# US 10,313,366 B1 · Retroactive identification of previously unknown malware based on network traffic analysis from a sandbox environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,366 B1 - Document ID: US10313366B1 - Status: Granted - Kind: B1 - Application number: 15/274,127 - Filed: 2016-09-23 - Granted: 2019-06-04 - Earliest claimed: 2016-09-23 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Erik M. Heuser - Web page: https://patentgrep.com/patent/US10313366B1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - H04L 63/1433: {Vulnerability analysis} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 2221/033: Test or assess software - H04L 2463/121: Timestamp - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques are provided for retroactively identifying malware programs when new signatures become available that later match network traffic previously obtained from the sandbox environment. An exemplary method comprises obtaining a plurality of packet capture files comprising previously captured network communications of malware programs that previously executed in a sandbox environment, wherein each of the packet capture files are associated with a corresponding malware program that generated the network communications; obtaining signatures indicative of at least one malware program; comparing the signatures to the packet capture files; and retroactively identifying a given malware program as malware if a signature matches a given packet capture file associated with the given malware program. A plurality of malware samples that were previously unidentified are optionally correlated with the given malware program based on a scan of additional packet capture files for the signature that matched the given packet capture file. ## Claims ### Claim 1 A method, comprising: obtaining a plurality of packet capture files comprising previously captured network communications of a plurality of malware programs that previously executed, relative to the obtaining of the plurality of packet capture files, in a sandbox environment, wherein each of said packet capture files is associated with a corresponding malware program that generated said network communications, wherein the packet capture files comprise at least a portion of the network communications of the corresponding malware program while executing in the sandbox environment; obtaining one or more signatures indicative of at least one of said malware programs; comparing, subsequent to the obtaining of the plurality of packet capture files, said one or more signatures to said plurality of packet capture files; and identifying, subsequent to the comparing, a given previously executed malware program as malware if one of said signatures matches a given packet capture file associated with said given malware program, wherein the previous execution of the given malware program is relative to the obtaining of the plurality of packet capture files. ### Claim 2 (depends on 1) The method of claim 1, further comprising the step of updating a table identifying known malware programs to include one or more of an identifier of said given malware and a hash of said given malware. ### Claim 3 (depends on 2) The method of claim 2, further comprising the step of updating said table identifying known malware programs to further include one or more of said one of said signatures that matched said given packet capture file and a current timestamp. ### Claim 4 (depends on 2) The method of claim 2, further comprising the step of storing said table identifying known malware programs in a format that can be queried by a user. ### Claim 5 (depends on 1) The method of claim 1, further comprising the step of correlating a plurality of malware samples that were previously unidentified with said given malware program based on a scan of additional packet capture files for said one of said signatures that matched said given packet capture file. ### Claim 6 (depends on 1) The method of claim 1, wherein said one or more signatures are each mapped to a corresponding one of said malware programs. ### Claim 7 (depends on 1) The method of claim 1, wherein said one or more signatures indicative of said at least one of said malware programs are obtained from an analyst that identified said one or more signatures. ### Claim 8 A computer program product, comprising a non-transitory machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps: obtaining a plurality of packet capture files comprising previously captured network communications of a plurality of malware programs that previously executed, relative to the obtaining of the plurality of packet capture files, in a sandbox environment, wherein each of said packet capture files is associated with a corresponding malware program that generated said network communications, wherein the packet capture files comprise at least a portion of the network communications of the corresponding malware program while executing in the sandbox environment; obtaining one or more signatures indicative of at least one of said malware programs; comparing, subsequent to the obtaining of the plurality of packet capture files, said one or more signatures to said plurality of packet capture files; and identifying, subsequent to the comparing, a given previously executed malware program as malware if one of said signatures matches a given packet capture file associated with said given malware program, wherein the previous execution of the given malware program is relative to the obtaining of the plurality of packet capture files. ### Claim 9 (depends on 8) The computer program product of claim 8, further comprising the step of updating a table identifying known malware programs to include one or more of an identifier of said given malware and a hash of said given malware. ### Claim 10 (depends on 9) The computer program product of claim 9, further comprising the step of updating said table identifying known malware programs to further include one or more of said one of said signatures that matched said given packet capture file and a current timestamp. ### Claim 11 (depends on 9) The computer program product of claim 9, further comprising the step of storing said table identifying known malware programs in a format that can be queried by a user. ### Claim 12 (depends on 8) The computer program product of claim 8, further comprising the step of correlating a plurality of malware samples that were previously unidentified with said given malware program based on a scan of additional packet capture files for said one of said signatures that matched said given packet capture file. ### Claim 13 (depends on 8) The computer program product of claim 8, wherein said one or more signatures are each mapped to a corresponding one of said malware programs. ### Claim 14 (depends on 8) The computer program product of claim 8, wherein said one or more signatures indicative of said at least one of said malware programs are obtained from an analyst that identified said one or more signatures. ### Claim 15 A system, comprising: a memory; and at least one processing device, coupled to the memory, operative to implement the following steps: obtaining a plurality of packet capture files comprising previously captured network communications of a plurality of malware programs that previously executed, relative to the obtaining of the plurality of packet capture files, in a sandbox environment, wherein each of said packet capture files is associated with a corresponding malware program that generated said network communications, wherein the packet capture files comprise at least a portion of the network communications of the corresponding malware program while executing in the sandbox environment; obtaining one or more signatures indicative of at least one of said malware programs; comparing, subsequent to the obtaining of the plurality of packet capture files, said one or more signatures to said plurality of packet capture files; and identifying, subsequent to the comparing, a given previously executed malware program as malware if one of said signatures matches a given packet capture file associated with said given malware program, wherein the previous execution of the given malware program is relative to the obtaining of the plurality of packet capture files. ### Claim 16 (depends on 15) The system of claim 15, further comprising the step of updating a table identifying known malware programs to include one or more of an identifier of said given malware and a hash of said given malware. ### Claim 17 (depends on 16) The system of claim 16, further comprising the step of updating said table identifying known malware programs to further include one or more of said one of said signatures that matched said given packet capture file and a current timestamp. ### Claim 18 (depends on 15) The system of claim 15, further comprising the step of correlating a plurality of malware samples that were previously unidentified with said given malware program based on a scan of additional packet capture files for said one of said signatures that matched said given packet capture file. ### Claim 19 (depends on 15) The system of claim 15, wherein said one or more signatures are each mapped to a corresponding one of said malware programs. ### Claim 20 (depends on 15) The system of claim 15, wherein said one or more signatures indicative of said at least one of said malware programs are obtained from an analyst that identified said one or more signatures.