Signature creation for malicious network traffic

A computer system for creating a traffic signature for detecting content in network traffic, comprising:

• a non-transitory computer-readable storage medium storing executable computer program modules comprising:
• a communications module for distributing detection data comprising behavior-based heuristics to a plurality of endpoints via a computer network, the behavior-based heuristics specifying one or more behaviors of an application processing content while executing on an endpoint that is characteristic of a malware attack;
• a content collection module for receiving, from at least some of the plurality of endpoints of the computer network, descriptions of content associated with an attack detected by the plurality of the endpoints, an attack detected by an endpoint of the plurality of the endpoints using the behavior-based heuristics of the distributed detection data;
• a signature creation module for generating a traffic signature for the described content associated with the attack detected by at least some of the plurality of the endpoints of the computer network by correlating the received descriptions of content associated with the attack, the correlating comprising identifying and analyzing descriptions referring to same content associated with the attack received from different endpoints, the traffic signature identifying characteristics of the content that are present when the content is carried by network traffic;
• and
• a signature distribution module for providing the traffic signature to an inspection point, the inspection point adapted to use the traffic signature to examine network traffic passing through the inspection point to detect the described content carried by the network traffic;
• and
• a computer processor for executing the computer program modules.

A non-transitory computer-readable storage medium storing executable computer program modules for enabling creation of a traffic signature for detecting content in network traffic, the modules comprising:

• a communication module for receiving detection data comprising behavior-based heuristics distributed by a computer server, the behavior-based heuristics specifying one or more behaviors of an application processing content while executing on an endpoint that is characteristic of a malware attack;
• a monitoring module for monitoring activity of an application at the endpoint;
• an attack detection module for detecting an attack on the application by analyzing activities monitored by the monitoring module, wherein the attack detection module uses the behavior-based heuristics of the distributed detection data;
• a content identification module for identifying the content associated with the detected attack and for generating a description of the identified content;
• and
• the communications module for providing the content description to a security server via a computer network;
• wherein the security server is adapted to receive, from a plurality of endpoints of the computer network, descriptions of content associated with attacks detected by the endpoints, and generate a traffic signature for the described content associated with the attack detected by the endpoints by correlating the received descriptions of content associated with the attack, the correlating comprising identifying and analyzing descriptions referring to same content associated with the attack received from different endpoints, the traffic signature identifying characteristics of the content that are present when the content is carried by network traffic, and to provide the traffic signature to an inspection point, the inspection point adapted to use the traffic signature to examine network traffic passing through the inspection point to detect the described content carried by the network traffic.