Palo Alto Networks, Inc.

Xin Ouyang

Xing Jin

Zhaoyan Xu

Tongbo Luo

Wei Xu

Jiangxia Liu

Bo Qu

Yanhui Jia

The use of browser context in detecting malware is disclosed. A client device requests content from a remote server. Data received by the client device from the remote server is transmitted to an external scanner for analysis by the external scanner. The external scanner is configured to use a browser executed in an instrumented virtual machine environment to analyze the data provided by the client device. The client device is configured to request the content from the remote server using a browser extension configured to retrieve data and provide the retrieved data to the external scanner without rendering the retrieved data.

Using browser context in evasive web-based malware detection

Techniques for providing an intelligent-interaction honeypot for IoT devices in accordance with some embodiments. In some embodiments, a system/process/computer program product for providing an intelligent-interaction honeypot for IoT devices includes receiving a request from an attacker sent to an IP address that is associated with a honeypot instance for Internet of Things (IoT) devices; determining a response to the request using a data store that stores a plurality of responses and associated IoT device information, wherein the plurality of responses and associated IoT device information is generated based on automated machine learning of active probing of physical IoT devices on the Internet; and sending the response from the honeypot instance for IoT devices to the attacker, wherein the attacker is unable to detect that the response is associated with an emulated IoT device.

Intelligent-interaction honeypot for IoT devices

The use of browser context in detecting malware is disclosed. A client device requests content from a remote server. Data received by the client device from the remote server is transmitted to an external scanner for analysis by the external scanner. The external scanner is configured to use a browser executed in an instrumented virtual machine environment to analyze the data provided by the client device. The client device is configured to act as a proxy on behalf of the external scanner.

Techniques for Domain Generation Algorithm (DGA) behavior detection are provided. In some embodiments, a system, process, and/or computer program product for DGA behavior detection includes receiving passive Domain Name System (DNS) data that comprises a plurality of DNS responses at a security device; and applying a signature to the passive DNS data to detect DGA behavior, in which applying the signature to the passive DNS data to detect DGA behavior further comprises: parsing each of the plurality of DNS responses to determine whether one or more of the plurality of DNS responses correspond to a non-existent domain (NXDOMAIN) response.

DGA behavior detection

The use of browser context in detecting malware is disclosed. A Uniform Resource Locator (URL) is received from a user and at a client device. The URL is used to request, at the client device, and from a remote server, content. At least a portion of data received from the remote server is provided by the client device to an external scanner. The external scanner is configured to use a browser executed in an instrumented virtual machine environment to analyze the data provided by the client device. A maliciousness verdict is received from the external scanner.

Various techniques for performing malware analysis of a URL (e.g., a URL sample) using a browser executed in an instrumented virtual machine environment are disclosed. In some embodiments, a system for performing dynamic malware analysis of a URL using a browser executed in an instrumented virtual machine environment includes the instrumented virtual machine environment executed on a processor that receives a URL sample for dynamic malware analysis using the browser executed in the instrumented virtual machine environment; and a dynamic time allocator executed on the processor that dynamically determines a period of time allocated for performing the dynamic malware analysis of the URL sample using the browser executed in the instrumented virtual machine environment, in which the URL sample is rendered using the browser executed in the instrumented virtual machine environment and monitored using the instrumented virtual machine environment for the period of time allocated for performing the dynamic malware analysis of the URL sample.

Growing community of inventors

Santa Clara, CA, United States of America

Xin Ouyang