Palo Alto Networks, Inc.

Yu Fu

Shengming Xu

Stefan Achleitner

Ajaya Neupane

Lei Xu

Yanhui Jia

Durgesh Madhavrao Sangvikar

Christian Elihu Navarrete Discua

Bo Qu

Mei Wang

Jin Chen

Zhibin Zhang

Yuwen Dai

Fikirte Ayalke Demmese

Durgesh Madhavrao Sangvilkar

A modular adversarial training data generator ('generator') generates adversarial training data for a machine learning (ML) model to detect malicious protocol data units (PDUs). The adversarial training data mimics high volume cyberattacks by perturbing PDUs to bypass malicious detection systems. For Hypertext Transfer Protocol (HTTP) PDUs, the generator rearranged, replaces, and grid searches values of HTTP header fields to generate the adversarial training data. The generator further biases grid search based on metrics for values of HTTP header fields that quantify impact of replacing the values on malicious verdicts by ML models trained on the adversarial training data.

Adversarial training for malicious protocol data unit detection with field value perturbations

An inline malicious traffic detector captures handshake messages in a session with a security protocol. The inline malicious traffic detector comprises a classifier that generates a verdict for the session indicating malicious or benign. The classifier is trained on labelled sessions using custom features generated from handshake messages. Based on determining that the session is malicious using features of the handshake messages, the inline malicious traffic detector blocks the session.

Inline detection of encrypted malicious network sessions

The present application discloses a method, system, and computer system for detecting malicious SQL or command injection strings. The method includes obtaining an SQL or command injection string and determining whether the command injection string is malicious based at least in part on a machine learning model.

Network attack detection with targeted feature extraction from exploit tools

Techniques for Cobalt Strike Beacon HTTP C2 heuristic detection are disclosed. In some embodiments, a system/process/computer program product for Cobalt Strike Beacon HTTP C2 heuristic detection includes monitoring HyperText Transfer Protocol (HTTP) network traffic at a firewall; prefiltering the monitored HTTP network traffic at the firewall to select a subset of the HTTP network traffic to forward to a cloud security service; determining whether the subset of the HTTP network traffic is associated with Cobalt Strike Beacon HTTP C2 traffic activity based on a plurality of heuristics; and performing an action in response to detecting the Cobalt Strike Beacon HTTP C2 traffic activity.

Cobalt Strike Beacon HTTP C2 heuristic detection

Detection of command and control malware is disclosed. A network traffic session is monitored. Automatic feature identification for real-time malicious command and control traffic detection based on a request header of the monitored network traffic session using a deep learning model is performed.

Deep learning pipeline to detect malicious command and control traffic

Cobalt strike beacon HTTP C2 heuristic detection

Growing community of inventors

Campbell, CA, United States of America

Yu Fu