# US 12,764,133 B2 · Inline malware detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,764,133 B2
- Document ID: US12764133B2
- Status: Granted
- Kind: B2
- Application number: 18/922,174
- Filed: 2024-10-21
- Published: 2025-02-06
- Granted: 2026-10-13
- Earliest claimed: 2019-07-19
- Assignees: Palo Alto Networks, Inc.
- Applicants: Palo Alto Networks, Inc.
- Inventors: William Redington Hewlett, II; Suiqiang Deng; Sheng Yang; Ho Yu Lam
- Web page: https://patentgrep.com/patent/US12764133B2

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06N 5/022: Knowledge engineering; Knowledge acquisition
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Detection of malicious files is disclosed. A firewall uses an external network to communicate with a security platform that stores a first set of signatures. A second set of signatures that is a subset of the first set of signatures is stored. At the firewall, a plurality of sample classification models is received and stored. At the firewall, a file transmitted by a remote resource to a client device is received. In response to determining that the file is malicious, propagation of the received file is prevented.

## Claims

### Claim 1

A system for evaluating and selectively blocking network traffic, comprising: a processor configured to:
implement a firewall that uses an external network to communicate with a security platform that stores a first set of signatures, wherein the system stores a second set of signatures that is a subset of the first set of signatures;
receive and store, at the firewall, a plurality of sample classification models;
receive, at the firewall, a file transmitted by a remote source to a client device, and in response to receiving the file, determine that a signature corresponding to the file is not present among the second set of signatures, wherein the signature, if matched by the file, would indicate whether or not the file is malicious; and
in response to determining that the signature is not present among the second set of signatures:
query the security platform for a verdict including whether or not the file is malicious; and
subsequent to the query and prior to receiving the verdict from the security platform:
determine information associated with the file, including a file name;
select either a linear classification model or a non-linear classification model, from the plurality of sample classification models, to use in performing analysis on the received file;
perform analysis on the file, including by performing n-gram analysis; and
determine whether the received file is malicious based at least in part on the n-gram analysis, and:
in response to determining that the received file is malicious, prevent propagation of the received file; and
in response to determining that the received file is not malicious, permit propagation of the received file to the client device;
wherein if an additional file having a sequence of packets matching the sequence of received packets is received, prevent propagation of the additional file; and
in response to receiving the verdict from the security platform, use the verdict to determine whether or not to prevent propagation instead of using the plurality of classification models; and
a memory coupled to the processor and configured to provide the processor with instructions.

### Claim 2 (depends on 1)

The system of claim 1, wherein the processor is configured to perform the n-gram analysis at least in part by comparing n-grams in the received packets against a predetermined list of n-grams.

### Claim 3 (depends on 2)

The system of claim 2, wherein the predetermined list of n-grams was generated using a plurality of previously collected malware samples.

### Claim 4 (depends on 1)

The system of claim 1, wherein the processor is configured to select, from the plurality of sample classification models, the linear classification model, based on a determined filetype associated with the sequence of received packets.

### Claim 5 (depends on 1)

The system of claim 1, wherein performing the n-gram analysis includes accumulating a set of weights corresponding to observed n-grams.

### Claim 6 (depends on 5)

The system of claim 5, wherein the weights are accumulated in a single float value.

### Claim 7 (depends on 1)

The system of claim 1, wherein the processor is configured to select, from the plurality of sample classification models, the non-linear classification model, based on a determined filetype associated with the sequence of received packets.

### Claim 8 (depends on 7)

The system of claim 7, wherein the non-linear classification model includes n-gram features and non n-gram features.

### Claim 9 (depends on 8)

The system of claim 8, wherein at least one non n-gram feature is associated with a file size.

### Claim 10 (depends on 8)

The system of claim 8, wherein at least one non n-gram feature is associated with a presence of an overlay.

### Claim 11 (depends on 1)

The system of claim 1, wherein performing the n-gram analysis includes updating a value for a feature in a feature vector whenever the feature is matched.

### Claim 12 (depends on 1)

The system of claim 1, wherein using at least one stored sample classification model includes running a non-linear classifier against a packet stream until a purported file length is reached.

### Claim 13 (depends on 12)

The system of claim 12, wherein the purported file length is not an actual file length and the verdict is determined prior to reaching an actual end of the file.

### Claim 14 (depends on 1)

The system of claim 1, wherein the processor is further configured to receive at least one updated classification model.

### Claim 15 (depends on 1)

The system of claim 1, wherein the n-gram analysis is performed inline with other packet analyses as a single pass analysis.

### Claim 16 (depends on 1)

The system of claim 1, wherein the processor is further configured to use a set of whitelisted n-grams when performing the n-gram analysis.

### Claim 17 (depends on 1)

The system of claim 1, wherein the processor is further configured to transmit a copy of the received file to the security platform and perform the n-gram analysis while awaiting the verdict from the security platform.

