Identifying command and control attacks using api calls
AssigneeDropbox, Inc.
InventorsJason Falivene, Ivo Ivanov, Carlos Fuentes Bermejo
Life of this patent
Estimating the term…
Abstract
A collaborative content management system identifies an application installed on one or more client devices that is susceptible to an attack by using the API calls of the application. The collaborative content management system obtains API calls made by the application and derives API call features. The collaborative content management system inputs the API call features into a machine learning model and receives, as output from the model, a determination of whether the set of API calls represents a C2 attack. In some embodiments, the collaborative content management system, responsive to determining that the set of API calls represents a C2 attack, may take a security action.
Claims20
A method comprising:
- identifying an application installed on one or more client devices that is susceptible to an attack by using application protocol interface (API) calls of the application;
- obtaining a set of API calls made by the application;
- extracting a vector of API call features derived from the set of API calls;
- inputting the vector of API call features into a machine learning model;
- and
- receiving, as output from the machine learning model, a determination as to whether the set of API calls represent a command and control attack.
A non-transitory computer-readable medium comprising memory with instructions encoded thereon, the instructions, when executed by one or more processors, causing the one or more processors to perform operations, the instructions comprising instructions to:
- identify an application installed on one or more client devices that is susceptible to an attack by using application protocol interface (API) calls of the application;
- obtain a set of API calls made by the application;
- extract a vector of API call features from the set of API calls;
- input the vector of API call features into a machine learning model;
- and
- receive, as output from the machine learning model, a determination as to whether the set of API calls represent a command and control attack.
A system comprising:
- memory with instructions encoded thereon;
- and
- one or more processors that, when executing the instructions, are caused to perform operations comprising:
- identifying an application installed on one or more client devices that is susceptible to an attack by using application protocol interface (API) calls of the application;
- obtaining a set of API calls made by the application;
- extracting a vector of API call features derived from the set of API calls;
- inputting the vector of API call features into a machine learning model;
- and
- receiving, as output from the machine learning model, a determination as to whether the set of API calls represent a command and control attack.
Dependencies are inferred from the claim text.