Back to results
US 11,960,605 B2Granted
Dynamic analysis techniques for applications
AssigneePalo Alto Networks, Inc.
InventorsCong Zheng, Wenjun Hu, Zhi Xu
Life of this patent
Estimating the term…
Abstract
A sample is analyzed to determine a set of events that should be selected for performing by a dynamic analyzer executing the sample in an instrumented, emulated environment. The set of selected events is performed. In some cases, at least one emulator detection resistance action is performed. A maliciousness verdict is determined for the sample based at least in part on one or more responses taken by the sample in response to the set of selected events being performed by the dynamic analyzer.
Claims28
A system, comprising:
- a processor configured to:
- analyze a sample to determine a set of events that should be selected for performing by a dynamic analyzer executing the sample in an instrumented, emulated environment;
- interact with the sample at least in part by:
- performing the set of selected events and performing a set of emulator detection resistance actions, including by hiding at least one emulator feature;
- and
- determine a maliciousness verdict for the sample based at least in part on one or more responses taken by the sample in response to the interaction performed by the dynamic analyzer;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
5 more elements
A method, comprising:
- analyzing a sample to determine a set of events that should be selected for performing by a dynamic analyzer executing the sample in an instrumented, emulated environment;
- interacting with the sample at least in part by:
- performing the set of selected events and performing a set of emulator detection resistance actions, including by hiding at least one emulator feature;
- and
- determining a maliciousness verdict for the sample based at least in part on one or more responses taken by the sample in response to the interaction performed by the dynamic analyzer.
2 more elements
Dependencies are inferred from the claim text.