Palo Alto Networks, Inc.

Janos Szurdi

Daiping Liu

Jun Wang

Mohamed Yoosuf Mohamed Nabeel

George Morrison Jones

Arun Bala Kumar

Rebekah Houser

Shehroze Farooqi

The present application discloses a method, system, and computer system for detecting stockpiled domains. The method includes (i) determining that a candidate domain is a malicious stockpiled domain using one or more of (a) a fingerprinting classification, (b) a heuristics-based classification, and (c) a machine learning classification, and (ii) applying a security policy based on a classification of the candidate domain as the malicious stockpiled domain.

Methods to detect malicious stockpiled domain names

A method and system for detecting shadowed domains is provided. New hostnames are collected for a predetermined period of time. Candidate shadowed domains are selected from the new hostnames. Classification of the candidate shadowed domains is performed based on a plurality of features relating to the candidate shadowed domains to output a set of identified shadowed domains. An action is performed based on the set of identified shadowed domains.

Detecting shadowed domains

Techniques for generating actionable indicators of compromise (IOCs) are disclosed. A set of potential sources for IOCs are received. One or more candidate IOCs are extracted from at least one source included in the set of potential sources. An actionable IOC is automatically identified from the one or more candidate IOCs. The actionable IOC is provided to a security enforcement service.

Automated extraction and classification of malicious indicators

Growing community of inventors

Santa Clara, CA, United States of America

Janos Szurdi