Cookies watermarking in malware analysis
AssigneePalo Alto Networks, Inc.
InventorsZhaoyan Xu, Wei Xu, Kyle Sanders
Life of this patent
Estimating the term…
Abstract
Techniques for cookies watermarking in malware analysis are disclosed. In some embodiments, a system, process, and/or computer program product for cookies watermarking in malware analysis includes receiving a sample at a cloud security service; detonating the sample in an instrumented virtual environment; and determining that the sample is malware based on detecting an attempt to access a watermark cookie during an automated malware analysis using the instrumented virtual environment.
Claims20
A system, comprising:
- a processor configured to:
- receive a sample at a cloud security service;
- inject a watermark cookie in an instrumented virtual environment to provide a modified instrumented virtual environment, wherein the watermark cookie comprises a cookie file that is associated with a decoy account of a distinct web site, and wherein the watermark cookie is stored in a predetermined file directory path for one or more web browsers in the modified instrumented virtual environment;
- detonate the sample in the modified instrumented virtual environment;
- and
- determine that the sample is malware based on detecting an attempt to access the watermark cookie during an automated malware analysis using the modified instrumented virtual environment that is configured with system-level detection rules;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- receiving a sample at a cloud security service;
- injecting a watermark cookie in an instrumented virtual environment to provide a modified instrumented virtual environment, wherein the watermark cookie comprises a cookie file that is associated with a decoy account of a distinct web site, and wherein the watermark cookie is stored in a predetermined file directory path for one or more web browsers in the modified instrumented virtual environment;
- detonating the sample in the modified instrumented virtual environment;
- and
- determining that the sample is malware based on detecting an attempt to access the watermark cookie during an automated malware analysis using the modified instrumented virtual environment that is configured with system-level detection rules.
A computer program product, the computer program product being embodied in a non-transitory tangible computer readable storage medium and comprising computer instructions for:
- receiving a sample at a cloud security service;
- injecting a watermark cookie in an instrumented virtual environment to provide a modified instrumented virtual environment, wherein the watermark cookie comprises a cookie file that is associated with a decoy account of a distinct web site, and wherein the watermark cookie is stored in a predetermined file directory path for one or more web browsers in the modified instrumented virtual environment;
- detonating the sample in the modified instrumented virtual environment;
- and
- determining that the sample is malware based on detecting an attempt to access the watermark cookie during an automated malware analysis using the modified instrumented virtual environment that is configured with system-level detection rules.
Dependencies are inferred from the claim text.