Palo Alto Networks, Inc.

Shadi Rostami-Hesarsorkh

Farshad Rostamabadi

Sudarshan Vasudevan

William Redington Hewlett, Ii

Huagang Xie

Lin Xu

Zhi Xu

Michael Soren Jacobsen

Seokkyung Chung

Lee Klarich

Bilal Malik

William Hewlett

Redington William Hewlett

Techniques for automatically grouping malware based on artifacts are disclosed. In some embodiments, a system, process, and/or computer program product for automatically grouping malware based on artifacts includes receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis; processing the log files to extract features associated with malware; clustering the plurality of samples based on the extracted features; and performing an action based on the clustering output.

Automatically grouping malware based on artifacts

Techniques for categorizing mobile uniform resource locators (URLs) that are used by mobile applications are disclosed. A URL is extracted from a mobile application. A category for the URL is determined based on a categorization of the mobile application. The URL and its determined category are then generated as output.

Mobile URL categorization

Techniques for alerting and tagging using a malware analysis platform for threat intelligence made actionable are disclosed. In some embodiments, a system, process, and/or computer program product for alerting and tagging using a malware analysis platform for threat intelligence made actionable includes receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis; processing the log files to extract artifacts associated with the log files; determining whether a tag matches any of the plurality of samples based on the artifacts; and performing an action based on whether the tag matches any of the plurality of samples.

Alerting and tagging using a malware analysis platform for threat intelligence made actionable

Techniques for automatically determining whether malware samples are similar are disclosed. In some embodiments, a system, process, and/or computer program product for automatically determining whether malware samples are similar includes receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis; comparing the log files based on the automated malware analysis; determining whether any of the plurality of samples are similar based on the comparison of the log files based on the automated malware analysis; and performing an action based on determining that at least two samples are similar.

Automatically determining whether malware samples are similar

Techniques for a malware analysis platform for threat intelligence made actionable are disclosed. In some embodiments, a system, process, and/or computer program product for a malware analysis platform for threat intelligence made actionable includes receiving a plurality of samples for performing automated malware analysis to generate log files based on the automated malware analysis; processing the log files to determine artifacts associated with malware; and performing an action based on an artifact.

Malware analysis platform for threat intelligence made actionable

Categorizing mobile uniform resource locators (URLs) used by a mobile application is disclosed. A plurality of URLs is extracted from the mobile application. A category is assigned to at least one URL included in the plurality of URLs. The category is assigned to the URL based on a categorization of the mobile application.

A first unclassified uniform resource locator (URL) is received. An originally primary bloom filter is initialized. A second bloom filter is initialized. In response to receiving a 'no match' result from querying the primary bloom filter for the received first unclassified URL, insert operations are performed on both the originally primary bloom filter and the secondary bloom filter. At a time subsequent to inserting the first unclassified URL into both the originally primary and secondary bloom filters, a determination is made that a false positive rate associated with the originally primary bloom filter exceeds a threshold. In response to the determination, the secondary bloom filter is designated as a replacement primary.

Probabilistic duplicate detection

Techniques for detecting encrypted tunneling traffic are disclosed. In some embodiments, detecting encrypted tunneling traffic includes monitoring encrypted network communications between a client and a remote server, in which the encrypted network communications are encrypted using a first protocol (e.g., Secure Shell (SSH) protocol or another protocol for encrypted network communications); and determining if the client sends a request to create a tunnel using the first protocol with the remote server. In some embodiments, detecting encrypted tunneling traffic further includes performing an action in response to determining that the client sent a request to create a tunnel using the first protocol with the remote server.

Detecting encrypted tunneling traffic

Encrypted peer-to-peer detection is provided. In some embodiments, encrypted peer-to-peer detection includes monitoring network traffic from a first client to determine whether the first client is executing a peer-to-peer application; and generating network traffic that emulates peer-to-peer network traffic sent from the peer-to-peer application executing on the first client to a second client after detecting unknown network traffic sent from the first client to the second client. In some embodiments, encrypted peer-to-peer detection includes monitoring network traffic from a client to determine that the client is sending a request for information for a peer-to-peer application executing on the client; and generating a network traffic response to the client that emulates peer-to-peer network traffic.

Growing community of inventors

Los Altos, CA, United States of America

Shadi Rostami-Hesarsorkh