Back to results
US 11,606,375 B2Granted
Methods and systems for identifying malware enabled by automatically generated domain names
AssigneeCheck Point Software Technologies Ltd.
InventorAliaksandr Chailytko
Life of this patent
Estimating the term…
Abstract
Computerized methods and systems identify malware enabled by automatically generated domain names. An agent executes a malware, in a controlled environment, at a first temporal input value and a second temporal input value. A first set of domain names is generated in response to the execution at the first temporal input value. A second set of domain names is generated in response to the execution at the second temporal input value. The agent compares the first set of domain names with the second set of domain names to produce a comparison output metric.
Claims12
A method, comprising:
- obtaining, by a hardware processor, at least one sample of a malware, the at least one sample including a first malware sample;
- executing, by the hardware processor, the first malware sample in a controlled environment at a first execution time-instance that emulates execution of the malware on a host computer at a first future time-instance to generate a first generated set of domain names;
- verifying, by the hardware processor, that the first generated set of domain names includes a number of unique domain names that is larger than a threshold amount;
- in response to the verifying, re-executing, by the hardware processor, the first malware sample in the controlled environment at a second execution time-instance that is subsequent to the first execution time-instance and that emulates execution of the malware on the host computer at a second future time-instance that is subsequent to the first future time-instance to generate a second generated set of domain names;
- and
- comparing, by the hardware processor, the first and second generated sets of domain names and in response to determining that an amount of overlap between the first and second generated sets of domain names is greater than an overlap threshold, determining, by the hardware processor, that the malware is enabled by automatically generated domain names.
3 more elements
A computer system, comprising:
- a storage medium for storing computer components;
- and
- a hardware processor for executing the computer components in a controlled environment comprising:
- a malware receipt module configured for:
- obtaining at least one sample of a malware, the at least one sample including a first malware sample, and
- a malware execution and identification agent linked to the malware receipt module configured for:
- executing the first malware sample in the controlled environment at a first execution time-instance that emulates execution of the malware on a host computer at a first future time-instance to generate a first generated set of domain names,
- verifying that the first generated set of domain names includes a number of unique domain names that is larger than a threshold amount,
- in response to the verifying, re-executing the first malware sample in the controlled environment at a second execution time-instance that is subsequent to the first execution time-instance and that emulates execution of the malware on the host computer at a second future time-instance that is subsequent to the first future time-instance to generate a second generated set of domain names, and
- comparing the first and second generated sets of domain names and in response to determining that an amount of overlap between the first and second generated sets of domain names is greater than an overlap threshold, determining that the malware is enabled by automatically generated domain names.
7 more elements
A computer usable non-transitory storage medium having a computer program embodied thereon for causing a suitable programmed system deployed in a controlled environment to perform the following steps when such program is executed on the system, the steps comprising:
- obtaining at least one sample of a malware, the at least one sample including a first malware sample;
- executing the first malware sample in the controlled environment at a first execution time-instance that emulates execution of the malware on a host computer at a first future time-instance to generate a first generated set of domain names;
- verifying that the first generated set of domain names includes a number of unique domain names that is larger than a threshold amount;
- in response to the verifying, re-executing the first malware sample in the controlled environment at a second execution time-instance that is subsequent to the first execution time-instance and that emulates execution of the malware on the host computer at a second future time-instance that is subsequent to the first future time-instance to generate a second generated set of domain names;
- and
- comparing the first and second generated sets of domain names and in response to determining that an amount of overlap between the first and second generated sets of domain names is greater than an overlap threshold, determining that the malware is enabled by automatically generated domain names.
3 more elements
Dependencies are inferred from the claim text.