# US 2023/0069731 A1 · Automatic network signature generation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0069731 A1 - Document ID: US20230069731A1 - Status: Published application - Kind: A1 - Application number: 17/462,230 - Filed: 2021-08-31 - Published: 2023-03-02 - Earliest claimed: 2021-08-31 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Zhanhao Chen; Jun Wang; Wei Xu - Web page: https://patentgrep.com/patent/US20230069731A1 ## CPC - H04L 63/0263: {Rule management} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/0272: {Virtual private networks} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Automatic generation of network signatures is disclosed. Network profiles for malware samples are generated. Network signature candidates are selected based on the network profiles. The network signature candidates are automatically evaluated to automatically generate a new set of network signatures. The new set of network signatures is distributed to a security device/service to enforce the new set of network signatures to detect malware. ## Claims ### Claim 1 A system, comprising: a processor configured to: generate network profiles for malware samples; select network signature candidates based on the network profiles; automatically evaluate the network signature candidates to automatically generate a new set of network signatures; and distribute the new set of network signatures to a security device/service to enforce the new set of network signatures to detect malware; and a memory coupled to the processor and configured to provide the processor with instructions. ### Claim 2 (depends on 1) The system of claim 1, wherein the processor is further configured to: train a machine learning model using labeled network traffic from a security service to evaluate network events associated with a set of known malware samples and a set of known is benign samples. ### Claim 3 (depends on 1) The system of claim 1, wherein: the processor is further configured to train a machine learning model using labeled network traffic from a security service to evaluate network events associated with a set of known malware samples and a set of known benign samples; the trained machine learning model corresponds to a recurrent neural network (RNN) based attention model; the training of the machine learning model using the labeled network traffic outputs a set of attention weights, wherein the set of attention weights is associated with a corresponding set of specific network events; and an attention weight corresponds with a specific network event. ### Claim 4 (depends on 1) The system of claim 1, wherein the automatically evaluating of the network signature candidates to automatically generate a new set of network signatures comprises to: identify, using a set of validation network traffic, the network signature candidates associated with malware, wherein a network signature candidate of the network signature candidates includes an ordered sequence of one or more network events; determine whether a recall rate of the network signature candidate exceeds or to equal a recall rate threshold; and in response to a determination that the network signature candidate exceeds or equals the recall rate threshold, add the network signature candidate to the new set of network signatures. ### Claim 5 (depends on 1) The system of claim 1, wherein: a trained machine learning model corresponds to a recurrent neural network (RNN) based attention model; a set of attention weights is associated with the RNN based attention model, wherein the set of attention weights is associated with a corresponding set of specific network events; and the selecting of the network signature candidates based on the network profiles comprises to: select an ordered sequence of network events having the highest attention score to obtain a network signature candidate of the network signature candidates. ### Claim 6 (depends on 3) The system of claim 3, wherein the adding of the network signature candidate to the new is set of network signatures comprises: determine whether a precision rate of the network signature candidate falls below or is equal to a precision rate threshold; and in response to a determination that the network signature candidate falls below or is equal to the precision rate threshold, omit adding the network signature candidate to the new set of network signatures. ### Claim 7 (depends on 1) The system of claim 1, wherein the security device/service is configured to detect malware using the new set of network signatures. ### Claim 8 A method, comprising: generating network profiles for malware samples; selecting network signature candidates based on the network profiles; automatically evaluating the network signature candidates to automatically generate a new set of network signatures; and distributing the new set of network signatures to a security device/service to enforce the new set of network signatures to detect malware. ### Claim 9 (depends on 8) The method of claim 8, further comprising: training a machine learning model using labeled network traffic from a security service to evaluate network events associated with a set of known malware samples and a set of known benign samples. ### Claim 10 (depends on 8) The method of claim 8, further comprising: training a machine learning model using labeled network traffic from a security service to evaluate network events associated with a set of known malware samples and a set of known benign samples, wherein: the trained machine learning model corresponds to a recurrent neural network (RNN) based attention model; the training of the machine learning model using the labeled network traffic outputs a set of attention weights, wherein the set of attention weights is associated with a corresponding set of specific network events; and an attention weight corresponds with a specific network event. ### Claim 11 (depends on 8) The method of claim 8, wherein the automatically evaluating of the network signature is candidates to automatically generate a new set of network signatures comprises: identifying, using a set of validation network traffic, the network signature candidates associated with malware, wherein a network signature candidate of the network signature candidates includes an ordered sequence of one or more network events; determining whether a recall rate of the network signature candidate exceeds or to equal a recall rate threshold; and in response to a determination that the network signature candidate exceeds or equals the recall rate threshold, adding the network signature candidate to the new set of network signatures. ### Claim 12 (depends on 8) The method of claim 8, wherein: a trained machine learning model corresponds to a recurrent neural network (RNN) based attention model; a set of attention weights is associated with the RNN based attention model, wherein the set of attention weights is associated with a corresponding set of specific network events; and the selecting of the network signature candidates based on the network profiles comprises: selecting an ordered sequence of network events having the highest attention score to obtain a network signature candidate of the network signature candidates. ### Claim 13 (depends on 8) The method of claim 8, wherein the adding of the network signature candidate to the new set of network signatures comprises: determining whether a precision rate of the network signature candidate falls below or is equal to a precision rate threshold; and in response to a determination that the network signature candidate falls below or is equal to the precision rate threshold, omitting to add the network signature candidate to the new set of network signatures. ### Claim 14 (depends on 8) The method of claim 8, wherein the security device/service is configured to detect malware using the new set of network signatures. ### Claim 15 A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for: generating network profiles for malware samples; is selecting network signature candidates based on the network profiles; automatically evaluating the network signature candidates to automatically generate a new set of network signatures; and distributing the new set of network signatures to a security device/service to enforce the new set of network signatures to detect malware. ### Claim 16 (depends on 15) The computer program product of claim 15, further comprising computer instructions for: training a machine learning model using labeled network traffic from a security service to evaluate network events associated with a set of known malware samples and a set of known benign samples. ### Claim 17 (depends on 15) The computer program product of claim 15, wherein the automatically evaluating of the network signature candidates to automatically generate a new set of network signatures comprises: identifying, using a set of validation network traffic, the network signature candidates associated with malware, wherein a network signature candidate of the network signature candidates includes an ordered sequence of one or more network events; determining whether a recall rate of the network signature candidate exceeds or to equal a recall rate threshold; and in response to a determination that the network signature candidate exceeds or equals the recall rate threshold, adding the network signature candidate to the new set of network signatures. ### Claim 18 (depends on 15) The computer program product of claim 15, wherein: a trained machine learning model corresponds to a recurrent neural network (RNN) based attention model; a set of attention weights is associated with the RNN based attention model, wherein the set of attention weights is associated with a corresponding set of specific network events; and the selecting of the network signature candidates based on the network profiles comprises: selecting an ordered sequence of network events having the highest attention score to obtain a network signature candidate of the network signature candidates. ### Claim 19 (depends on 15) The computer program product of claim 15, wherein the adding of the network signature candidate to the new set of network signatures comprises: determining whether a precision rate of the network signature candidate falls below or is equal to a precision rate threshold; and in response to a determination that the network signature candidate falls below or is equal to the precision rate threshold, omitting to add the network signature candidate to the new set of network signatures. ### Claim 20 (depends on 15) The computer program product of claim 15, wherein the security device/service is configured to detect malware using the new set of network signatures.