US 10,708,283 B2Granted

Detection and mitigation of time-delay based network attacks

AssigneeFortinet, Inc.

InventorJ. Dennis Bergström

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods for mitigation of time-delay based network attacks are provided. According to one embodiment, an email directed to a user of an enterprise and containing a potentially malicious link is received by a mail server of the enterprise. At a first time, a file to which the potentially malicious link points is evaluated within a sandbox environment and a first hash value is generated based on contents of the file. At a second time, evaluating, by the sandbox environment, a second file to which the potentially malicious link points, including downloading the second file to which the potentially malicious link points to at the second time and generating a second hash value based on contents of the second file. When the two hash values differ, then the second file is treated as a suspicious or high risk file or is evaluated within the sandbox environment.

Claims21

Dependent claims

A method comprising:

receiving, by a mail server of an enterprise, an electronic mail (email) directed to a user of the enterprise and containing a potentially malicious link;
at a first time, causing, by the mail server, a first file to which the potentially malicious link points at the first time to be downloaded and evaluated within a sandbox environment and a first hash value to be generated based on contents of the first file to which the potentially malicious link points at the first time;
at a second time, evaluating, by the sandbox environment, a second file to which the potentially malicious link points to at the second time, including downloading the second file to which the potentially malicious link points to at the second time and generating a second hash value based on contents of the second file to which the potentially malicious link points to at the second time, wherein the second time comprises a predetermined or configurable amount of time after the first time that is selected to subvert a link evasion technique in which the first file to which the potentially malicious link points to at the first time is replaced with the second file on or before the second time;
when the first hash value and the second hash value differ, then
(i) treating, by the sandbox environment, the second file to which the potentially malicious link points to at the second time as a suspicious or high risk file;
or
(ii) evaluating, by the sandbox environment, the second file and causing, by the sandbox environment, the mail server to handle the email based on a result of said evaluating.

4 more elements

A sandbox device comprising:

a non-transitory storage device having embodied therein instructions;
and
one or more processors coupled to the non-transitory storage device and operable to execute the instructions to perform a method comprising:
receiving a potentially malicious link from a mail server of an enterprise that extracted the potentially malicious link from an electronic mail (email) directed to a user of the enterprise;
at a first time, performing sandboxing on a first file to which the potentially malicious link points at the first time and generating a first hash value based on contents of the first file;
at a second time, downloading a second file to which the potentially malicious link points to at the second time and generating a second hash value based on contents of the second file, wherein the second time comprises a predetermined or configurable amount of time after the first time that is selected to subvert a link evasion technique in which the first file to which the potentially malicious link points to at the first time is replaced with the second file on or before the second time;
and
when the first hash value and the second hash value differ, then
(i) treating the second file as a suspicious or high risk file;
or
(ii) performing sandboxing on the second file and handling the second file based on a result of said performing sandboxing on the second file.

8 more elements

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a sandbox device, causes the one or more processors to perform a method for mitigating time-delay based attacks comprising:

receiving a potentially malicious link from a mail server of an enterprise that extracted the potentially malicious link from an electronic mail (email) directed to a user of the enterprise;
at a first time, performing sandboxing on a first file to which the potentially malicious link points at the first time and generating a first hash value based on contents of the first file;
at a second time, downloading a second file to which the potentially malicious link points to at the second time and generating a second hash value based on contents of the second file, wherein the second time comprises a predetermined or configurable amount of time after the first time that is selected to subvert a link evasion technique in which the first file to which the potentially malicious link points to at the first time is replaced with the second file on or before the second time;
and
when the first hash value and the second hash value differ, then
(i) treating the second file as a suspicious or high risk file;
or
(ii) performing sandboxing on the second file and handling the second file based on a result of said performing sandboxing on the second file.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/640,381Filed 30 Jun 2017
Published: US 2019/0007426 A13 Jan 2019
Granted: 7 Jul 2020
Term ends: Not estimatedThe source records don’t support an estimate.

Classification13 codes

H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
G06F 21/53
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by executing in a restricted environment, e.g.…
H04L 51/212
Monitoring or handling of messages: using filtering or selective blocking
H04L 63/1441
For detecting or protecting against malicious traffic: countermeasures against malicious traffic