Palo Alto Networks, Inc.

Ajaya Neupane

Yu Fu

Shengming Xu

Yanhui Jia

Durgesh Madhavrao Sangvikar

Christian Elihu Navarrete Discua

Mei Wang

Stefan Achleitner

Lei Xu

Yuwen Dai

Fikirte Ayalke Demmese

Durgesh Madhavrao Sangvilkar

A modular adversarial training data generator ('generator') generates adversarial training data for a machine learning (ML) model to detect malicious protocol data units (PDUs). The adversarial training data mimics high volume cyberattacks by perturbing PDUs to bypass malicious detection systems. For Hypertext Transfer Protocol (HTTP) PDUs, the generator rearranged, replaces, and grid searches values of HTTP header fields to generate the adversarial training data. The generator further biases grid search based on metrics for values of HTTP header fields that quantify impact of replacing the values on malicious verdicts by ML models trained on the adversarial training data.

Adversarial training for malicious protocol data unit detection with field value perturbations

Techniques for Cobalt Strike Beacon HTTP C2 heuristic detection are disclosed. In some embodiments, a system/process/computer program product for Cobalt Strike Beacon HTTP C2 heuristic detection includes monitoring HyperText Transfer Protocol (HTTP) network traffic at a firewall; prefiltering the monitored HTTP network traffic at the firewall to select a subset of the HTTP network traffic to forward to a cloud security service; determining whether the subset of the HTTP network traffic is associated with Cobalt Strike Beacon HTTP C2 traffic activity based on a plurality of heuristics; and performing an action in response to detecting the Cobalt Strike Beacon HTTP C2 traffic activity.

Cobalt Strike Beacon HTTP C2 heuristic detection

Detection of command and control malware is disclosed. A network traffic session is monitored. Automatic feature identification for real-time malicious command and control traffic detection based on a request header of the monitored network traffic session using a deep learning model is performed.

Deep learning pipeline to detect malicious command and control traffic

Cobalt strike beacon HTTP C2 heuristic detection

Growing community of inventors

San Jose, CA, United States of America

Ajaya Neupane