### Claim 18

A method for evaluating and selectively blocking network traffic, comprising:
implementing a firewall that uses an external network to communicate with a security platform that stores a first set of signatures, wherein a data appliance stores a second set of signatures that is a subset of the first set of signatures;
receiving and storing, at the firewall, a plurality of sample classification models;
receiving, at the firewall, a file transmitted by a remote source to a client device, and in response to receiving the file, determining that a signature corresponding to the file is not present among the second set of signatures, wherein the signature, if matched by the file, would indicate whether or not the file is malicious; and
in response to determining that the signature is not present among the second set of signatures:
querying the security platform for a verdict including whether or not the file is malicious; and
subsequent to the query and prior to receiving the verdict from the security platform:
determine information associated with the file, including a file name;
select either a linear classification model or a non-linear classification model, from the plurality of sample classification models, to use in performing analysis on the received file;
perform analysis on the file, including by performing n-gram analysis; and
determine whether the received file is malicious based at least in part on the n-gram analysis, and:
in response to determining that the received file is malicious, prevent propagation of the received file; and
in response to determining that the received file is not malicious, permit propagation of the received file to the client device;
wherein if an additional file having a sequence of packets matching the sequence of received packets is received, prevent propagation of the additional file; and
in response to receiving the verdict from the security platform, use the verdict to determine whether or not to prevent propagation instead of using the plurality of classification models.

### Claim 19 (depends on 18)

The method of claim 18, wherein performing the n-gram analysis includes comparing n-grams in the received packets against a predetermined list of n-grams.

### Claim 20 (depends on 19)

The method of claim 19, wherein the predetermined list of n-grams was generated using a plurality of previously collected malware samples.

### Claim 21 (depends on 18)

The method of claim 18, further comprising selecting, from the plurality of sample classification models, the linear classification model, based on a determined filetype associated with the sequence of received packets.

### Claim 22 (depends on 18)

The method of claim 18, wherein performing the n-gram analysis includes accumulating a set of weights corresponding to observed n-grams.

### Claim 23 (depends on 22)

The method of claim 22, wherein the weights are accumulated in a single float value.

### Claim 24 (depends on 18)

The method of claim 18, further comprising selecting, from the plurality of sample classification models, the non-linear classification model, based on a determined filetype associated with the sequence of received packets.

### Claim 25 (depends on 24)

The method of claim 24, wherein the non-linear classification model includes n-gram features and non n-gram features.

### Claim 26 (depends on 25)

The method of claim 25, wherein at least one non n-gram feature is associated with a file size.

### Claim 27 (depends on 25)

The method of claim 25, wherein at least one non n-gram feature is associated with a presence of an overlay.

### Claim 28 (depends on 18)

The method of claim 18, wherein performing the n-gram analysis includes updating a value for a feature in a feature vector whenever the feature is matched.

### Claim 29 (depends on 18)

The method of claim 18, wherein using at least one stored sample classification model includes running a non-linear classifier against a packet stream until a purported file length is reached.

### Claim 30 (depends on 29)

The method of claim 29, wherein the purported file length is not an actual file length and the verdict is determined prior to reaching an actual end of the file.

### Claim 31 (depends on 18)

The method of claim 18, further comprising receiving at least one updated classification model.

### Claim 32 (depends on 18)

The method of claim 18, wherein the n-gram analysis is performed inline with other packet analyses as a single pass analysis.

### Claim 33 (depends on 18)

The system of claim 18, further comprising using a set of whitelisted n-grams when performing the n-gram analysis.

### Claim 34 (depends on 18)

The method of claim 18, further comprising transmitting a copy of the received file to the security platform and performing the n-gram analysis while awaiting the verdict from the security platform.

### Claim 35

A computer program product comprising a non-transitory computer readable storage medium and comprising computer instructions configured for:
implementing a firewall that uses an external network to communicate with a security platform that stores a first set of signatures, wherein a data appliance stores a second set of signatures that is a subset of the first set of signatures;
receiving and storing, at the firewall, a plurality of sample classification models;
receiving, at the firewall, a file transmitted by a remote source to a client device, and in response to receiving the file, determining that a signature corresponding to the file is not present among the second set of signatures, wherein the signature, if matched by the file, would indicate whether or not the file is malicious; and
in response to determining that the signature is not present among the second set of signatures:
querying the security platform for a verdict including whether or not the file is malicious; and
subsequent to the query and prior to receiving the verdict from the security platform:
determine information associated with the file, including a file name;
select either a linear classification model or a non-linear classification model, from the plurality of sample classification models, to use in performing analysis on the received file;
perform analysis on the file, including by performing n-gram analysis; and
determine whether the received file is malicious based at least in part on the n-gram analysis, and:
in response to determining that the received file is malicious, prevent propagation of the received file; and
in response to determining that the received file is not malicious, permit propagation of the received file to the client device;
wherein if an additional file having a sequence of packets matching the sequence of received packets is received, prevent propagation of the additional file; and
in response to receiving the verdict from the security platform, use the verdict to determine whether or not to prevent propagation instead of using the plurality of classification models.