Automatically determining whether malware samples are similar
AssigneePalo Alto Networks, Inc.
InventorsShadi Rostami-Hesarsorkh, Sudarshan Vasudevan, Farshad Rostamabadi
Life of this patent
Estimating the term…
Abstract
Techniques for automatically determining whether malware samples are similar are disclosed. In some embodiments, a system, process, and/or computer program product for automatically determining whether malware samples are similar includes receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis; comparing the log files based on the automated malware analysis; determining whether any of the plurality of samples are similar based on the comparison of the log files based on the automated malware analysis; and performing an action based on determining that at least two samples are similar.
Claims20
A system, comprising:
- a processor configured to:
- receive a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis;
- compare the log files based on the automated malware analysis;
- determine whether any of the plurality of samples are similar based on the comparison of the log files based on the automated malware analysis;
- and
- perform an action based on determining that at least two samples are similar;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis;
- comparing the log files based on the automated malware analysis;
- determining whether any of the plurality of samples are similar based on the comparison of the log files based on the automated malware analysis;
- and
- performing an action based on determining that at least two samples are similar.
A computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:
- receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis;
- comparing the log files based on the automated malware analysis;
- determining whether any of the plurality of samples are similar based on the comparison of the log files based on the automated malware analysis;
- and
- performing an action based on determining that at least two samples are similar.
Dependencies are inferred from the claim text.