US 9,152,789 B2Granted

Systems and methods for dynamic cloud-based malware behavior analysis

AssigneeZscaler, Inc.

InventorsSriram Natarajan, Narinder Paul, Julien Sobrier, Karthikeyan Thamilarasu, Balakrishna Bayar, Michael Andrew William Sutton

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

A cloud-based method, a behavioral analysis system, and a cloud-based security system can include a plurality of nodes communicatively coupled to one or more users, wherein the plurality of nodes each perform inline monitoring for one of the one or more users for security comprising malware detection and preclusion; and a behavioral analysis system communicatively coupled to the plurality of nodes, wherein the behavioral analysis system performs offline analysis for any suspicious content from the one or more users which is flagged by the plurality of nodes; wherein the plurality of nodes each comprise a set of known malware signatures for the inline monitoring that is periodically updated by the behavioral analysis system based on the offline analysis for the suspicious content.

Claims15

Dependent claims

A cloud-based method, comprising:

receiving known malware signatures at one or more nodes in a cloud-based system;
monitoring one or more users inline through the one or more nodes in the cloud-based system for regular traffic processing comprising malware detection and preclusion;
determining unknown content from a user of the one or more users is suspicious of being malware;
sending the unknown content to a behavioral analysis system for an offline analysis;
and
receiving updated known malware signatures based on the offline analysis determined based on a combined score computed from both a static analysis and a dynamic analysis, which is performed using a queue ordered based on the static analysis and based on content type that determines which operating system the unknown content must be executed on for the dynamic analysis, the dynamic analysis is performed as a sandbox analysis, running the unknown content in a virtual machine in a closed manner, performing packet capture, screenshot image capture, listing of files created, deleted, and/or downloaded while running the unknown content, and evaluating in the dynamic analysis, JavaScript Object Notation (JSON) data generated, temporary files generated, system and registry files modified, files added or deleted, external communications, security bypass, data leakage, persistence, and processor, network, memory and file system usages.

3 more elements

A cloud-based security system, comprising:

a plurality of nodes, having a plurality of hardware processors, communicatively coupled to one or more users, wherein the plurality of nodes are each formed by one or more servers and each perform inline monitoring for one of the one or more users for security comprising malware detection and preclusion, each node comprises a set of known malware signatures for the inline monitoring that is periodically updated by the behavioral analysis system based on the offline analysis for the suspicious content;
and
a behavioral analysis system, having a hardware processor, communicatively coupled to the plurality of nodes, wherein the behavioral analysis system performs offline analysis for any suspicious content from the one or more users which is flagged by the plurality of nodes, behavioral analysis system is configured to:
perform the offline analysis as a combination of a static analysis and a dynamic analysis;
perform the dynamic analysis as a sandbox analysis, running the suspicious content in a virtual machine in a closed manner, performing packet capture, screenshot image capture, and listing of files created, deleted, and/or downloaded while running the suspicious content;
evaluate, in the dynamic analysis, JavaScript Object Notation (JSON) data generated, temporary files generated, system and registry files modified, files added or deleted, external communications, security bypass, data leakage, persistence, and processor, network, memory and file system usages;
perform the dynamic analysis using a queue ordered based on the static analysis and based on content type, wherein the content type determines which operating system the suspicious content must be executed on for the dynamic analysis;
and
determine that unknown content is malware based on a combined score from both the static analysis and the dynamic analysis.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/225,557Filed 26 Mar 2014 · continuation in part
Priority: 28 May 2008
Published: US 2014/0208426 A124 Jul 2014
Granted: 6 Oct 2015
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements
G06F 21/562
Computer malware detection or handling, e.g. anti-virus arrangements: static detection
G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…
H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic

Family

Application12/128,481Parent of this continuation-in-part · filed 28 May 2008
Application12/354,900Parent of this continuation-in-part · filed 16 Jan 2009
US 2014/0208426 A1Pre-grant publication · published 24 Jul 2014
US 8,887,249 B1Parent of this continuation-in-part
US 9,154,475 B1Related patent
US 9,152,789 B2This patent

From the US filing history. Foreign family members aren’t listed.