Integrated application analysis and endpoint protection
AssigneePalo Alto Networks, Inc.
InventorsZhi Xu, Elad Wexler, Asaf Weiss
Life of this patent
Estimating the term…
Abstract
An indication of an application to be installed on a local device is received. A request is transmitted to a remote server for information associated with the application. In some cases, in response to the receipt of a report from the remote server, a set of rules restricting behaviors of the application is implemented at the local device. In some cases, in response to the receipt of a report from the remote server, the installation of the application on the local device is prevented.
Claims18
A system, comprising:
- a processor configured to:
- receive an indication of an application to be installed on a local device;
- transmit a request to a remote server for information associated with the application;
- in response to the receipt of a report, from the remote server, comprising behaviors observed as being taken by an executing copy of the application in a virtualized environment, implement, at the local device, a set of rules restricting behaviors of the application installed on the local device;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- receiving an indication of an application to be installed on a local device;
- transmitting a request to a remote server for information associated with the application;
- and
- in response to the receipt of a report, from the remote server, comprising behaviors observed as being taken by an executing copy of the application in a virtualized environment, implementing, at the local device, a set of rules restricting behaviors of the application.
The method of claim 10 further comprising detecting an attempt by the application to take an action that would violate the set of rules.
The method of claim 11 wherein the set of rules comprises a whitelisted set of behaviors observed at the remote server during emulation of the application in a virtualized environment and wherein an attempt by the application while executing on the local device to take an action not included in the whitelisted set of behaviors constitutes a rule violation.
The method of claim 14 wherein, in response to receiving the report, the remote server performs an evaluation of the application.
A system, comprising:
- a processor configured to:
- receive an indication of an application to be installed on a local device;
- transmit a request to a remote server for information associated with the application;
- in response to receiving an indication from the remote server that the application is determined to be malicious, prevent the installation of the application on the local device;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- receiving an indication of an application to be installed on a local device;
- transmitting a request to a remote server for information associated with the application;
- and
- in response to receiving an indication from the remote server that the application is determined to be malicious, preventing the installation of the application on the local device.
Dependencies are inferred from the claim text.