Deduplicating malware
AssigneePalo Alto Networks, Inc.
InventorsRyan C. Salsamendi, Wei Xu
Life of this patent
Estimating the term…
Abstract
Detecting duplicate malware samples is disclosed. A first guest clock is set to a first value in a first virtual machine instance. A first malware sample is executed in the first virtual machine instance. A second guest clock value is set to the first value in a second virtual machine instance. A second malware sample is executed in the second virtual machine instance. A determination is made as to whether the first malware sample and the second malware sample are the same, based at least in part on performing a comparison of attempted external contacts generated by executing each of the respective first and second malware samples.
Claims40
A system, comprising:
- a processor configured to:
- set a first guest clock to a first value in a first virtual machine instance and execute a first malware sample in the first virtual machine instance;
- set a second guest clock value to the first value in a second virtual machine instance and execute a second malware sample in the second virtual machine instance;
- and
- perform a comparison of attempted external contacts generated by executing each of the respective first and second malware samples, and determine that the first malware sample and the second malware sample are the same, based at least in part by determining that a threshold number of duplicate attempted external contacts were generated by both the first malware sample and the second malware sample;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- setting a first guest clock to a first value in a first virtual machine instance and executing a first malware sample in the first virtual machine instance;
- setting a second guest clock value to the first value in a second virtual machine instance and executing a second malware sample in the second virtual machine instance;
- and
- performing a comparison of attempted external contacts generated by executing each of the respective first and second malware samples, and determining that the first malware sample and the second malware sample are the same, based at least in part by determining that a threshold number of duplicate attempted external contacts were generated by both the first malware sample and the second malware sample.
A system, comprising:
- a processor configured to:
- set a first guest clock to a first value in a first virtual machine instance and execute a first malware sample in the first virtual machine instance;
- set a second guest clock value to the first value in a second virtual machine instance and execute a second malware sample in the second virtual machine instance;
- and
- perform a comparison of attempted external contacts generated by executing each of the respective first and second malware samples, and determine that the first malware sample and the second malware sample are the same, based at least in part by determining that a threshold sequence of attempted external contacts was generated by both the first malware sample and the second malware sample;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- setting a first guest clock to a first value in a first virtual machine instance and executing a first malware sample in the first virtual machine instance;
- setting a second guest clock value to the first value in a second virtual machine instance and executing a second malware sample in the second virtual machine instance;
- and
- performing a comparison of attempted external contacts generated by executing each of the respective first and second malware samples, and determining that the first malware sample and the second malware sample are the same, based at least in part by determining that a threshold sequence of attempted external contacts was generated by both the first malware sample and the second malware sample.
Dependencies are inferred from the claim text.