Palo Alto Networks, Inc.

Shape Security, Inc.

Other

Xinran Wang

Huagang Xie

Yao Zhao

Kyle Sanders

Wei Xu

Yanxin Zhang

Justin David Call

Bo Qu

Zhi Xu

Timothy Dylan Peacock

Jiangxia Liu

Marc R Hansen

Sumit Agarwal

Bryan D Hanks

Jarrod S Overson

Ye Xu

Computer systems and methods in various embodiments are configured for improving the security and efficiency of client computers interacting with server computers through supervising instructions defined in a web page and/or web browser. In an embodiment, a computer system comprising one or more processors, coupled to a remote client computer, and configured to send, to the remote client computer, one or more instructions, which when executed by the remote client computer, cause a run-time environment on the remote client computer to: intercept, within the run-time environment, a first call to execute a particular function defined in the run-time environment by a first caller function in the run-time environment; determine a first caller identifier, which corresponds to the first caller function identified in a run-time stack maintained by the run-time environment; determine whether the first caller function is authorized to call the particular function based on the first caller identifier.

Call stack integrity check on client/server systems

Techniques are provided for detection of malicious activity using behavior data. A behavior model is trained with behavior data generated in association with a plurality of requests. Data is received that describes a particular request from a particular client device to a server system hosting a website. The data includes particular behavior data generated at the particular client device in association with the particular request. The particular behavior data is analyzed using the behavior model to generate a behavior model result. An automation determination for the particular request is generated based on the behavior model result. The particular request is handled based on the automation determination for the particular request.

Detection of malicious activity using behavior data

Unsupervised or supervised machine learning ('ML') techniques discussed herein can be used to classify browsers as one or more types of browser or within one or more browser groups. For example, a computer system configured to improve security of server computers interacting with client computers through an intermediary computer, and comprising: a memory comprising processor logic; one or more processors coupled to the memory, wherein the one or more processors execute the processor logic, which causes the one or more processors to: receive a first plurality of requests from a first plurality of browsers; generate a first plurality of request-feature vectors from the first plurality of requests; generate a plurality of browser groups based on the first plurality of request-feature vectors; receive a first new request from a first client computer; generate a first new request-feature vector based on the first new request; determine that the first new request-feature vector belongs to a first browser group among the plurality of browser groups; determine that the first browser group is associated with a first rule, and in response, respond to the first new request according to the first rule.

Unsupervised and supervised machine learning approaches to detecting bots and other types of browsers

Techniques for performing static and dynamic analysis on a mobile device application are disclosed. Static analysis is performed on a mobile device application using a static analysis engine. A set of static analysis results is generated. Dynamic analysis of the application is selectively customized based at least in part on a presence of a permission in the set of static analysis results. Dynamic analysis is performed using a dynamic analysis engine. A determination of whether the application is malicious is made based at least in part on the dynamic analysis.

Static and dynamic security analysis of apps for mobile devices

Techniques for malware detection using clustering with malware source information are disclosed. In some embodiments, malware detection using clustering with malware source information includes generating a first cluster of source information associated with a first malware sample, in which the first malware sample was determined to be malware, and the first malware sample was determined to be downloaded from a first source; and determining that a second source is associated with malware based on the first cluster.

Malware detection using clustering with malware source information

Evaluating a potentially malicious sample using a copy-on-write overlay is disclosed. A first virtual machine instance is initialized as a copy-on-write overlay associated with an original virtual machine image. The first virtual machine image is started and a first sample is executed. A second virtual machine instance is initialized as a copy-on-write overlay associated with a second original virtual machine image. The second virtual machine image is started and a second sample is executed. The first and second samples are executed at an overlapping time.

Evaluating malware in a virtual machine using copy-on-write

Methods and apparatus are described for automatically modifying web page code. Specific implementations relate to the modification of web page code for the purpose of combatting Man-in-the-Browser (MitB) attacks.

Detecting man-in-the-browser attacks

Techniques for malware domain detection using passive Domain Name Service (DNS) are disclosed. In some embodiments, malware domain detection using passive DNS includes generating a malware association graph that associates a plurality of malware samples with malware source information, in which the malware source information includes a first domain; generating a reputation score for the first domain using the malware association graph and passive DNS information; and determining whether the first domain is a malware domain based on the reputation score for the first domain.

Malware domain detection using passive DNS

A computer-implemented method includes providing, for use by a third-party, injectable computer code that is capable of being served with other code provided by the third-party to client computing devices; receiving data from client computing devices that have been served the code by the third-party, the data including data that characterizes (a) the client computing devices and (b) user interaction with the client computing devices; classifying the client computing devices as controlled by actual users or instead by automated software based on analysis of the received data from the client computing devices; and providing to the third party one or more reports that characterize an overall level of automated software activity among client computing devices that have been served code by the third party.

Detecting attacks against a server computer based on characterizing user interactions with the client computing device

Detecting malicious PDF documents is disclosed. A PDF document is received. The PDF is classified using a classifier. The classifier is trained at least in part by using one of the following: (1) a feature associated with embedded script code; (2) a feature associated with a PDF action; and (3) a feature associated with a PDF structure.

Malicious PDF detection

Techniques for performing static and dynamic analysis on a mobile device application are disclosed. Static analysis is performed on a mobile device application using a static analysis engine. A static analysis report is generated. Dynamic analysis of the application is performed using a dynamic analysis engine. The dynamic analysis performed is customized based on results of the static analysis. A determination of whether the application is malicious is made based at least on the dynamic analysis.

Techniques for combating man-in-the-browser attacks

Detecting malware is disclosed. A candidate malware application is caused to be executed using a virtual machine. Traffic analysis is performed on network traffic associated with the execution of the candidate malware application. A determination is made as to whether the candidate malware application is malicious or not, based at least in part on the traffic analysis and an application type associated with the candidate malware application.

Growing community of inventors

San Ramon, CA, United States of America

Xinran Wang