Context profiling for malware detection
AssigneePalo Alto Networks, Inc.
InventorsJun Wang, Wei Xu
Life of this patent
Estimating the term…
Abstract
Analysis of samples for maliciousness is disclosed. A sample is executed and one or more network activities associated with executing the sample are recorded. The recorded network activities are compared to a malware profile. The malware profile comprises a set of network activities taken by a known malicious application during execution of the known malicious application. A verdict of “malicious” is assigned to the sample based at least in part on a determination that the recorded network activities match the malware profile.
Claims25
A system, comprising:
- a processor configured to:
- execute a potentially malicious sample and record one or more network activities associated with executing the potentially malicious sample;
- compare at least some of the recorded network activities to a malware profile, wherein the malware profile comprises a sequence of network events and corresponding attributes previously taken by a known malicious application during execution of the known malicious application, and wherein the malware profile was previously generated at least in part by filtering out, from a raw profile comprising raw network activity events system-generated events taken by a sample analysis system coincident to the execution of the known malicious application;
- and
- assign a malicious verdict to the potentially malicious sample based at least in part on a determination that the recorded network activities match the malware profile;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- executing a potentially malicious sample and recording one or more network activities associated with executing the potentially malicious sample;
- comparing at least some of the recorded network activities to a malware profile, wherein the malware profile comprises a sequence of network events and corresponding attributes previously taken by a known malicious application during execution of the known malicious application, and wherein the malware profile was previously generated at least in part by filtering out, from a raw profile comprising raw network activity events, system-generated events taken by a sample analysis system coincident to the execution of the malicious application;
- and
- assigning a malicious verdict to the potentially malicious sample based at least in part on a determination that the recorded network activities match the malware profile.
A computer program product embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:
- executing a potentially malicious sample and recording one or more network activities associated with executing the potentially malicious sample;
- comparing at least some of the recorded network activities to a malware profile, wherein the malware profile comprises a sequence of network events and corresponding attributes previously taken by a known malicious application during execution of the known malicious application, and wherein the malware profile was previously generated at least in part by filtering out, from a raw profile comprising raw network activity events, system-generated events taken by a sample analysis system coincident to the execution of the malicious application;
- and
- assigning a malicious verdict to the potentially malicious sample based at least in part on a determination that the recorded network activities match the malware profile.
Dependencies are inferred from the claim text.