# US 10,313,370 B2 · Generating malware signatures based on developer fingerprints in debug information > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,370 B2 - Document ID: US10313370B2 - Status: Granted - Kind: B2 - Application number: 15/969,546 - Filed: 2018-05-02 - Published: 2018-09-06 - Granted: 2019-06-04 - Earliest claimed: 2016-03-28 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Zihang Xiao - Web page: https://patentgrep.com/patent/US10313370B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 8/73: Program documentation - G06F 21/563: {by source code analysis} - G06F 2221/034: Test or assess a computer or a system - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques for generating malware signatures based on developer fingerprints in debug information are disclosed. In some embodiments, a system, process, and/or computer program product for generating malware signatures based on developer fingerprints in debug information includes receiving a sample, in which the sample includes a binary executable file; matching one or more paths in content of the binary executable file based on a plurality of patterns; extracting meta information from the one or more matched paths; and automatically generating a signature based on the extracted meta information. ## Claims ### Claim 1 A system, comprising: a processor configured to: receive a sample, wherein the sample includes a binary executable file; match one or more specific file paths in content of the binary executable file based on a plurality of pre-defined patterns, wherein each of the one or more specific file paths is associated with a development environment, a development project's profile, and/or other meta information associated with a malware author, comprising to: extract a first string from the binary executable file, wherein the first string relates to debug information of the binary executable file; determine whether a specific file path associated with the first string matches a pattern of the plurality of pre-defined patterns, the pattern including a regular expression; and in response to a determination that the specific file path matches the pattern, determine that the specific file path is a matched specific file path; extract meta information from the one or more matched specific file paths, wherein the extracted meta information includes extracted strings or fields that are not executable code; automatically generate a signature based on the one or more matched specific file paths and the extracted meta information; and send the signature to a firewall device or a host agent, wherein the firewall device or the host agent can perform an action based on the signature; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system recited in claim 1, wherein the extracted meta information includes compiler generated meta data that is included within the binary executable file. ### Claim 3 (depends on 1) The system recited in claim 1, wherein the extracted meta information comprises a developer fingerprint in debug information, debug symbols, and/or derived data that corresponds to device/user fingerprint information associated with the malware author that can be used to generate the signature. ### Claim 4 (depends on 1) The system recited in claim 1, wherein the sample comprises a plurality of samples associated with a malware family, wherein each of the plurality of samples includes a binary executable file, wherein the signature is generated based on meta information that is common across the malware family and is extracted from each of the plurality of samples, and wherein the signature is a malware family signature. ### Claim 5 (depends on 1) The system recited in claim 1, wherein the signature is a malware family signature that is generated based on the extracted meta information. ### Claim 6 (depends on 1) The system recited in claim 1, wherein the binary executable file is associated with a malware family based on the extracted meta information. ### Claim 7 (depends on 1) The system recited in claim 1, wherein the processor is further configured to: perform an action based on the signature. ### Claim 8 A method, comprising: receiving a sample, wherein the sample includes a binary executable file; matching one or more specific file paths in content of the binary executable file based on a plurality of pre-defined patterns, wherein each of the one or more specific file paths is associated with a development environment, a development project's profile, and/or other meta information associated with a malware author, comprising to: extracting a first string from the binary executable file, wherein the first string relates to debug information of the binary executable file; determining whether a specific file path associated with the first string matches a pattern of the plurality of pre-defined patterns, the pattern including a regular expression; and in response to a determination that the specific file path matches the pattern, determine that the specific file path is a matched specific file path; extracting meta information from the one or more matched specific file paths, wherein the extracted meta information includes extracted strings or fields that are not executable code; automatically generating a signature based on the one or more matched specific file paths and the extracted meta information; and sending the signature to a firewall device or a host agent, wherein the firewall device or the host agent can perform an action based on the signature. ### Claim 9 (depends on 8) The method of claim 8, wherein the extracted meta information includes compiler generated meta data that is included within the binary executable file. ### Claim 10 (depends on 8) The method of claim 8, wherein the extracted meta information comprises a developer fingerprint in debug information, debug symbols, and/or derived data that corresponds to device/user fingerprint information associated with the malware author that can be used to generate the signature. ### Claim 11 (depends on 8) The method of claim 8, wherein the sample comprises a plurality of samples associated with a malware family, wherein each of the plurality of samples includes a binary executable file, wherein the signature is generated based on meta information that is common across the malware family and is extracted from each of the plurality of samples, and wherein the signature is a malware family signature. ### Claim 12 (depends on 8) The method of claim 8, wherein the signature is a malware family signature that is generated based on the extracted meta information. ### Claim 13 (depends on 8) The method of claim 8, wherein the binary executable file is associated with a malware family based on the extracted meta information. ### Claim 14 (depends on 8) The method of claim 8, further comprising: performing an action based on the signature. ### Claim 15 A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for: receiving a sample, wherein the sample includes a binary executable file; matching one or more specific file paths in content of the binary executable file based on a plurality of pre-defined patterns, wherein each of the one or more specific file paths is associated with a development environment, a development project's profile, and/or other meta information associated with a malware author, comprising to: extracting a first string from the binary executable file, wherein the first string relates to debug information of the binary executable file; determining whether a specific file path associated with the first string matches a pattern of the plurality of pre-defined patterns, the pattern including a regular expression; and in response to a determination that the specific file path matches the pattern, determine that the specific file path is a matched specific file path; extracting meta information from the one or more matched specific file paths, wherein the extracted meta information includes extracted strings or fields that are not executable code; automatically generating a signature based on the one or more matched specific file paths and the extracted meta information; and sending the signature to a firewall device or a host agent, wherein the firewall device or the host agent can perform an action based on the signature. ### Claim 16 (depends on 15) The computer program product recited in claim 15, wherein the extracted meta information includes compiler generated meta data that is included within the binary executable file. ### Claim 17 (depends on 15) The computer program product recited in claim 15, wherein the extracted meta information comprises a developer fingerprint in debug information, debug symbols, and/or derived data that corresponds to device/user fingerprint information associated with the malware author that can be used to generate the signature. ### Claim 18 (depends on 15) The computer program product recited in claim 15, wherein the sample comprises a plurality of samples associated with a malware family, wherein each of the plurality of samples includes a binary executable file, wherein the signature is generated based on meta information that is common across the malware family and is extracted from each of the plurality of samples, and wherein the signature is a malware family signature. ### Claim 19 (depends on 15) The computer program product recited in claim 15, wherein the binary executable file is associated with a malware family based on the extracted meta information. ### Claim 20 (depends on 15) The computer program product recited in claim 15, further comprising computer instructions for: performing an action based on the signature.