# US 2016/0366100 A1 · Dynamic malware analysis of a url using a browser executed in an instrumented virtual machine environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366100 A1 - Document ID: US20160366100A1 - Status: Published application - Kind: A1 - Application number: 15/191,377 - Filed: 2016-06-23 - Published: 2016-12-15 - Earliest claimed: 2014-10-27 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Jiangxia Liu; Xin Ouyang; Bo Qu - Web page: https://patentgrep.com/patent/US20160366100A1 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 9/45504: {Abstract machines for program code execution, e.g. Java virtual machine [JVM], interpreters or emulators} - G06F 9/45533: {Hypervisors; Virtual machine monitors} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/552: {involving long-term monitoring or reporting} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/168: {above the transport layer} - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - H04L 63/0281: {Proxies} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Various techniques for performing malware analysis of a URL (e.g., a URL sample) using a browser executed in an instrumented virtual machine environment are disclosed. In some embodiments, a system for performing dynamic malware analysis of a URL using a browser executed in an instrumented virtual machine environment includes the instrumented virtual machine environment executed on a processor that receives a URL sample for dynamic malware analysis using the browser executed in the instrumented virtual machine environment; and a dynamic time allocator executed on the processor that dynamically determines a period of time allocated for performing the dynamic malware analysis of the URL sample using the browser executed in the instrumented virtual machine environment, in which the URL sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for the period of time allocated for performing the dynamic malware analysis of the URL sample. ## Claims ### Claim 1 (canceled) ### Claim 2 A system, comprising: a processor; and a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to: receive a Uniform Resource Locator (URL) sample for dynamic malware analysis using a browser executed in an instrumented virtual machine environment executed on the processor; and dynamically determine a period of time allocated for performing the dynamic malware analysis of the URL sample using the browser executed in the instrumented virtual machine environment, wherein the URL sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for the period of time allocated for performing the dynamic malware analysis of the URL sample, wherein the determining of the period of time allocated for performing the dynamic malware analysis of the URL sample comprises to: perform the following: A) generate a message when a registered event of the URL sample is completed; B) generate a User Interface (UI) event without delay to trigger one or more functions that are triggered in response to one or more UI events, the one or more functions being associated with the URL sample; or C) a combination thereof. ### Claim 3 (depends on 2) The system recited in claim 2, wherein the URL sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for at least the period of time allocated for performing the dynamic malware analysis of the URL sample or until malicious behavior is detected. ### Claim 4 (depends on 2) The system recited in claim 2, wherein the URL sample includes a URL that includes a reference to a resource that can be retrieved and rendered using the browser executed in the instrumented virtual machine environment. ### Claim 5 (depends on 2) The system recited in claim 2, wherein the URL sample includes a URL that includes a reference to a resource that can be retrieved and rendered using the browser executed in the instrumented virtual machine environment, and wherein the resource includes dynamic content. ### Claim 6 (depends on 2) The system recited in claim 2, wherein the URL sample includes a URL that includes a reference to a resource that can be retrieved and rendered using the browser executed in the instrumented virtual machine environment, and wherein the resource includes executable content that includes Java Script code. ### Claim 7 (depends on 2) The system recited in claim 2, wherein the URL sample includes a URL that includes a reference to a resource that can be retrieved and rendered using the browser executed in the instrumented virtual machine environment, and wherein the dynamically determining of the period of time allocated for malware analysis of the URL sample further includes reducing the period of time allocated for malware analysis of the URL sample based on executable content associated with the resource. ### Claim 8 (depends on 2) The system recited in claim 2, wherein the processor is further configured to: determine whether the URL sample is associated with malware based on analysis of the URL sample during the period of time allocated for performing the dynamic malware analysis of the URL sample using the browser executed in the instrumented virtual machine environment. ### Claim 9 (depends on 2) The system recited in claim 2, wherein the processor is further configured to: load, by the browser, a browser helper object (BHO) prior to rendering the URL sample. ### Claim 10 (depends on 2) The system recited in claim 2, wherein the instrumented virtual machine environment is executed by a cloud security service, wherein the instrumented virtual machine environment executed on the processor that receives the URL sample for malware analysis further includes receiving the URL sample at the