Attack-resistant verification of auto-generated anti-malware signatures

A method to generate and verify anti-malware signatures, comprising:

• detecting a first attack on a server application on a host system having at least a processor and a memory, wherein the host system executes an intrusion prevention application and the server application;
• determining, by operation of the processor on the host system executing the intrusion prevention application, a candidate payload being processed by the server application contemporaneous to the detected attack;
• generating a provisional signature corresponding to the first attack;
• upon determining a first payload intended for the server application matches the provisional signature, monitoring the effects of the first payload when processed by the server application;
• upon determining that processing the first payload results in a second attack on the server application, increasing a confidence metric associated with the provisional signature;
• upon determining the confidence metric associated with the provisional signature matching the first payload exceeds a predetermined threshold, storing the provisional signature as a verified anti-malware signature;
• upon determining at least a second payload intended for the server application matches the provisional signature, monitoring the effects of the second payload when processed by the server application;
• and
• upon determining that processing the second payload does not result in an attack on the server application, discarding the provisional signature.

A non-transitory computer-readable storage-medium containing a program which, when executed, performs an operation to generate and verify anti-malware signatures, the operation comprising:

• detecting a first attack on a server application on a host system, wherein the host system executes an intrusion prevention application and the server application;
• determining a candidate payload being processed by the server application contemporaneous to the detected attack;
• generating a provisional signature corresponding to the first attack;
• assigning a confidence metric to the provisional signature;
• upon determining a first payload intended for the server application matches the provisional signature, monitoring the effects of the first payload when processed by the server application;
• upon determining that processing the first payload results in a second attack on the server application, increasing a confidence metric associated with the provisional signature;
• upon determining the confidence metric associated with the provisional signature matching the first payload exceeds a predetermined threshold, storing the provisional signature as a verified anti-malware signature;
• upon determining at least a second payload intended for the server application matches the provisional signature, monitoring the effects of the second payload when processed by the server application;
• and
• upon determining that processing the second payload does not result in an attack on the server application, discarding the provisional signature.