Automatically detecting unknown packers
AssigneePalo Alto Networks, Inc.
InventorsChienHua Lu, Wenjun Hu
Life of this patent
Estimating the term…
Abstract
Techniques for automatically detecting unknown packers are disclosed. In some embodiments, a system/process/computer program product for automatically detecting unknown packers includes receiving a plurality of samples for malware packer detection analysis; performing a packer filter to determine whether each of the plurality of samples is packed; emulating each of the packed samples to extract a plurality of features; and clustering the packed samples based on the extracted features.
Claims20
A system, comprising:
- a processor configured to:
- receive a sample for inline malware packer detection analysis;
- perform a packer filter to determine whether the sample is packed;
- compare the sample with known malware packer clusters to determine whether the sample is associated with a known malware packer;
- and
- perform a responsive action based on the determination;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- receiving a sample for inline malware packer detection analysis;
- performing a packer filter to determine whether the sample is packed;
- comparing the sample with known malware packer clusters to determine whether the sample is associated with a known malware packer;
- and
- performing a responsive action based on the determination.
A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
- receiving a sample for inline malware packer detection analysis;
- performing a packer filter to determine whether the sample is packed;
- comparing the sample with known malware packer clusters to determine whether the sample is associated with a known malware packer;
- and
- performing a responsive action based on the determination.
Dependencies are inferred from the claim text.