Back to results
US 10,313,370 B2Granted
Generating malware signatures based on developer fingerprints in debug information
AssigneePalo Alto Networks, Inc.
InventorZihang Xiao
Life of this patent
Estimating the term…
Abstract
Techniques for generating malware signatures based on developer fingerprints in debug information are disclosed. In some embodiments, a system, process, and/or computer program product for generating malware signatures based on developer fingerprints in debug information includes receiving a sample, in which the sample includes a binary executable file; matching one or more paths in content of the binary executable file based on a plurality of patterns; extracting meta information from the one or more matched paths; and automatically generating a signature based on the extracted meta information.
Claims20
A system, comprising:
- a processor configured to:
- receive a sample, wherein the sample includes a binary executable file;
- match one or more specific file paths in content of the binary executable file based on a plurality of pre-defined patterns, wherein each of the one or more specific file paths is associated with a development environment, a development project's profile, and/or other meta information associated with a malware author, comprising to:
- extract a first string from the binary executable file, wherein the first string relates to debug information of the binary executable file;
- determine whether a specific file path associated with the first string matches a pattern of the plurality of pre-defined patterns, the pattern including a regular expression;
- and
- in response to a determination that the specific file path matches the pattern, determine that the specific file path is a matched specific file path;
- extract meta information from the one or more matched specific file paths, wherein the extracted meta information includes extracted strings or fields that are not executable code;
- automatically generate a signature based on the one or more matched specific file paths and the extracted meta information;
- and
- send the signature to a firewall device or a host agent, wherein the firewall device or the host agent can perform an action based on the signature;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
10 more elements
A method, comprising:
- receiving a sample, wherein the sample includes a binary executable file;
- matching one or more specific file paths in content of the binary executable file based on a plurality of pre-defined patterns, wherein each of the one or more specific file paths is associated with a development environment, a development project's profile, and/or other meta information associated with a malware author, comprising to:
- extracting a first string from the binary executable file, wherein the first string relates to debug information of the binary executable file;
- determining whether a specific file path associated with the first string matches a pattern of the plurality of pre-defined patterns, the pattern including a regular expression;
- and
- in response to a determination that the specific file path matches the pattern, determine that the specific file path is a matched specific file path;
- extracting meta information from the one or more matched specific file paths, wherein the extracted meta information includes extracted strings or fields that are not executable code;
- automatically generating a signature based on the one or more matched specific file paths and the extracted meta information;
- and
- sending the signature to a firewall device or a host agent, wherein the firewall device or the host agent can perform an action based on the signature.
7 more elements
A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:
- receiving a sample, wherein the sample includes a binary executable file;
- matching one or more specific file paths in content of the binary executable file based on a plurality of pre-defined patterns, wherein each of the one or more specific file paths is associated with a development environment, a development project's profile, and/or other meta information associated with a malware author, comprising to:
- extracting a first string from the binary executable file, wherein the first string relates to debug information of the binary executable file;
- determining whether a specific file path associated with the first string matches a pattern of the plurality of pre-defined patterns, the pattern including a regular expression;
- and
- in response to a determination that the specific file path matches the pattern, determine that the specific file path is a matched specific file path;
- extracting meta information from the one or more matched specific file paths, wherein the extracted meta information includes extracted strings or fields that are not executable code;
- automatically generating a signature based on the one or more matched specific file paths and the extracted meta information;
- and
- sending the signature to a firewall device or a host agent, wherein the firewall device or the host agent can perform an action based on the signature.
7 more elements
Dependencies are inferred from the claim text.