need a new approach that doesn't rely on malware signatures, analyzing files written to disk, and learning from what past malware looks like and how it behaves.

Although named “fileless”, such malware might not be 100% file-free. They may still rely on files in some stages of a whole attack campaign. Fileless attacks can be completely fileless, such that the attack never involves writing a file on a disk of a computer system, indirectly uses files on a disk, or have some sort of fileless persistence but not without using files to operate. A key feature of “file-less” malware is that it does not expose its malicious code directly in a stored file or executable. That is fileless malware does not expose malicious features on hard disks. These attacks usually do not touch the disk, and do not trigger antivirus file scanning.

There are multiple ways to execute file-less malware. One way is to take advantages of the vulnerability of benign software. For example, CVE-2019-0541 allows adversaries to execute arbitrary code in Internet Explorer® (IE) through a specially crafted web page. A second example is taking advantages of the script interpreters, such as PowerShell or Windows Management Instrumentation (WMI). A third example is to use a “not malicious” malware that injects malicious code to a benign process's memory. For example, Reflective DLL Loading is a method to accomplish memory injection.

In various instances, the initial penetration vector can be spear-phishing attacks using social engineering directed towards top-level management, including CIOs. Attackers can embed scripts in benign documents like text documents, such as a resume, customer complaint, etc., to run their malicious payload. Worse, the operating system can open access to its core functionalities via various language interfaces (e.g., PowerShell and .Net) that an attacker could take advantage of. Such dynamic languages facilitate execution of malicious logic on-the-fly, leaving little or no footprints on the filesystem. Downloaded PowerShell scripts can be obfuscated and resided only in memory. The attacks can be DLL sideloading attack in various application software. The attack can also be an advanced persistent threat (APT). Lockdown approaches, such as application control, may not help much because fileless malware leverages administrative tools and other applications that are typically in a company's whitelist of known “good” or “benign” applications.

Data provenance can provide the contextual information about applications and data. A provenance-aware system automatically gathers and reports metadata that describes the history of each object being processed on the system. Data provenance can describe the actions taken on a data object from its creation to the present time, which can allow users to understand how data objects came to exist in their present state.

SUMMARY

According to an aspect of the present invention, a computer implemented provenance-based threat detection method is provided for detecting stealthy malware. The method includes building a provenance graph including a plurality of paths using a processor device from provenance data obtained from one or more computer systems and/or networks. The method further includes sampling the provenance graph to form a plurality of linear sample paths, and calculating a regularity score for each of the plurality of linear sample paths using a processor device. The method further includes selecting a subset of linear sample paths from the plurality of linear sample paths based on the regularity score, and embedding each of the subset of linear sample paths by converting each of the subset of linear sample paths into a numerical vector using a processor device. The method further includes detecting anomalies in the embedded paths to identify malicious process activities, and terminating a process related to the embedded path having the identified malicious process activities.

According to another aspect of the present invention, a system is provided for provenance-based threat detection. The system includes a computer system including random access memory configured to store a provenance-based threat detection tool, and one or more processor devices and an operating system having a kernel, wherein one or more hook functions operating in the kernel are configured to collect provenance data. The system further including a database configured to store the provenance data collected by the one or more hook functions, wherein the provenance-based threat detection tool is configured to build a provenance graph including a plurality of paths using the one or more processor devices from provenance data obtained from the computer systems and/or a network; sample the provenance graph to form a plurality of linear sample paths; calculate a regularity score for each of the plurality of linear sample paths using the one or more processor devices; select a subset of linear sample paths from the plurality of linear sample paths based on the regularity score; embed each of the subset of linear sample paths by converting each of the subset of linear sample paths into a numerical vector using the one or more processor devices; detect anomalies in the embedded paths to identify malicious process activities; and terminate a process related to the embedded path having the identified malicious process activities.

According to another aspect of the present invention, a non-transitory computer readable storage medium comprising a computer readable program for a computer implemented provenance-based threat detection tool, wherein the computer readable program when executed on a computer causes the computer to perform the computer implemented provenance-based threat detection method.

These and other features and advantages will become apparent from the following detailed description of illustrative embodiments thereof, which is to be read in connection with the accompanying drawings.

