# US 8,782,790 B1 · Signature creation for malicious network traffic

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,782,790 B1
- Document ID: US8782790B1
- Status: Granted
- Kind: B1
- Application number: 12/709,432
- Filed: 2010-02-19
- Granted: 2014-07-15
- Earliest claimed: 2010-02-19
- Assignees: Symantec Corporation
- Applicants: Spencer Smith; Adam Glick; Nicholas Graf; Uriel Mann
- Inventors: Spencer Smith; Adam Glick; Nicholas Graf; Uriel Mann
- Web page: https://patentgrep.com/patent/US8782790B1

## CPC

- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An endpoint on a network uses detection data to detect a malicious software attack. The endpoint identifies content associated with the attack, such as a component of a web page, and generates a description of the content. The endpoint sends the description to a security server. The security server analyzes the content and identifies characteristics of the content that are present when the content is carried by network traffic. The security server generates a traffic signature that specifies the identified characteristics and provides the traffic signature to inspection points. The inspection points, in turn, use the traffic signature to examine network traffic passing through the inspection points to detect network traffic carrying the content. The attack detection at the endpoint thus informs the traffic signature-based detection at the inspection points and reduces the spread of malicious software.

## Claims

### Claim 1

A computer-implemented method of creating a traffic signature for detecting content in network traffic, comprising:
distributing detection data comprising behavior-based heuristics to a plurality of endpoints via a computer network, the behavior-based heuristics specifying one or more behaviors of an application processing content while executing on an endpoint that is characteristic of a malware attack;
receiving, from at least some of the plurality of endpoints of the computer network, descriptions of content associated with an attack detected by the endpoints using the behavior-based heuristics of the distributed detection data;
generating a traffic signature for the described content associated with the attack detected by at least some of the plurality of the endpoints of the computer network by correlating the received descriptions of content associated with the attack, the correlating comprising identifying and analyzing descriptions referring to same content associated with the attack received from different endpoints, the traffic signature identifying characteristics of the content that are present when the content is carried by network traffic; and
providing the traffic signature to an inspection point, the inspection point adapted to use the traffic signature to examine network traffic passing through the inspection point to detect the described content carried by the network traffic.

### Claim 2 (depends on 1)

The method of claim 1, wherein a description of the content associated with the attack detected by an endpoint of the computer network comprises one or more of: a hash of the content, a fingerprint of the content, and a copy of the content.

### Claim 3 (depends on 1)

The method of claim 1, wherein the traffic signature specifies a string of bytes that identifies the content and can be detected in network traffic carrying the content.

### Claim 4 (depends on 1)

The method of claim 1, wherein the content associated with the attack comprises malicious software that attempted to exploit a security vulnerability in the application at the endpoint.

### Claim 5 (depends on 1)

The method of claim 1, wherein the inspection point is adapted to inspect Internet Protocol (IP) packets passing through the inspection point to detect packets having the content matching the characteristics identified by the traffic signature.

### Claim 6

A computer system for creating a traffic signature for detecting content in network traffic, comprising:
a non-transitory computer-readable storage medium storing executable computer program modules comprising:
a communications module for distributing detection data comprising behavior-based heuristics to a plurality of endpoints via a computer network, the behavior-based heuristics specifying one or more behaviors of an application processing content while executing on an endpoint that is characteristic of a malware attack;
a content collection module for receiving, from at least some of the plurality of endpoints of the computer network, descriptions of content associated with an attack detected by the plurality of the endpoints, an attack detected by an endpoint of the plurality of the endpoints using the behavior-based heuristics of the distributed detection data;
a signature creation module for generating a traffic signature for the described content associated with the attack detected by at least some of the plurality of the endpoints of the computer network by correlating the received descriptions of content associated with the attack, the correlating comprising identifying and analyzing descriptions referring to same content associated with the attack received from different endpoints, the traffic signature identifying characteristics of the content that are present when the content is carried by network traffic; and
a signature distribution module for providing the traffic signature to an inspection point, the inspection point adapted to use the traffic signature to examine network traffic passing through the inspection point to detect the described content carried by the network traffic; and
a computer processor for executing the computer program modules.

### Claim 7 (depends on 6)

The computer system of claim 6, wherein a description of the content associated with the attack detected by an endpoint of the computer network received by the content collection module comprises of one or more of: a hash of the content, a fingerprint of the content, and a copy of the content.

### Claim 8 (depends on 6)

The computer system of claim 6, wherein the traffic signature specifies a string of bytes that identifies the content and can be detected in network traffic carrying the content.

### Claim 9 (depends on 6)

The computer system of claim 6, wherein the content associated with the attack comprises malicious software that attempted to exploit a security vulnerability in the application at the endpoint.

### Claim 10 (depends on 6)

The computer system of claim 6, wherein the inspection point is adapted to inspect Internet Protocol (IP) packets passing through the inspection point to detect the content matching the characteristics identified by the traffic signature.

### Claim 11

A non-transitory computer-readable storage medium storing executable computer program modules for enabling creation of a traffic signature for detecting content in network traffic, the modules comprising:
a communication module for receiving detection data comprising behavior-based heuristics distributed by a computer server, the behavior-based heuristics specifying one or more behaviors of an application processing content while executing on an endpoint that is characteristic of a malware attack;
a monitoring module for monitoring activity of an application at the endpoint;
an attack detection module for detecting an attack on the application by analyzing activities monitored by the monitoring module, wherein the attack detection module uses the behavior-based heuristics of the distributed detection data;
a content identification module for identifying the content associated with the detected attack and for generating a description of the identified content; and
the communications module for providing the content description to a security server via a computer network;
wherein the security server is adapted to receive, from a plurality of endpoints of the computer network, descriptions of content associated with attacks detected by the endpoints, and generate a traffic signature for the described content associated with the attack detected by the endpoints by correlating the received descriptions of content associated with the attack, the correlating comprising identifying and analyzing descriptions referring to same content associated with the attack received from different endpoints, the traffic signature identifying characteristics of the content that are present when the content is carried by network traffic, and to provide the traffic signature to an inspection point, the inspection point adapted to use the traffic signature to examine network traffic passing through the inspection point to detect the described content carried by the network traffic.

### Claim 12 (depends on 11)

The computer-readable medium of claim 11, wherein the identified content comprises content processed by the application as the application renders a web page.

### Claim 13 (depends on 11)

The computer-readable medium of claim 11, wherein the description of the identified content comprises at least one of: a hash of the content, a fingerprint of the content, and a copy of the content.

### Claim 14 (depends on 13)

The computer-readable medium of claim 13, wherein the description of the identified content further comprises at least one of: an address of a web page being rendered when the attack was detected and an identifier of a heuristic that identified the attack.

### Claim 15 (depends on 11)

The computer-readable medium of claim 11, wherein the attack detection module is further for remediating the malware attack.

### Claim 16 (depends on 1)

The method of claim 1, wherein the behavior-based heuristics describe one or more behaviors of the application selected from the set consisting of:
the application crashing;
the application performing an illegal access of local resources; and
the application having memory corruption.

### Claim 17 (depends on 1)

The method of claim 1, generating the traffic signature further comprises:
determining whether the descriptions of the content were generated in response to false positive malware attacks detected by the endpoints.

### Claim 18 (depends on 1)

The method of claim 1, wherein the detection data comprises one or more signatures for detecting malware when the malware is in the format used by the application processing the content containing the malware on an endpoint.

### Claim 19 (depends on 1)

The method of claim 1, wherein the traffic signature distinctly identifies characteristics of the content carried by network traffic, wherein the content carried by network traffic is in a format different from a format of the content processed by an application on an endpoint.