# US 10,320,810 B1 · Mitigating communication and control attempts > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,810 B1 - Document ID: US10320810B1 - Status: Granted - Kind: B1 - Application number: 15/339,783 - Filed: 2016-10-31 - Granted: 2019-06-11 - Earliest claimed: 2016-10-31 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Zhi Xu; Cong Zheng - Web page: https://patentgrep.com/patent/US10320810B1 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/04: specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/125: involving control of end-device applications over a network - H04L 67/131: Protocols for games, networked simulations or virtual reality - H04L 67/30: Profiles - H04L 67/303: Terminal profiles - H04L 67/306: User profiles - H04L 67/53: using third party service providers - H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) - H04L 67/564: Enhancement of application control based on intercepted application data - H04L 63/0254: {Stateful filtering} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The profiling and fingerprinting of communication and control (C&C) infrastructure is disclosed herein. An initial C&C profile is transmitted to a first network monitoring system. The initial C&C profile includes at least one of: (1) a domain corresponding to a C&C channel, and (2) a C&C pattern corresponding to a C&C channel. At least in part in response to information received from a second network monitoring system, the initial C&C profile is revised. An updated C&C profile is transmitted to the first network monitoring system. ## Claims ### Claim 1 A system, comprising: a processor configured to: transmit an initial communication and control profile to a first network monitoring system, wherein the initial communication and control profile includes at least one domain, extracted from a first application sample comprising at least one file during at least one of: a static analysis and a dynamic analysis of the first application sample, and corresponding to a communication and control channel; at least in part in response to information received from a second network monitoring system that is different from the first network monitoring system, revise the initial communication and control profile and change a verdict associated with a second application sample that is different from the first application sample; and transmit an updated communication and control profile to the first network monitoring system; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system of claim 1 wherein the processor is further configured to transmit the initial communication and control profile to an application sample analysis system. ### Claim 3 (depends on 1) The system of claim 1 wherein the processor is further configured to transmit the updated communication and control profile to an application sample analysis system. ### Claim 4 (depends on 1) The system of claim 1 wherein the first network monitoring system comprises a data appliance. ### Claim 5 (depends on 1) The system of claim 1 wherein the initial communication and control profile is created at a communication and control pattern generation system in response to a message from an application sample analysis system. ### Claim 6 (depends on 1) The system of claim 1 wherein the information received from the second network monitoring system comprises an additional domain corresponding to the initial communication and control profile. ### Claim 7 (depends on 1) The system of claim 1 wherein the information received from the second network monitoring system comprises an additional pattern corresponding to the initial communication and control profile. ### Claim 8 (depends on 1) The system of claim 1 wherein the information received from the second network monitoring system is obtained by the second network monitoring system from observed network traffic. ### Claim 9 (depends on 1) The system of claim 1 wherein the initial communication and control profile comprises at least one of: a plurality of communication and control patterns, and a plurality of communication and control domains. ### Claim 10 (depends on 1) The system of claim 1 wherein the initial communication and control profile is built in response to analysis of a plurality of application samples by an application sample analysis system. ### Claim 11 (depends on 1) The system of claim 1 wherein the processor is further configured to determine that a first communication and control profile and a second communication and control profile should be merged into a merged communication and control profile. ### Claim 12 (depends on 1) The system of claim 1 wherein the first network monitoring system is configured to continue to use the initial communication and control profile for a period of time while passively monitoring using the updated communication and control profile. ### Claim 13 (depends on 12) The system of claim 12 wherein, after the period of time has elapsed, the first network monitoring system stops using the initial communication and control profile and starts actively monitoring using the updated communication and control profile. ### Claim 14 A method, comprising: transmitting an initial communication and control profile to a first network monitoring system, wherein the initial communication and control profile includes at least one domain, extracted from a first application sample comprising at least one file during at least one of: a static analysis and a dynamic analysis of the first application sample, and corresponding to a communication and control channel; at least in part in response to information received from a second network monitoring system that is different from the first network monitoring system, revising the initial communication and control profile and changing a verdict associated with a second application sample that is different from the first application sample; and transmitting an updated communication and control profile to the first network monitoring system. ### Claim 15 (depends on 14) The method of claim 14 wherein the information received from the second network monitoring system comprises an additional domain corresponding to the initial communication and control profile. ### Claim 16 (depends on 14) The method of claim 14 wherein the information received from the second network monitoring system comprises an additional pattern corresponding to the initial communication and control profile. ### Claim 17 A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for: transmitting an initial communication and control profile to a first network monitoring system, wherein the initial communication and control profile includes at least one domain, extracted from a first application sample comprising at least one file during at least one of: a static analysis and a dynamic analysis of the first application sample, and corresponding to a communication and control channel; at least in part in response to information received from a second network monitoring system that is different from the first network monitoring system, revising the initial communication and control profile and changing a verdict associated with a second application sample that is different from the first application sample; and transmitting an updated communication and control profile to the first network monitoring system. ### Claim 18 (depends on 14) The method of claim 14 further comprising transmitting the initial communication and control profile to an application sample analysis system. ### Claim 19 (depends on 14) The method of claim 14 further comprising transmitting the updated communication and control profile to an application sample analysis system. ### Claim 20 (depends on 14) The method of claim 14 wherein the first network monitoring system comprises a data appliance. ### Claim 21 (depends on 14) The method of claim 14 wherein the initial communication and control profile is created at a communication and control pattern generation system in response to a message from an application sample analysis system. ### Claim 22 (depends on 14) The method of claim 14 wherein the information received from the second network monitoring system is obtained by the second network monitoring system from observed network traffic. ### Claim 23 (depends on 14) The method of claim 14 wherein the initial communication and control profile comprises at least one of: a plurality of communication and control patterns, and a plurality of communication and control domains. ### Claim 24 (depends on 14) The method of claim 14 wherein the initial communication and control profile is built in response to analysis of a plurality of application samples by an application sample analysis system. ### Claim 25 (depends on 14) The method of claim 14 further comprising determining that a first communication and control profile and a second communication and control profile should be merged into a merged communication and control profile. ### Claim 26 (depends on 14) The method of claim 14 wherein the first network monitoring system is configured to continue to use the initial communication and control profile for a period of time while passively monitoring using the updated communication and control profile. ### Claim 27 (depends on 26) The method of claim 26 wherein, after the period of time has elapsed, the first network monitoring system stops using the initial communication and control profile and starts actively monitoring using the updated communication and control profile.