Trend Micro Inc.

Xinfeng Liu

Qiang Huang

Xiaochuan Wan

Xuewen Zhu

Ben Huang

Xuebin Chen

Min Zhang

Hu Cao

Yuefeng Li

A malware detection system for evaluating sample programs for malware incorporates an evasion code detector. The evasion code detector includes semantic patterns for identifying conditional statements and other features employed by evasion code. The system inserts breakpoints at conditional statements, compares expected and actual evaluated values of conditional variables of the conditional statements, and changes the execution path of the sample program based on the comparison. Changing the execution path of the sample program to an expected execution path counteracts the evasion code, allowing for the true nature of the sample program to be revealed during runtime.

Anti-malware system with evasion code detection and rectification

A sandbox system includes a mixed analysis engine that allows for dynamic and static analysis of a sample process for malware. The sample process is executed in a virtual machine and interrupted to allow the mixed analysis engine to identify functions that are called by malware to perform a malicious behavior. The functions are correlated to identify a behavior node that is indicative of the malicious behavior, and behavior nodes are correlated to identify a behavior net. The behavior net is scored to determine if the sample process is malware.

Mixed analysys-based virtual machine sandbox

Tablet computers send relevant geographic and identification data to an application server (one of the tablets, or a local or remote server) which groups them to form a video wall. Once placed next to one another in substantially the same plane, the tablets snap photographs at more or less the same time and these images are transmitted to the application server. The server determines the relative positions of the tablets and then streams a portion of a video or digital image to each of the tablets in order that all tablets display the video or image in an integrated fashion. The tablets may operate independently or may rely upon the remote application server. Relative positions are determined by analyzing features and determining an up-down or left-right relationship between pairs of images, sorting images into vertical and horizontal rows, and placing the images into a grid.

Detection of relative positions of tablet computers

An application document known to include malware (such as a document exploit) is opened and executed by its corresponding software application. Behaviors of this document (such as registry, file system, network and process) are monitored and recorded using internal software drivers and hook modules. A behavior report is generated and a baseline pattern is created including a number of regular expressions. A suspicious document of the same type as the monitored document is opened and executed by the same corresponding software application. Behaviors are monitored in the same way and a behavior report is generated. This behavior report is compared to the baseline pattern and a determination is made as to whether a document exploit is present. Known benign documents may also be opened, monitored and their behavior recorded, resulting in creation of a known benign pattern for the corresponding software application.

Document exploit detection using baseline comparison

A single virtual machine is implemented upon a computer and an operating system executes within this virtual machine. A sample file suspected of being malware is received and any number of versions of the software application corresponding to the sample file are installed. Each version of the software application is executed within the operating system, each version opening the sample file. Behavior of each version and of the sample file is collected while each version is executing. A score indicating malicious behavior for each version with respect to the sample file is determined and reported. The versions may execute serially in the happening system, each version terminating before the next version begins executing. Or, all versions may execute concurrently within the operating system. Files and registries are hidden to facilitate installation. System information is changed to facilitate execution.

Multiple application versions in a single virtual machine

Computers are protected against virtual machine exploits. A computer includes an exploit monitor for a virtual machine running in the computer. Loading of a virtual machine program in the virtual machine triggers the exploit monitor to modify the virtual machine program after the virtual machine program is loaded in the virtual machine but before the virtual machine program is executed in the virtual machine. The modification includes adding monitoring code, such as one or more checkpoints, in the virtual machine program. When the monitoring code is reached during execution of the virtual machine program in the virtual machine, the virtual machine program is evaluated to determine whether or not the virtual machine program is a virtual machine exploit.

Growing community of inventors

Nanjing, China

Xinfeng Liu