US 10,944,768 B2 · System for automated signature generation and refinement

Abstract

Systems and methods are provided for generating samples of network traffic and characterizing the samples to easily identify exploits. A first embodiment of the present disclosure can generate traffic between a sample generator and the target computing device based on a particular exploit. The traffic can be a plurality of samples of the exploit using an exploit script. The method can provide for collecting and storing the plurality of samples. These samples can then be used to characterize the exploit by identifying invariant portions and variable portions of the samples. The method can further provide for removing any artifacts from the samples. Regular expressions can be constructed based on the samples. Each regular expression can be tested and ranked according to metrics of efficiency and accuracy.

Claims17

Dependent claims

A method for characterizing an exploit, where an exploit script provided by a first computing device and configures the first computing device to attempt the exploit on a target computing device via a network, the method comprising:

generating a plurality of samples of the exploit using the exploit script, wherein each sample comprises invariant portions and variable portions;
removing at least one artifact from each sample in a plurality of samples, wherein an artifact comprises a portion of the sample which is non-essential to access the target computing device;
constructing a plurality of regular expressions for the plurality of samples, wherein each regular expression in the plurality of regular expressions represents a pattern for matching invariant portions of the exploit script;
testing each regular expression in the plurality of regular expressions on the plurality of samples to yield test result data;
and
ranking each regular expression in the plurality of regular expressions according to a ranking metric and the test result data.

3 more elements

A system for characterizing an exploit, comprising:

a first computing device;
a target computing device;
and
a network, wherein the network is configured to allow communication between the first computing device and the target computing device;
and
wherein the first computing device is configured to:
generate a plurality of samples of the exploit using an exploit script, wherein the exploit script is located at the first computing device and configures the first computing device to attempt unauthorized access to the target computing device via the network, and wherein each sample comprises invariant portions and variable portions;
remove at least one artifact from each sample in a plurality of samples, wherein an artifact comprises a portion of the sample which is non-essential to access the target computing device;
construct a plurality of regular expressions for the plurality of samples, wherein each regular expression in the plurality of regular expressions represents a pattern for matching invariant portions of the exploit script;
test each regular expression in the plurality of regular expressions on the plurality of samples to yield test result data;
and
rank each regular expression in the plurality of regular expressions according to a ranking metric and the test result data.

9 more elements

Dependencies are inferred from the claim text.

System for automated signature generation and refinement

Life of this patent

System for automated signature generation and refinement

Life of this patent

Abstract

Claims17