Back to results
US 9,805,193 B1Granted
Collecting algorithmically generated domains
AssigneePalo Alto Networks, Inc.
InventorsRyan C. Salsamendi, Robert A. Seger
Life of this patent
Estimating the term…
Abstract
Generating a set of attempted external contacts associated with a malware sample is disclosed. A malware sample is executed, in an accelerated computing environment. In the accelerated computing environment, a guest time is advanced more quickly than a time by which a host time is advanced. A set of one or more attempted external contacts generated by the executing malware sample is recorded. The set of attempted external contacts is provided as output.
Claims36
A system, comprising:
- a processor configured to:
- execute, in an accelerated computing environment comprising a non-virtualized platform, a malware sample, wherein a guest time associated with the accelerated computing environment is advanced by an operating system such that the guest time advances faster than a host time advances and such that the malware is unable to detect that a current guest time is different from a current host time, and wherein the operating system associated with the accelerated computing environment is configured to accelerate the guest time using at least one of a time interrupt customization and a time polling customization;
- record a set of attempts made by the executing malware sample to contact external resources, wherein at least some of the resources the executing malware sample attempts to contact are algorithmically generated domain names, generated by the executing malware;
- and
- provide the set of attempted external contacts as output;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
4 more elements
A method, comprising:
- executing, in an accelerated computing environment comprising a non-virtualized platform, a malware sample, wherein a guest time associated with the accelerated computing environment is advanced by an operating system such that the guest time advances faster than a host time advances and such that the malware is unable to detect that a current guest time is different from a current host time, and wherein the operating system associated with the accelerated computing environment is configured to accelerate the guest time using at least one of a time interrupt customization and a time polling customization;
- recording a set of attempts made by the executing malware sample to contact external resources, wherein at least some of the resources the executing malware sample attempts to contact are algorithmically generated domain names, generated by the executing malware;
- and
- providing the set of attempted external contacts as output.
1 more element
Dependencies are inferred from the claim text.