cloud security service from a security device, and wherein the URL sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for at least the period of time allocated for malware analysis of the URL sample or until malicious behavior is detected. ### Claim 11 A method, comprising: receiving a Uniform Resource Locator (URL) sample for dynamic malware analysis using a browser executed in an instrumented virtual machine environment executed on a processor; and dynamically determining a period of time allocated for performing the dynamic malware analysis of the URL sample using the browser executed in the instrumented virtual machine environment, wherein the URL sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for the period of time allocated for performing the dynamic malware analysis of the URL sample, wherein the determining of the period of time allocated for performing the dynamic malware analysis of the URL sample comprises: performing the following: A) generating a message when a registered event of the URL sample is completed; B) generating a User Interface (UI) event without delay to trigger one or more functions that are triggered in response to one or more UI events, the one or more functions being associated with the URL sample; or C) a combination thereof. ### Claim 12 (depends on 11) The method of claim 11, wherein a malware sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for at least the period of time allocated for performing the dynamic malware analysis of the URL sample or until malicious behavior is detected. ### Claim 13 (depends on 11) The method of claim 11, wherein the URL sample includes a URL that includes a reference to a resource that can be retrieved and rendered using the browser executed in the instrumented virtual machine environment. ### Claim 14 (depends on 11) The method of claim 11, wherein the URL sample includes a URL that includes a reference to a resource that can be retrieved and rendered using the browser executed in the instrumented virtual machine environment, and wherein dynamically determining the period of time allocated for malware analysis of the URL sample further includes reducing the period of time allocated for malware analysis of the URL sample based on executable content associated with the resource. ### Claim 15 (depends on 11) The method of claim 11, wherein the instrumented virtual machine environment is executed by a cloud security service, wherein the instrumented virtual machine environment executed on the processor that receives the URL sample for malware analysis further includes receiving the URL sample at the cloud security service from a security device, and wherein the URL sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for at least the period of time allocated for malware analysis of the URL sample or until malicious behavior is detected. ### Claim 16 A computer program product being embodied in a non-transitory, tangible computer readable storage medium and comprising computer instructions for: receiving a Uniform Resource Locator (URL) sample for dynamic malware analysis using a browser executed in an instrumented virtual machine environment executed on a processor; and dynamically determining a period of time allocated for performing the dynamic malware analysis of the URL sample using the browser executed in the instrumented virtual machine environment, wherein the URL sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for the period of time allocated for performing the dynamic malware analysis of the URL sample, wherein the determining of the period of time allocated for performing the dynamic malware analysis of the URL sample comprises: performing the following: A) generating a message when a registered event of the URL sample is completed; B) generating a User Interface (UI) event without delay to trigger one or more functions that are triggered in response to one or more UI events, the one or more functions being associated with the URL sample; or C) a combination thereof. ### Claim 17 (depends on 16) The computer program product recited in claim 16, wherein the URL sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for at least the period of time allocated for performing the dynamic malware analysis of the URL sample or until malicious behavior is detected. ### Claim 18 (depends on 16) The computer program product recited in claim 16, wherein the URL sample includes a URL that includes a reference to a resource that can be retrieved and rendered using the browser executed in the instrumented virtual machine environment. ### Claim 19 (depends on 16) The computer program product recited in claim 16, wherein the URL sample includes a URL that includes a reference to a resource that can be retrieved and rendered using the browser executed in the instrumented virtual machine environment, and wherein dynamically determining the period of time allocated for malware analysis of the URL sample further includes reducing the period of time allocated for malware analysis of the URL sample based on executable content associated with the resource. ### Claim 20 (depends on 16) The computer program product recited in claim 16, wherein the instrumented virtual machine environment is executed by a cloud security service, wherein the instrumented virtual machine environment executed on the processor that receives the URL sample for malware analysis further includes receiving the URL sample at the cloud security service from a security device, and wherein the URL sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for at least the period of time allocated for malware analysis of the URL sample or until malicious behavior is detected.