Malware family identification using profile signatures
AssigneePalo Alto Networks, Inc.
InventorsKyle Sanders, Xinran Wang
Life of this patent
Estimating the term…
Abstract
A potential malware sample is received from a security device at a server associated with a security cloud service. The sample is executed in a sandbox environment on the server, including by monitoring interaction of the sample with an application program interface (API), provided by the sandbox environment, in order to obtain an API log. It is determined whether the sample is associated with a known malware family including by determining, based at least in part on the API log, if the sample created an executable file and if the sample registered the executable file in a run key. If it is determined that the sample is associated with a known malware family, then an alert is generated.
Claims12
A system, comprising:
- a security device configured to send a potential malware sample to a server associated with a security cloud service;
- and
- the server associated with the security cloud service which is configured to:
- execute the potential malware sample in a sandbox environment on the server, including by monitoring network activity initiated by the potential malware sample using a packet capture process in order to obtain observed network activity;
- determine whether the potential malware sample matches a signature profile associated with a known command and control malware family, including by comparing the signature profile and the observed network activity in order to determine if there is a pattern match between the signature profile and the observed network activity in a portion of a uniform resource identifier (URI) that is associated with a HyperText Transfer Protocol (HTTP) request;
- and
- in the event it is determined that the potential malware sample is associated with the known command and control malware family, generating an alert.
A method, comprising:
- receiving, from a security device, a potential malware sample at a server associated with a security cloud service;
- executing the potential malware sample in a sandbox environment on the server, including by monitoring network activity initiated by the potential malware sample using a packet capture process in order to obtain observed network activity;
- using the server associated with the security cloud service to determine whether the potential malware sample matches a signature profile associated with a known command and control malware family, including by comparing the signature profile and the observed network activity in order to determine if there is a pattern match between the signature profile and the observed network activity in a portion of a uniform resource identifier (URI) that is associated with a HyperText Transfer Protocol (HTTP) request;
- and
- in the event it is determined that the potential malware sample is associated with the known command and control malware family, generating an alert.
A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- receiving, from a security device, a potential malware sample at a server associated with a security cloud service;
- executing the potential malware sample in a sandbox environment on the server, including by monitoring network activity initiated by the potential malware sample using a packet capture process in order to obtain observed network activity;
- determining whether the potential malware sample matches a signature profile associated with a known command and control malware family, including by comparing the signature profile and the observed network activity in order to determine if there is a pattern match between the signature profile and the observed network activity in a portion of a uniform resource identifier (URI) that is associated with a HyperText Transfer Protocol (HTTP) request;
- and
- in the event it is determined that the potential malware sample is associated with the known command and control malware family, generating an alert.
Dependencies are inferred from the claim text.