Palo Alto Networks, Inc.

Taojie Wang

Jin Chen

Bo Qu

Shengming Xu

Stefan Achleitner

Yanhui Jia

Tao Yan

Hui Gao

Matthew W Tennis

Mengying Hu

Yue Guan

Various techniques for detecting obfuscated web skimmers based on encoding and hooking are disclosed. In some embodiments, a system/process/computer program product for detecting obfuscated web skimmers based on encoding and hooking includes receiving a sample; performing static analysis on the sample using encoded web skimmer detection rules (e.g., encoded using a plurality of encoding methods); performing dynamic analysis on the sample using hooking; and detecting an obfuscated web skimmer based on results of the static analysis using the encoded web skimmer detection rules and/or the dynamic analysis using hooking.

Detecting obfuscated web skimmers based on encoding and hooking

Detection of malicious JavaScript based on automated user interaction emulation is disclosed. A malware sample is executed in an instrumented virtual environment. Dynamic behavior is triggered based on emulated user interactions.

Malicious JS detection based on automated user interaction emulation

Techniques for sample traffic based self-learning malware detection are disclosed. In some embodiments, a system/process/computer program product for sample traffic based self-learning malware detection includes receiving a plurality of samples for malware detection analysis using a sandbox; executing each of the plurality of samples in the sandbox and monitoring network traffic during execution of each of the plurality of samples in the sandbox; detecting that one or more of the plurality of samples is malware based on automated analysis of the monitored network traffic using a command and control (C2) machine learning (ML) model if there is not a prior match with an intrusion prevention system (LPS) signature; and performing an action in response to detecting that the one or more of the plurality of samples is malware based on the automated analysis of the monitored network traffic using the C2 ML model. In some embodiments, the IPS signatures and C2 ML model are automatically generated and trained.

Sample traffic based self-learning malware detection

Techniques for sample traffic based self-learning malware detection are disclosed. In some embodiments, a system/process/computer program product for sample traffic based self-learning malware detection includes receiving a plurality of samples for malware detection analysis using a sandbox; executing each of the plurality of samples in the sandbox and monitoring network traffic during execution of each of the plurality of samples in the sandbox; detecting that one or more of the plurality of samples is malware based on automated analysis of the monitored network traffic using a command and control (C2) machine learning (ML) model if there is not a prior match with an intrusion prevention system (IPS) signature; and performing an action in response to detecting that the one or more of the plurality of samples is malware based on the automated analysis of the monitored network traffic using the C2 ML model. In some embodiments, the IPS signatures and C2 ML model are automatically generated and trained.

Growing community of inventors

San Jose, CA, United States of America

Taojie Wang