Back to results
US 12,771,700 B2Granted
Deep learning pipeline to detect malicious command and control traffic
AssigneePalo Alto Networks, Inc.
InventorsAjaya Neupane, Yuwen Dai, Stefan Achleitner, Yu Fu, Shengming Xu
Life of this patent
Estimating the term…
Abstract
Detection of command and control malware is disclosed. A network traffic session is monitored. Automatic feature identification for real-time malicious command and control traffic detection based on a request header of the monitored network traffic session using a deep learning model is performed.
Claims12
A system, comprising:
- a processor configured to:
- monitor a network traffic session;
- and
- perform automatic feature identification for real-time malicious command and control traffic detection based on a request header of the monitored network traffic session using a deep learning model, comprising to:
- perform tokenization of the request header of the network traffic session to generate character tokens and word tokens;
- and
- feed the character tokens and the word tokens into a first layer of the deep learning model to find a group of features, comprising to:
- multiply the first layer with a filter matrix to obtain a second layer;
- and
- max-pool a plurality of elements of the second layer to obtain the group of features;
- and
- predict, using a fully connected layer of the deep learning model, a label of a hypertext transfer protocol (HTTP) session based on a probabilistic score;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
11 more elements
A method, comprising:
- monitoring a network traffic session;
- performing automatic feature identification for real-time malicious command and control traffic detection based on a request header of the monitored network traffic session using a deep learning model, comprising:
- performing tokenization of the request header of the network traffic session to generate character tokens and word tokens;
- and
- feeding the character tokens and the word tokens into a first layer of the deep learning model to find a group of features, comprising:
- multiplying the first layer with a filter matrix to obtain a second layer;
- and
- max-pooling a plurality of elements of the second layer to obtain the group of features;
- and
- predicting, using a fully connected layer of the deep learning model, a label of a hypertext transfer protocol (HTTP) session based on a probabilistic score.
7 more elements
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- monitoring a network traffic session;
- performing automatic feature identification for real-time malicious command and control traffic detection based on a request header of the monitored network traffic session using a deep learning model, comprising:
- performing tokenization of the request header of the network traffic session to generate character tokens and word tokens;
- and
- feeding the character tokens and the word tokens into a first layer of the deep learning model to find a group of features, comprising:
- multiplying the first layer with a filter matrix to obtain a second layer;
- and
- max-pooling a plurality of elements of the second layer to obtain the group of features;
- and
- predicting, using a fully connected layer of the deep learning model, a label of a hypertext transfer protocol (HTTP) session based on a probabilistic score.
7 more elements
Dependencies are inferred from the claim text.