Malware analysis system
AssigneePalo Alto Networks, Inc.
InventorsHuagang Xie, Xinran Wang, Jiangxia Liu
Life of this patent
Estimating the term…
Abstract
In some embodiments, a malware analysis system includes receiving a potential malware sample from a firewall; analyzing the potential malware sample using a virtual machine to determine if the potential malware sample is malware; and automatically generating a signature if the potential malware sample is determined to be malware. In some embodiments, the potential malware sample does not match a preexisting signature, and the malware is a zero-day attack.
Claims21
(canceled)
A system, comprising:
- a first device comprising a first processor configured to execute a firewall, and a second device comprising a second processor configured to execute a virtual machine,
- wherein the executing the firewall using the first processor of the first device comprises:
- using the firewall to generate a potential malware sample from at least a portion of a network traffic flow;
- determining that the potential malware sample does not match a preexisting signature;
- and
- sending the potential malware sample from the firewall to the virtual machine;
- and
- wherein the executing the virtual machine using the second processor of the second device comprises:
- using the virtual machine to monitor behavior of the potential malware sample during emulation to identify malware;
- automatically generating a signature using the virtual machine in the event that the potential malware sample is determined to be malware;
- and
- sending the signature from the virtual machine to the firewall, wherein the firewall is configured to enforce a security policy for network access based at least in part on the signature.
A method, comprising:
- using a firewall to generate a potential malware sample from at least a portion of a network traffic flow, wherein the firewall is executed by a first device;
- using the firewall to determine that the potential malware sample does not match a preexisting signature;
- sending the potential malware sample from the firewall to a virtual machine, wherein the virtual machine is executed by a second device;
- using the virtual machine to monitor behavior of the potential malware sample during emulation to identify malware;
- automatically generating a signature using the virtual machine in the event that the potential malware sample is determined to be malware;
- and
- sending the signature from the virtual machine to the firewall, wherein the firewall is configured to enforce a security policy for network access based at least in part on the signature.
A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- using a firewall to generate a potential malware sample from at least a portion of a network traffic flow, wherein the firewall is executed by a first device;
- using the firewall to determine that the potential malware sample does not match a preexisting signature;
- sending the potential malware sample from the firewall to a virtual machine, wherein the virtual machine is executed by a second device;
- using the virtual machine to monitor behavior of the potential malware sample during emulation to identify malware;
- automatically generating a signature using the virtual machine in the event that the potential malware sample is determined to be malware;
- and
- sending the signature from the virtual machine to the firewall, wherein the firewall is configured to enforce a security policy for network access based at least in part on the signature.
Dependencies are inferred from the claim text.