Back to results
US 12,764,133 B2Granted
Inline malware detection
AssigneePalo Alto Networks, Inc.
InventorsWilliam Redington Hewlett, II, Suiqiang Deng, Sheng Yang, Ho Yu Lam
Life of this patent
Estimating the term…
Abstract
Detection of malicious files is disclosed. A firewall uses an external network to communicate with a security platform that stores a first set of signatures. A second set of signatures that is a subset of the first set of signatures is stored. At the firewall, a plurality of sample classification models is received and stored. At the firewall, a file transmitted by a remote resource to a client device is received. In response to determining that the file is malicious, propagation of the received file is prevented.
Claims35
A system for evaluating and selectively blocking network traffic, comprising:
- a processor configured to:
- implement a firewall that uses an external network to communicate with a security platform that stores a first set of signatures, wherein the system stores a second set of signatures that is a subset of the first set of signatures;
- receive and store, at the firewall, a plurality of sample classification models;
- receive, at the firewall, a file transmitted by a remote source to a client device, and in response to receiving the file, determine that a signature corresponding to the file is not present among the second set of signatures, wherein the signature, if matched by the file, would indicate whether or not the file is malicious;
- and
- in response to determining that the signature is not present among the second set of signatures:
- query the security platform for a verdict including whether or not the file is malicious;
- and
- subsequent to the query and prior to receiving the verdict from the security platform:
- determine information associated with the file, including a file name;
- select either a linear classification model or a non-linear classification model, from the plurality of sample classification models, to use in performing analysis on the received file;
- perform analysis on the file, including by performing n-gram analysis;
- and
- determine whether the received file is malicious based at least in part on the n-gram analysis, and:
- in response to determining that the received file is malicious, prevent propagation of the received file;
- and
- in response to determining that the received file is not malicious, permit propagation of the received file to the client device;
- wherein if an additional file having a sequence of packets matching the sequence of received packets is received, prevent propagation of the additional file;
- and
- in response to receiving the verdict from the security platform, use the verdict to determine whether or not to prevent propagation instead of using the plurality of classification models;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
19 more elements
A method for evaluating and selectively blocking network traffic, comprising:
- implementing a firewall that uses an external network to communicate with a security platform that stores a first set of signatures, wherein a data appliance stores a second set of signatures that is a subset of the first set of signatures;
- receiving and storing, at the firewall, a plurality of sample classification models;
- receiving, at the firewall, a file transmitted by a remote source to a client device, and in response to receiving the file, determining that a signature corresponding to the file is not present among the second set of signatures, wherein the signature, if matched by the file, would indicate whether or not the file is malicious;
- and
- in response to determining that the signature is not present among the second set of signatures:
- querying the security platform for a verdict including whether or not the file is malicious;
- and
- subsequent to the query and prior to receiving the verdict from the security platform:
- determine information associated with the file, including a file name;
- select either a linear classification model or a non-linear classification model, from the plurality of sample classification models, to use in performing analysis on the received file;
- perform analysis on the file, including by performing n-gram analysis;
- and
- determine whether the received file is malicious based at least in part on the n-gram analysis, and:
- in response to determining that the received file is malicious, prevent propagation of the received file;
- and
- in response to determining that the received file is not malicious, permit propagation of the received file to the client device;
- wherein if an additional file having a sequence of packets matching the sequence of received packets is received, prevent propagation of the additional file;
- and
- in response to receiving the verdict from the security platform, use the verdict to determine whether or not to prevent propagation instead of using the plurality of classification models.
16 more elements
A computer program product comprising a non-transitory computer readable storage medium and comprising computer instructions configured for:
- implementing a firewall that uses an external network to communicate with a security platform that stores a first set of signatures, wherein a data appliance stores a second set of signatures that is a subset of the first set of signatures;
- receiving and storing, at the firewall, a plurality of sample classification models;
- receiving, at the firewall, a file transmitted by a remote source to a client device, and in response to receiving the file, determining that a signature corresponding to the file is not present among the second set of signatures, wherein the signature, if matched by the file, would indicate whether or not the file is malicious;
- and
- in response to determining that the signature is not present among the second set of signatures:
- querying the security platform for a verdict including whether or not the file is malicious;
- and
- subsequent to the query and prior to receiving the verdict from the security platform:
- determine information associated with the file, including a file name;
- select either a linear classification model or a non-linear classification model, from the plurality of sample classification models, to use in performing analysis on the received file;
- perform analysis on the file, including by performing n-gram analysis;
- and
- determine whether the received file is malicious based at least in part on the n-gram analysis, and:
- in response to determining that the received file is malicious, prevent propagation of the received file;
- and
- in response to determining that the received file is not malicious, permit propagation of the received file to the client device;
- wherein if an additional file having a sequence of packets matching the sequence of received packets is received, prevent propagation of the additional file;
- and
- in response to receiving the verdict from the security platform, use the verdict to determine whether or not to prevent propagation instead of using the plurality of classification models.
16 more elements
Dependencies are inferred from the claim text.