Palo Alto Networks, Inc.

Bo Qu

ChienHua Lu

Tao Yan

Jiangxia Liu

Kyle Sanders

Xinran Wang

Zhanglin He

Jin Chen

Zhibin Zhang

Xin Ouyang

Taojie Wang

Shengming Xu

Stefan Achleitner

Yu Fu

Lei Xu

Mengying Jiang

Sultanbek Omurzakov

Rongbo Shao

Edouard Bochin

Michael Harbison

Amy Lee

Inline detection of ransomware attacks using network traffic, such as server message block (SMB) traffic, is disclosed. A network communication between a client and a server is received. A determination is made, using the received network traffic, that a ransomware attack is being attempted against the server. In response to detecting the attempted ransomware attack, a remedial action is performed.

Inline ransomware detection via server message block (SMB) traffic

The present application discloses a method, system, and computer system for detecting malicious SQL or command injection strings. The method includes obtaining an SQL or command injection string and determining whether the command injection string is malicious based at least in part on a machine learning model.

Network attack detection with targeted feature extraction from exploit tools

The present application discloses a method, system, and computer system for detecting Return Oriented Programming (ROP) exploits. The method includes (i) intercepting, by one or more processors, a memory attribute change function for a sample; (ii) determining if a return address is associated with a shellcode address, and (iii) in response to determining that the return address is associated with the shellcode address, determining that the sample is an ROP exploit.

Return address validation watchdog to discover ROP chains in exploits engineering cloud delivered security services (CDSS)

Techniques for application identification for phishing detection are disclosed. In some embodiments, a system/process/computer program product for application identification for phishing detection includes monitoring network activity associated with a session to detect a request to access a site; determining advanced application identification associated with the site; and identifying the site as a phishing site based on the advanced application identification.

Application identification for phishing detection

Detection of malicious JavaScript based on automated user interaction emulation is disclosed. A malware sample is executed in an instrumented virtual environment. Dynamic behavior is triggered based on emulated user interactions.

Malicious JS detection based on automated user interaction emulation

Techniques for rendering an object using multiple versions of an application in a single process for dynamic malware analysis are disclosed. In some embodiments, a system, process, and/or computer program product for rendering an object using multiple versions of an application in a single process for dynamic malware analysis includes receiving a sample at a cloud security service, in which the sample includes an embedded object; detonating the sample using a browser executed in an instrumented virtual machine environment; and rendering the embedded object using a plurality of versions of an application in a single process during a dynamic malware analysis using the instrumented virtual machine environment.

Rendering an object using multiple versions of an application in a single process for dynamic malware analysis

Various techniques for detection of malware using an instrumented virtual machine environment are disclosed. In some embodiments, detection of malware using an instrumented virtual machine environment includes instantiating a first virtual machine in the instrumented virtual machine environment, in which the first virtual machine is configured to support installation of two or more versions of a resource; installing a first version of the resource on the first virtual machine and monitoring the instrumented virtual machine environment while executing the first version of the resource with a malware sample opened using the first version of the resource; and installing a second version of the resource on the first virtual machine and monitoring the instrumented virtual machine environment while executing the second version of the resource with the malware sample opened using the second version of the resource.

Detection of malware using an instrumented virtual machine environment

Rendering an object using muliple versions of an application in a single process for dynamic malware analysis

Various techniques for detection of malware that attempt to exploit a memory allocation vulnerability are disclosed. In some embodiments, a system, process, and/or computer program product for detecting an attempt to exploit a memory allocation vulnerability includes receiving a malware sample; monitoring an array operation performed by the malware sample using a memory monitoring component; and determining whether the array operation performed by the malware sample is suspicious. For example, an array operation, such as a vector operation performed by an application that is executed using an ActionScript virtual machine, can be monitored to detect any suspicious vector operations.

Detecting an attempt to exploit a memory allocation vulnerability

Various techniques for performing malware analysis of a URL (e.g., a URL sample) using a browser executed in an instrumented virtual machine environment are disclosed. In some embodiments, a system for performing dynamic malware analysis of a URL using a browser executed in an instrumented virtual machine environment includes the instrumented virtual machine environment executed on a processor that receives a URL sample for dynamic malware analysis using the browser executed in the instrumented virtual machine environment; and a dynamic time allocator executed on the processor that dynamically determines a period of time allocated for performing the dynamic malware analysis of the URL sample using the browser executed in the instrumented virtual machine environment, in which the URL sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for the period of time allocated for performing the dynamic malware analysis of the URL sample.

Dynamic malware analysis of a URL using a browser executed in an instrumented virtual machine environment

A candidate malware that potentially includes at least one malicious element is received. The candidate malware is executed using a virtualized environment. A determination is made that the candidate malware, while executing using the virtualized environment, has taken at least one anti-virtual machine action, wherein the anti-virtual machine action is indicative of an attempt by the candidate malware to evade detection of the malicious element by the system when the candidate malware is executed using a virtualized environment. In response to the determination, an alert that the candidate malware is malicious is generated as output.

Detecting malware

Various techniques for exploit detection based on heap spray detection are disclosed. In some embodiments, exploit detection based on heap spray detection includes executing a program in a virtual environment; and detecting heap spray in memory while executing the program in the virtual environment. In some embodiments, exploit detection based on heap spray detection includes executing a program in a virtual environment; and detecting heap spray related malware in response to a modification of an execution environment in the virtual environment.

Growing community of inventors

Fremont, CA, United States of America

Bo Qu