Mitigating communications and control attempts
AssigneePalo Alto Networks, Inc.
InventorsZhi Xu, Cong Zheng
Life of this patent
Estimating the term…
Abstract
The profiling and fingerprinting of communication and control (C&C) infrastructure is disclosed herein. An initial C&C profile is transmitted to a first network monitoring system. The initial C&C profile includes a domain corresponding to a C&C channel, and a pattern corresponding to the C&C channel. At least in part in response to information received from a second network monitoring system, the initial C&C profile is revised. An updated C&C profile is transmitted to the first network monitoring system.
Claims32
A system, comprising:
- a processor configured to:
- transmit an initial communication and control profile for a first malware family to a first network monitoring system, wherein the initial communication and control profile comprises:
- (1) a domain corresponding to a communication and control channel, and (2) at least one URL pattern comprising a path used by the communication and control channel;
- at least in part in response to receiving information from a second network monitoring system, revise the initial communication and control profile for the first malware family, including by adding an additional URL pattern comprising an additional path used by the communication and control channel;
- and
- transmit an updated communication and control profile to the first network monitoring system;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- transmitting an initial communication and control profile for a first malware family to a first network monitoring system, wherein the initial communication and control profile comprises:
- (1) a domain corresponding to a communication and control channel, and (2) at least one URL pattern comprising a path used by the communication and control channel;
- at least in part in response to receiving information from a second network monitoring system, revising the initial communication and control profile for the first malware family, including by adding an additional URL pattern comprising an additional path used by the communication and control channel;
- and
- transmitting an updated communication and control profile to the first network monitoring system.
A computer program product embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:
- transmitting an initial communication and control profile for a first malware family to a first network monitoring system, wherein the initial communication and control profile comprises:
- (1) a domain corresponding to a communication and control channel, and (2) at least one URL pattern comprising a path used by the communication and control channel;
- at least in part in response to receiving information from a second network monitoring system, revising the initial communication and control profile for the first malware family, including by adding an additional URL pattern comprising an additional path used by the communication and control channel;
- and
- transmitting an updated communication and control profile to the first network monitoring system.
Dependencies are inferred from the claim text.