Palo Alto Networks, Inc.

William Redington Hewlett, Ii

Brody James Kutt

Oleksii Starov

Yuchen Zhou

Fang Liu

Seokkyung Chung

Shadi Rostami-Hesarsorkh

Farshad Rostamabadi

Min Du

Sheng Yang

Lin Xu

Wenjun Hu

Ho Yu Lam

Suiqiang Deng

Sudarshan Vasudevan

Nandini Ramanan

Wei Cao

Dao-Chen Zheng

Shangde Zhou

Sujit Rokka Chhetri

Zhi Xu

Lee Klarich

Tyler Pals Halfpop

Peng Peng

Yijie Sui

Anirudh Mittal

Ashwin Kumar Dewan

Manish Mradul

Tung-Ling Li

Shan Huang

Anurag Mukund Phadke

Mrunmayi Bharat Nandgaonkar

Sreejith Rajkumar

An automated software-as-a-service (SaaS) security posture management (SSPM) system disclosed herein detects and maintains security posture for SaaS applications according to correct implementation of configuration settings. Based on detecting a previously unseen SaaS application with unknown implementation of configuration settings, the SSPM system scrapes the Internet for web content for the SaaS application and preprocesses/inputs the web content into a machine learning model to obtain predictions of correct/incorrect implementation of configuration settings as output. Based on the predictions not having sufficiently high confidence, the SSPM system obtains additional application content by logging into the SaaS application and scraping locally rendered pages therein. The application content is preprocessed/input to the machine learning model to obtain additional high confidence predictions.

Automated machine learning-based detection of correct implementations for configuration settings of software-as-a-service applications

Techniques for using deep learning to identify malicious image files are disclosed. A plurality of sections of a first image are received. The received sections are used to determine a likelihood that the first image is malicious. The determination is made, at least in part, using a model trained using a set of sections extracted from a set of sample images. A verdict is provided for the first image.

Deep learning for malicious image file detection

An identification of an item that was misclassified by a classification model constructed in accordance with a machine learning technique is received. One example of such a machine learning technique is a random forest. A subset of training data, previously used to construct the model, and that is associated with the item is identified. At least a portion of the identified subset is provided as output.

Data blaming

Detection of malicious files is disclosed. A set comprising a plurality of sample classification models is received and stored. A determination is made that n-gram analysis should be performed on a sequence of received packets associated with a received file. Performing the n-gram analysis includes using a determined filetype associated with the sequence of received packets to select at least one stored sample classification model included in the set for use in performing the n-gram analysis. A determination is made that the received file is malicious based at least in part on the n-gram analysis of the sequence of received packets. In response to determining that the file is malicious, propagation of the received file is prevented.

Inline malware detection

A set of features including a first feature and a second feature is received at a server. A subset of the set of features is determined for use in generating a model usable by a device to locally make a malware classification decision. The device has reduced computing resources as compared to computing resources of the server. The subset of the set of features is used to generate the model. The generated model includes the first feature and does not include the second feature. A determination is made, at a time subsequent to the generation of the model, that an updated model should be deployed to the device. An updated model is generated.

Specific file detection baked into machine learning pipelines

The present application discloses a method, system, and computer system for classifying stream data at an edge device. The method includes obtaining a stream of a file at the edge device, processing a set of chunks associated with the stream of the file using a machine learning model, and classifying, at the edge device, the file before processing an entirety of the file.

Machine learning architecture for detecting malicious files using stream of data

The present application discloses a method, system, and computer system for classifying stream data at an edge device. The method includes obtaining a stream of a file at the edge device, aligning a predetermined amount of data in chunks associated with the stream of the file, processing a plurality of aligned chunks associated with the stream of the file using a machine learning model, and classifying, at the edge device, the file based at least in part on a classification of the plurality of aligned chunks.

Automated attribute scraping for security feature implementation with a single trained machine model across security features improves prediction quality and efficiency of predictions. A security feature implementation prediction system (system) generates search engine queries for each security feature based on high importance tokens for the security feature. The system ranks URLs returned from each search engine query for relevance, then preprocess and inputs content for top-ranked URLs into the trained machine learning models. The system identifies implemented security features output based on confidence values output by the trained machine learning model and identifies sentences that describe the implementations in corresponding content for top-ranked URLs.

Automated attribute scraping for security feature implementation prediction

A URL categorization query is received. The URL categorization query includes at least one URL. The URL is used to determine a set of data distribution keys. A distributed key-value data store is queried using at least one data distribution key included in the determined set of data distribution keys. Categorization information is returned. The returned URL categorization information can be used to enforce policies.

Communicating URL categorization information

Malware signature generation through combination rule mining is disclosed. A set of properties associated, collectively, with a plurality of data samples is received. A first data sample has a first set of properties and a second data sample has a second set of properties. A combination signature comprising at least a first property included in the first set of properties and a second property included in the second set of properties is generated.

Combination rule mining for malware signature generation

Techniques for providing innocent until proven guilty (IUPG) solutions for building and using adversary resistant and false positive resistant deep learning models are disclosed. In some embodiments, a system, process, and/or computer program product includes storing a set comprising one or more innocent until proven guilty (IUPG) models for static analysis of a sample; performing a static analysis of content associated with the sample, wherein performing the static analysis includes using at least one stored IUPG model; and determining that the sample is malicious based at least in part on the static analysis of the content associated with the sample, and in response to determining that the sample is malicious, performing an action based on a security policy.

Innocent until proven guilty (IUPG): adversary resistant and false positive resistant deep learning models

Techniques for providing deep learning for malicious URL classification (URLC) using the innocent until proven guilty (IUPG) learning framework are disclosed. In some embodiments, a system, process, and/or computer program product includes storing a set comprising one or more innocent until proven guilty (IUPG) models for static analysis of a sample; performing a static analysis of one or more URLs associated with the sample, wherein performing the static analysis includes using at least one stored IUPG model; and determining that the sample is malicious based at least in part on the static analysis of the one or more URLs associated with the sample, and in response to determining that the sample is malicious, performing an action based on a security policy.

Deep learning for malicious URL classification (URLC) with the innocent until proven guilty (IUPG) learning framework

A copy of a model comprising a plurality of trees is received, as is a copy of training set data comprising a plurality of training set examples. For each tree included in the plurality of trees, the training set data is used to determine which training set examples are classified as a given leaf. A blame forest is generated at least in part by mapping each training set item to the respective leaves at which it arrives.

A system/process/computer program product for building multi-representational learning models for static analysis of source code includes receiving training data, wherein the training data includes a set of source code files for training a multi-representational learning (MRL) model for classifying malicious source code and benign source code based on a static analysis; generating a first feature vector based on a set of characters extracted from the set of source code files; generating a second feature vector based on a set of tokens extracted from the set of source code files; and performing an ensemble of the first feature vector and the second feature vector to form a target feature vector for classifying malicious source code and benign source code based on the static analysis.

Growing community of inventors

Mountain View, CA, United States of America

William Redington Hewlett, Ii