Emc IP Holding Company LLC

Erik M Heuser

Arie Agranonik

Techniques are provided for automated classification of domain names resolved by malware. An exemplary method comprises obtaining a domain name included in malware domain resolution requests; obtaining a domain table identifying a plurality of known domains; obtaining a dynamic domain table identifying a plurality of dynamic Domain Name System domains; parsing a full domain name associated with the domain name from the malware domain resolution requests into a Top Level Domain and a Domain; classifying the domain from the malware domain resolution requests name as a dynamic Domain Name System domain if the Top Level Domain and the Domain are found in the dynamic domain table; and storing the classification of the domain name from the malware domain resolution requests as the dynamic Domain Name System domain in the domain table with a complete domain of the domain, a current date and time and a Time-To-Live attribute of the domain from a response of the Domain Name System.

Automated classification of domain names resolved by malware

A method includes obtaining session data related to a plurality of network sessions, analyzing the session data to identify one or more features of the network sessions, and utilizing the one or more features to aggregate the plurality of network sessions into a plurality of meta-sessions. A meta-session comprises a set of network sessions having similar features. The method also includes selecting a classifier for ranking the meta-sessions based on a scoring function that characterizes performance in ranking meta-sessions having a designated characteristic, ranking the meta-sessions utilizing the selected classifier, providing a designated number of the ranked meta-sessions for additional processing to determine potential maliciousness, and modifying access by client devices to an additional network session responsive to the additional network session comprising session data with features similar to those of one of the designated number of the ranked meta-sessions determined to be potentially malicious.

Aggregating network sessions into meta-sessions for ranking and classification

Techniques are provided for retroactively identifying malware programs when new signatures become available that later match network traffic previously obtained from the sandbox environment. An exemplary method comprises obtaining a plurality of packet capture files comprising previously captured network communications of malware programs that previously executed in a sandbox environment, wherein each of the packet capture files are associated with a corresponding malware program that generated the network communications; obtaining signatures indicative of at least one malware program; comparing the signatures to the packet capture files; and retroactively identifying a given malware program as malware if a signature matches a given packet capture file associated with the given malware program. A plurality of malware samples that were previously unidentified are optionally correlated with the given malware program based on a scan of additional packet capture files for the signature that matched the given packet capture file.

Retroactive identification of previously unknown malware based on network traffic analysis from a sandbox environment

Asynchronous techniques are provided for resolving domain names and for automated classification of domain type. An exemplary method comprises asynchronously resolving at least two known domains in parallel to obtain a current domain-to-IP address resolution for the at least two known domains, wherein a schedule of the asynchronous resolution is based on a Time-To-Live attribute of a latest domain-to-IP address resolution of the at least two known domains; determining if the current domain-to-IP address resolution matches the latest domain-to-IP address for the at least two known domains; and updating the domain-to-IP address table with the current domain-to-IP address resolution and corresponding resolution time if the current domain-to-IP address resolution does not match the latest domain-to-IP address for a given known domain. In one or more embodiments, a Time-To-Live attribute of the current domain-to-IP address resolution for the given known domain is updated in the domain table. A plurality of worker processes optionally perform the asynchronous resolution.

Growing community of inventors

Manassas, VA, United States of America

Erik M Heuser