Palo Alto Networks, Inc.

Vmware, Inc.

Apple Inc.

Danisco US Inc.

Wei Xu

Pratap Subrahmanyam

Rajesh Venkatasubramanian

Richard Ray Bott

Jun Wang

Huagang Xie

Xinran Wang

Yanxin Zhang

Alok Nemchand Kataria

Kyle Sanders

Zhaoyan Xu

Daiping Liu

Nir Zuk

Jeffrey W Sheldon

Rakesh Agarwal

Radu Rugina

Xin Ouyang

David A Dunn

Martin Walter

Yuchen Zhou

Seokkyung Chung

Ryan C Salsamendi

Xin Xu

Vivek Mohan Thampi

Fan Fei

Bryan Tan

Suquan Li

Ben Hua

Michael Edward Weber

Tao Ren

Xiaoxin Chen

Mohamed Hassan Abu-Rahma

Kiran Tati

Adrian Drzewiecki

Rohan U Mandrekar

Shuai Jiang

Victor Zyuban

Oded Horovitz

Per Hakan Hammarlund

Qasim Ali

Jamie L Langlinais

Ling Hua

Frederick Joseph Jacobs

Zhanhao Chen

Jaroslav Raszka

Alexander B Uan-Zo-li

Ophir Rachman

Martim Carbone

Danfeng Song

Sambasivan Narayan

Zhengzheng Zou

Sung J Kim

James S Mattson

James S Mattson, Jr

Robert O Bruckner

Hans L Yeager

Zhongmei Tang

Zhen Qian

Zhiyong Xie

Bo Zhang

Guoqing Liu

Detection of algorithmically generated domains is disclosed. A DNS query is received. Markov Chain analysis is performed on a domain included in the received query. A determination of whether the received query implicates an algorithmically generated domain is made based at least in part on a result of the Markov Chain analysis.

In-line detection of algorithmically generated domains

Analysis of samples for maliciousness is disclosed. A sample is executed and one or more network activities associated with executing the sample are recorded. The recorded network activities are compared to a malware profile. The malware profile comprises a set of network activities taken by a known malicious application during execution of the known malicious application. A verdict of 'malicious' is assigned to the sample based at least in part on a determination that the recorded network activities match the malware profile.

Context profiling for malware detection

The present application discloses a method, system, and computer system for predicting responses to DNS queries. The method includes receiving a DNS query comprising a subdomain portion and a root domain portion from a client device, determining whether to obtain target address information corresponding to the DNS from a predictive cache, in response to determining to obtain the target address information from the predictive cache, obtaining the target address information from the predictive cache, and providing the target address information to the client device.

Predictive DNS cache to improve security and performance

Techniques for malware detection using watermark cookies are disclosed. In some embodiments, a system, process, and/or computer program product for malware detection using watermark cookies includes receiving a sample at a cloud security service; injecting a watermark cookie in a virtual environment to provide a modified virtual environment; detonating the sample in the modified virtual environment, wherein the modified virtual environment is instrumented for monitoring activities associated with the sample during automated malware analysis of the sample; detecting whether the watermark cookie was accessed in the modified virtual environment during the automated malware analysis of the sample; and determining whether the sample is malware based on whether the watermark cookie was accessed in the modified virtual environment.

Malware detection using watermark cookies

Automatic generation of network signatures is disclosed. Network profiles for malware samples are generated. Network signature candidates are selected based on the network profiles. The network signature candidates are automatically evaluated to automatically generate a new set of network signatures. The new set of network signatures is distributed to a security device/service to enforce the new set of network signatures to detect malware.

Automatic network signature generation

A power delivery sub-system included in a computer system employs a primary voltage regulator circuit that generates a primary supply voltage on a primary power supply node. The power delivery sub-system also includes multiple bypass voltage regulator circuits that source corresponding bypass currents to a local power supply nodes in an integrated circuit. The integrated circuit includes multiple circuit blocks coupled to corresponding ones of the local power supply nodes, and multiple local voltage regulator circuits coupled to the primary power supply node. When a voltage level of a given local power supply node drops below a threshold value, a corresponding local voltage regulator circuit sources a supply current to the given local power supply node.

Merged power delivery

The technology presented herein enables the use of a clustering algorithm to identify additional malicious domains based on known malicious domains. A domain identifier system identifies a first plurality of domain names associated with a malicious domain campaign and seeding a first clustering algorithm with the first plurality of domain names. After seeding the first clustering algorithm, the domain identifier system uses the first clustering algorithm to process passive domain name system (DNS) records to identify and group a second plurality of domain names associated with the malicious domain campaign.

Identification of malicious domain campaigns using unsupervised clustering

Credential phishing attack mitigation is disclosed. A URL that is associated with a suspected credential phishing web page is received. The suspected credential phishing web page is one that includes at least one element soliciting at least one credential. The URL is included in a message having at least one intended recipient. An artificial credential is provided to the suspected credential phishing web page. An indication is received that, subsequent to providing the artificial credential to the suspected credential phishing web page, an attempted use of the artificial credential to access a resource was made. In response to receiving the indication that the attempted use of the artificial credential to access the resource has been made, at least one remedial action is taken with respect to the suspected credential phishing web page.

Mitigating phishing attempts

A malware profile is received. The malware profile comprises a set of n-tuples of attributes that describe one or more activities associated with executing a copy of a known malicious application that is associated with the malware profile. A set of one or more log entries is analyzed for a set of entries that matches the malware profile. Based at least in part on identifying the set of entries matching the malware profile, a determination is made that a host was compromised. In response to determining that the host has been compromised, a remedial action is taken with respect to the host.

Context for malware forensics and detection

Malicious domain finding using DNS query pattern analysis is disclosed. A first DNS query signature and a second DNS query signature are generated, using a set of DNS query records. The first and second DNS query signatures are compared, and the second DNS query signature is identified as malicious based on a detected match between the first and second DNS query signatures.

Finding malicious domains with DNS query pattern analysis

Mechanisms to protect the integrity of memory of a virtual machine are provided. The mechanisms involve utilizing certain capabilities of the hypervisor underlying the virtual machine to monitor writes to memory pages of the virtual machine. A guest integrity driver communicates with the hypervisor to request such functionality. Additional protections are provided for protecting the guest integrity driver and associated data, as well as for preventing use of these mechanisms by malicious software. These additional protections include an elevated execution mode, termed 'integrity mode,' which can only be entered from a specified entry point, as well as protections on the memory pages that store the guest integrity driver and associated data.

Techniques for protecting memory pages of a virtual computing instance

Growing community of inventors

Santa Clara, CA, United States of America

Wei Xu