Palo Alto Networks, Inc.

Auradine, Inc.

Aurascape

Ho Yu Lam

Taylor Ettema

Robert Earle Ashley

Suiqiang Deng

Xuanyu Jin

Robert Tesh

Qiuming Li

Paul Mathison

William Redington Hewlett, Ii

Sheng Yang

Shengming Xu

Mengying Jiang

Menglan Fang

Shu Lin

Liang Li

Viswesh Ananthakrishnan

Huijun Veronica Zhu

Shujun Zhao

Nidhi Shah

Paul Theodore Mathison

Detection of malicious files is disclosed. A set comprising a plurality of sample classification models is received and stored. A determination is made that n-gram analysis should be performed on a sequence of received packets associated with a received file. Performing the n-gram analysis includes using a determined filetype associated with the sequence of received packets to select at least one stored sample classification model included in the set for use in performing the n-gram analysis. A determination is made that the received file is malicious based at least in part on the n-gram analysis of the sequence of received packets. In response to determining that the file is malicious, propagation of the received file is prevented.

Inline malware detection

A method includes: accessing, at a security proxy, a first transaction of a communications session between a client device and an application hosted by a server; clustering the first transaction with a plurality of other transactions for the application, based on a common data feature of the first transaction and the plurality of other transactions; providing structured data including indications of the clustering and the common data feature as input to a natural language processing (NLP) machine learning model; and based on one or more outputs of the NLP machine learning model, identifying the application, identifying a content type of a portion of data in the first transaction, and, based on the identified content type, generating a recipe for decoding network data corresponding to the application.

Network data decoding and encoding

An apparatus, having a server and processor, is configured to receive a first set of security rules applicable to a set of users or a set of files for a first period of time. The first set of security rules are executable in an order of priority. The processor receives an interim security policy that is different from the first set of security rules. The interim security policy is applicable to a subset of the set of users for a second period of time that is less than the first period, or a subset of the set of files for a second period of time that is less than the first period. The processor determines, in the first set of security rules, an insertion point among the order of priority. The processor executes, at the insertion point and in the first set of security rules, the interim security policy.

Systems and methods for implementing interim security policies

Techniques for outbound/inbound lateral traffic punting based upon process risk are disclosed. In some embodiments, a system/process/computer program product for outbound/inbound lateral traffic punting based upon process risk includes receiving, at a network device on an enterprise network, process identification (ID) information from an endpoint (EP) agent executed on an EP device, in which the process ID information identifies a process that is associated with an outbound or inbound network session on the EP device on the enterprise network, and the EP agent selected the network session for punting to the network device for inspection; monitoring network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session; and performing an action based on a security policy using the process ID information and the APP ID.

Outbound/inbound lateral traffic punting based on process risk

A cloud-based traffic classification engine maintains a catalog of application-based traffic classes which have been developed based on known applications, and a local traffic classification engine maintains a subset of these classes. Network traffic intercepted by the firewall which cannot be classified by the local engine is forwarded to the cloud-based engine for classification. Upon determination of a class of the traffic, the cloud-based engine forwards the determined class and corresponding signature to the local engine. The firewall maintains a cache which is updated with the signatures corresponding to the class communicated by the cloud-based engine. Subsequent network traffic sent from the application can be determined to correspond to the application and classified according locally at the firewall based on the cached signatures. Localization of the cache to the firewall reduces latency of traffic classification operations as the catalog of classification information stored in the cloud scales.

Increased coverage of application-based traffic classification with local and cloud classification services

Generating models usable by data appliances to perform inline malware analysis is disclosed. A set of features, including a plurality of n-grams, extracted from a set of files is received. A reduced set of features is determined that includes at least some of the plurality of n-grams. The reduced set of features is used to generate a model usable by a data appliance to perform inline malware analysis.

Generating models for performing inline malware detection

Detection of malicious files is disclosed. A set comprising one or more sample classification models is stored on a networked device. N-gram analysis is performed on a sequence of received packets associated with a received file. Performing the n-gram analysis includes using at least one stored sample classification model. A determination is made that the received file is malicious based at least in part on the n-gram analysis of the sequence of received packets. In response to determining that the file is malicious, propagation of the received file is prevented.

Techniques for fine-grained firewall policy enforcement using session APP ID and endpoint process ID correlation are disclosed. In some embodiments, a system/process/computer program product for fine-grained firewall policy enforcement using session APP ID and endpoint process ID correlation includes receiving, at a network device on an enterprise network, process identification (ID) information from an endpoint (EP) agent executed on an EP device, in which the process identification information identifies a process that is initiating a network session from the EP device on the enterprise network; monitoring network communications associated with the network session at the network device to identify an application identification (APP ID) for the network session; and performing an action based on a security policy using the process ID information and the APP ID.

Fine-grained firewall policy enforcement using session app ID and endpoint process ID correlation

Techniques for credentials enforcement using a firewall are disclosed. In some embodiments, a system, process, and/or computer program product for enforcement using a firewall includes storing a plurality of user credentials at a network device; monitoring network traffic at the network device to determine if there is a match with one or more of the plurality of user credentials; and performing an action if the match is determined.

Credentials enforcement using a firewall

Techniques for an efficient and secure store for credentials enforcement using a firewall are disclosed. In some embodiments, a system, process, and/or computer program product for an efficient and secure store for credentials enforcement using a firewall includes receiving a space-efficient and secure data structure, such as bloom filter, from an agent executed on an authentication server, in which the bloom filter is generated by the agent based on a transformation of a plurality of user credentials extracted from the authentication server and/or intercepted at the authentication server; storing the bloom filter on the network device (e.g., in a cache on the network device); and monitoring network traffic at the network device to perform credentials enforcement using the bloom filter.

Growing community of inventors

Santa Clara, CA, United States of America

Ho Yu Lam