Generation of malware traffic signatures using natural language processing by a neural network
AssigneePalo Alto Networks, Inc.
InventorsZhaoyan Xu, Tongbo Luo
Life of this patent
Estimating the term…
Abstract
The technology disclosed herein enables the generation of malware traffic signatures by performing natural language processing on known malware traffic using a neural network. In a particular embodiment, a method provides generating sentences comprising first information obtained from a plurality of fields in each of a plurality of known malware data packets in a first malware family. The method further provides inputting the sentences into a first neural network for natural language processing of the sentences and generating one or more signatures for the first malware family from results of the natural language processing of the sentences.
Claims20
A method for generating malware network traffic signatures, the method comprising:
- generating sentences comprising first information obtained from a plurality of fields in each of a plurality of known malware data packets in a first malware family;
- inputting the sentences into a first neural network for natural language processing of the sentences;
- and
- generating one or more signatures for the first malware family from results of the natural language processing of the sentences.
An apparatus for generating malware network traffic signatures, the apparatus comprising:
- one or more computer readable storage media;
- a processing system operatively coupled with the one or more computer readable storage media;
- and
- program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the processing system to:
- generate sentences comprising first information obtained from a plurality of fields in each of a plurality of known malware data packets in a first malware family;
- input the sentences into a first neural network for natural language processing of the sentences;
- and
- generate one or more signatures for the first malware family from results of the natural language processing of the sentences.
One or more computer readable storage media having program instructions stored thereon for generating malware network traffic signatures, the program instructions, when read and executed by a processing system, direct the processing system to:
- generate sentences comprising first information obtained from a plurality of fields in each of a plurality of known malware data packets in a first malware family;
- input the sentences into a first neural network for natural language processing of the sentences;
- and
- generate one or more signatures for the first malware family from results of the natural language processing of the sentences.
Dependencies are inferred from the claim text.