# US 8,474,044 B2 · Attack-resistant verification of auto-generated anti-malware signatures > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,474,044 B2 - Document ID: US8474044B2 - Status: Granted - Kind: B2 - Application number: 12/348,702 - Filed: 2009-01-05 - Published: 2010-07-08 - Granted: 2013-06-25 - Earliest claimed: 2009-01-05 - Assignees: Cisco Technology, Inc. - Applicants: Andrew Zawadowskiy; Boris Ruchansky; Mikhail Cherepov - Inventors: Andrew Zawadowskiy; Boris Ruchansky; Mikhail Cherepov - Web page: https://patentgrep.com/patent/US8474044B2 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F 21/564: {by virus signature recognition} - H04L 2463/141: Denial of service attacks against endpoints in a network - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Techniques are disclosed for verifying whether payload signatures correspond to a vulnerability or exploit. Generally a security system may be configured to detect an attack on a server while the server is processing a payload. The security system generates (or obtains) a provisional signature corresponding to the vulnerability. For example, a provisional signature may be generated for a vulnerability from a group of payloads determined to correspond to that vulnerability. The effects of subsequent payloads which match the provisional signature may be monitored. If the effects of a payload duplicate the attack symptoms, a confidence metric for provisional signature may be increased. Once the confidence metric exceeds a predetermined threshold, then the provisional signature may be made active and used to block traffic from reaching an intended destination. ## Claims ### Claim 1 A system, comprising: a processor; a memory; and an intrusion prevention application, which, when executed by the processor is configured to verify anti-malware signatures by performing an operation, comprising: detecting a first attack on a server application executing on the system, determining a candidate payload being processed by the server application contemporaneous to the detected attack, generating a provisional signature corresponding to the first attack, upon determining a first payload addressed to the server application matches the provisional signature, monitoring the effects of the first payload when processed by the server application, upon determining that processing the first payload results in a second attack on the server application, increasing a confidence metric associated with the provisional signature, upon determining the confidence metric associated with the provisional signature matching the first payload exceeds a predetermined threshold, storing the provisional signature as a verified anti-malware signature, upon determining at least a second payload intended for the server application matches the provisional signature, monitoring the effects of the second payload when processed by the server application, and upon determining that processing the second payload does not result in an attack on the server application, discarding the provisional signature. ### Claim 2 (depends on 1) The system of claim 1, wherein the operation further comprises: upon determining a second payload intended for the server application matches the verified anti-malware signature, blocking the second payload from being processed by the server application. ### Claim 3 (depends on 1) The system of claim 1, wherein the operation further comprises: caching the discarded provisional signature; and monitoring for a denial of service (DOS) attack resulting from receiving a plurality of payloads matching the discarded provisional signature. ### Claim 4 (depends on 1) The system of claim 1, wherein the first attack comprises a buffer overflow. ### Claim 5 (depends on 1) The system of claim 1, wherein the first attack comprises shell code configured to exploit a vulnerability of the server application which allows an attacker to cause the application server to execute the shell code on the processor. ### Claim 6 (depends on 5) The system of claim 5, wherein the shell code is delivered to the server application as an HTTP argument. ### Claim 7 (depends on 1) The system of claim 1, wherein the confidence metric provides a measure of confidence that the payload corresponding to the provisional signature carries an intended attack on the server application. ### Claim 8 (depends on 1) The system of claim 1, wherein determining that processing the first payload results in the second attack on the server application comprises: comparing a stack state and an execution path of the server application following processing the first payload with a comparable stack state and execution path of the system following the first attack; and identifying a match between the stack state and the execution path and the comparable stack state and the execution path. ### Claim 9 A method to generate and verify anti-malware signatures, comprising: detecting a first attack on a server application on a host system having at least a processor and a memory, wherein the host system executes an intrusion prevention application and the server application; determining, by operation of the processor on the host system executing the intrusion prevention application, a candidate payload being processed by the server application contemporaneous to the detected attack; generating a provisional signature corresponding to the first attack; upon determining a first payload intended for the server application matches the provisional signature, monitoring the effects of the first payload when processed by the server application; upon determining that processing the first payload results in a second attack on the server application, increasing a confidence metric associated with the provisional signature; upon determining the confidence metric associated with the provisional signature matching the first payload exceeds a predetermined threshold, storing the provisional signature as a verified anti-malware signature; upon determining at least a second payload intended for the server application matches the provisional signature, monitoring the effects of the second payload when processed by the server application; and upon determining that processing the second payload does not result in an attack on the server application, discarding the provisional signature. ### Claim 10 (depends on 9) The method of claim 9, further comprising: upon determining a second payload intended for the server application matches the verified anti-malware signature, blocking the second payload from being processed by the server application. ### Claim 11 (depends on 9) The method of claim 9, further comprising: caching the discarded provisional signature; and monitoring for a denial of service (DOS) attack resulting from receiving a plurality of payloads matching the discarded provisional signature. ### Claim 12 (depends on 9) The method of claim 9, wherein the first attack comprises a buffer overflow. ### Claim 13 (depends on 9) The method of claim 9, wherein the first attack comprises shell code configured to exploit a vulnerability of the server application which allows an attacker to cause the application server execute the shell code on host system. ### Claim 14 (depends on 9) The method of claim 9, wherein determining that processing the first payload results in the second attack on the server application comprises: comparing a stack state and an execution path of the server application following processing the first payload with a comparable stack state and execution path of the system following the first attack; and identifying a match between the stack state and the execution path and the comparable stack state and the execution path. ### Claim 15 A non-transitory computer-readable storage-medium containing a program which, when executed, performs an operation to generate and verify anti-malware signatures, the operation comprising: detecting a first attack on a server application on a host system, wherein the host system executes an intrusion prevention application and the server application; determining a candidate payload being processed by the server application contemporaneous to the detected attack; generating a provisional signature corresponding to the first attack; assigning a confidence metric to the provisional signature; upon determining a first payload intended for the server application matches the provisional signature, monitoring the effects of the first payload when processed by the server application; upon determining that processing the first payload results in a second attack on the server application, increasing a confidence metric associated with the provisional signature; upon determining the confidence metric associated with the provisional signature matching the first payload exceeds a predetermined threshold, storing the provisional signature as a verified anti-malware signature; upon determining at least a second payload intended for the server application matches the provisional signature, monitoring the effects of the second payload when processed by the server application; and upon determining that processing the second payload does not result in an attack on the server application, discarding the provisional signature. ### Claim 16 (depends on 15) The non-transitory computer-readable storage-medium of claim 15, wherein the operation further comprises: upon determining a second payload intended for the server application matches the verified anti-malware signature, blocking the second payload from being processed by the server application. ### Claim 17 (depends on 15) The non-transitory computer-readable storage-medium of claim 15, wherein the operation further comprises: caching the discarded provisional signature; and monitoring for a denial of service (DOS) attack resulting from receiving a plurality of payloads matching the discarded provisional signature. ### Claim 18 (depends on 15) The non-transitory computer-readable storage-medium of claim 15, wherein determining that processing the first payload results in the second attack on the server application comprises: comparing a stack state and an execution path of the server application following processing the first payload with a comparable stack state and execution path of the system following the first attack; and identifying a match between the stack state and the execution path and the comparable stack state and the execution path.