Detecting and blocking a malicious file early in transit on a network
AssigneeJuniper Networks, Inc.
InventorsPaul Randee Dilim Kimayong, Mounir Hahad
Life of this patent
Estimating the term…
Abstract
A device may receive a malicious file associated with a network of network devices and may identify a file type and file characteristics associated with the malicious file. The device may determine one or more rules to apply to the malicious file based on the file type and the file characteristics associated with the malicious file and may apply the one or more rules to the malicious file to generate a partial file signature for the malicious file. The device may provide the partial file signature for the malicious file to one or more of the network devices of the network. The partial file signature may cause the one or more of the network devices to block the malicious file.
Claims20
A method, comprising:
- receiving, by a device, a malicious file generated by a compromised endpoint device associated with a network of network devices;
- identifying, by the device, a file type and file characteristics associated with the malicious file,
- wherein the file characteristics are based on the file type;
- determining, by the device, one or more rules to apply to the malicious file based on the file type and the file characteristics associated with the malicious file;
- applying, by the device, the one or more rules to the malicious file to generate a partial file signature for the malicious file;
- and
- providing, by the device, the partial file signature for the malicious file to one or more of the network devices of the network,
- wherein the partial file signature causes the one or more of the network devices to block the malicious file.
A device, comprising:
- one or more memories;
- and
- one or more processors to:
- receive a malicious file generated by a compromised endpoint device associated with a network of network devices;
- identify a file type and file characteristics associated with the malicious file,
- wherein the file characteristics are based on the file type;
- determine one or more rules to apply to the malicious file based on the file type and the file characteristics associated with the malicious file;
- apply the one or more rules to the malicious file to generate a partial file signature for the malicious file;
- and
- provide the partial file signature for the malicious file to one or more of the network devices of the network,
- wherein the partial file signature causes the one or more of the network devices to block the malicious file.
A non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising:
- one or more instructions that, when executed by one or more processors of a device, cause the device to:
- receive a malicious file associated with a network of network devices;
- identify a file type and file characteristics associated with the malicious file,
- wherein the file characteristics are based on the file type;
- determine one or more rules to apply to the malicious file based on the file type and the file characteristics associated with the malicious file;
- apply the one or more rules to the malicious file to generate a partial file signature for the malicious file;
- and
- provide the partial file signature for the malicious file to one or more of the network devices of the network,
- wherein the partial file signature causes the one or more of the network devices to block the malicious file and to transmit a file other than the malicious file.
Dependencies are inferred from the claim text.