Palo Alto Networks, Inc.

Mengying Jiang

Ho Yu Lam

Shengming Xu

Menglan Fang

Bo Qu

Zihang Xiao

Li Meng

Zhibin Zhang

Sultanbek Omurzakov

Lexuan Sun

Inline detection of ransomware attacks using network traffic, such as server message block (SMB) traffic, is disclosed. A network communication between a client and a server is received. A determination is made, using the received network traffic, that a ransomware attack is being attempted against the server. In response to detecting the attempted ransomware attack, a remedial action is performed.

Inline ransomware detection via server message block (SMB) traffic

Separating awareness of multipart file transmissions of different applications from traffic handling at a granularity of an individual application layer session facilitates efficient cybersecurity enforcement on multipart file transmissions. A protocol-based multipart file transmission regulator ('regulator') determines a per session message handling action to prevent completion of a multipart file transmission based on a protocol of an application identified for the session until cybersecurity analysis can be performed. The regulator then communicates the message handling action to a network component supporting the session. The regulator maintains information and file chunks in a data store for active sessions and determines with the data store whether a condition for requesting cybersecurity analysis for a multipart file transmission is satisfied. Upon obtaining a cybersecurity analysis verdict, the regulator provides the verdict or a verdict based instruction to the network component that ensures the multipart file transmission is compliant with a cybersecurity policy(ies).

Inline inspection cybersecurity enforcement of multipart file transmissions

A cloud-based traffic classification engine maintains a catalog of application-based traffic classes which have been developed based on known applications, and a local traffic classification engine maintains a subset of these classes. Network traffic intercepted by the firewall which cannot be classified by the local engine is forwarded to the cloud-based engine for classification. Upon determination of a class of the traffic, the cloud-based engine forwards the determined class and corresponding signature to the local engine. The firewall maintains a cache which is updated with the signatures corresponding to the class communicated by the cloud-based engine. Subsequent network traffic sent from the application can be determined to correspond to the application and classified according locally at the firewall based on the cached signatures. Localization of the cache to the firewall reduces latency of traffic classification operations as the catalog of classification information stored in the cloud scales.

Increased coverage of application-based traffic classification with local and cloud classification services

Growing community of inventors

Campbell, CA, United States of America

Mengying Jiang