METHOD OF DETECTING MALICIOUS FILES RESISTING ANALYSIS IN AN ISOLATED ENVIRONMENT
FIG2 shows a block diagram of the activity monitoring module, in accordance with exemplary aspects of the present disclosure
In one example, the security module 110 and the hypervisor 115 of virtual machine 120 are implemented on the computing device of the user. In some examples, the hypervisor 115 controls the operation of the virtual machine 120. In the given case, the security module 110 is a security application, such as an antivirus application. An example of the security module 110 is the security module 210 (or second security module), discussed further with respect to FIG2. In another case, the security module 110 and the hypervisor 115 are implemented on a remote server (or on different servers), or as a cloud service. The security module 110 in this case obtains the file 100 from third party sources (for example, from the security module 210 running on the computing devices of a user), and transfers the file 100 to the virtual machine 120, where the file 100 may be opened. In yet another case, the security module 110 obtains the file from other security modules carrying out the monitoring and intercepting of network traffic data. FIG2 shows an example of the proposed method of recognizing a file as malicious. In the context of the present disclosure, for each file 100 being analyzed with the use of the virtual machine 120 and for which no verdict has been given with regard to its maliciousness, the security module 110 forms a unique behavior template 220 from the log 150, which includes, as mentioned above, all or at least some of the security-related events saved by the intercept module 130 in the log 150. This behavior template is then used by the security module 210 which provides protection to the computer system 200.
block diagram
210
security module
230
activity monitoring module
220
behavior template
100
file
200
computer system
['1. A method for recognizing a file as malicious, comprising: intercepting a file for analysis received at a computing device of a user; opening the file for analysis in an environment for safe execution; generating a log that stores a portion of information occurring during opening of the file for analysis in the environment for safe execution; analyzing the log to recognize a first set of security related events from the portion of information; tracking a second set of security related events when the file for analysis is opened on the computing device; comparing the second set of security related events and the first set of security related events to identify a discrepancy; and in response to identifying the discrepancy, recognizing the file under analysis as malicious.', '2. The method according to claim 1, further comprising: forming a behavior template based on the first set of security related events; calculating a coefficient of danger of the file under analysis based on events from the behavior template; increasing the coefficient of danger for each event found in the second set of security related events that is not found in the first set of security related events; and recognizing the file under analysis is malicious when the coefficient of danger exceeds a threshold value.']