Mitigating communication and control attempts
AssigneePalo Alto Networks, Inc.
InventorsZhi Xu, Cong Zheng
Life of this patent
Estimating the term…
Abstract
The profiling and fingerprinting of communication and control (C&C) infrastructure is disclosed herein. An initial C&C profile is transmitted to a first network monitoring system. The initial C&C profile includes at least one of: (1) a domain corresponding to a C&C channel, and (2) a C&C pattern corresponding to a C&C channel. At least in part in response to information received from a second network monitoring system, the initial C&C profile is revised. An updated C&C profile is transmitted to the first network monitoring system.
Claims27
A system, comprising:
- a processor configured to:
- transmit an initial communication and control profile to a first network monitoring system, wherein the initial communication and control profile includes at least one domain, extracted from a first application sample comprising at least one file during at least one of:
- a static analysis and a dynamic analysis of the first application sample, and corresponding to a communication and control channel;
- at least in part in response to information received from a second network monitoring system that is different from the first network monitoring system, revise the initial communication and control profile and change a verdict associated with a second application sample that is different from the first application sample;
- and
- transmit an updated communication and control profile to the first network monitoring system;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- transmitting an initial communication and control profile to a first network monitoring system, wherein the initial communication and control profile includes at least one domain, extracted from a first application sample comprising at least one file during at least one of:
- a static analysis and a dynamic analysis of the first application sample, and corresponding to a communication and control channel;
- at least in part in response to information received from a second network monitoring system that is different from the first network monitoring system, revising the initial communication and control profile and changing a verdict associated with a second application sample that is different from the first application sample;
- and
- transmitting an updated communication and control profile to the first network monitoring system.
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- transmitting an initial communication and control profile to a first network monitoring system, wherein the initial communication and control profile includes at least one domain, extracted from a first application sample comprising at least one file during at least one of:
- a static analysis and a dynamic analysis of the first application sample, and corresponding to a communication and control channel;
- at least in part in response to information received from a second network monitoring system that is different from the first network monitoring system, revising the initial communication and control profile and changing a verdict associated with a second application sample that is different from the first application sample;
- and
- transmitting an updated communication and control profile to the first network monitoring system.
Dependencies are inferred from the claim text.