Palo Alto Networks, Inc.

Zihang Xiao

Cong Zheng

Zhi Xu

Jiangxia Liu

ChienHua Lu

Jun Wang

Daiping Liu

Zhanhao Chen

Ruian Duan

Wenjun Hu

Li Meng

Mengying Jiang

Tyler Pals Halfpop

Yang Ji

Lexuan Sun

Separating awareness of multipart file transmissions of different applications from traffic handling at a granularity of an individual application layer session facilitates efficient cybersecurity enforcement on multipart file transmissions. A protocol-based multipart file transmission regulator ('regulator') determines a per session message handling action to prevent completion of a multipart file transmission based on a protocol of an application identified for the session until cybersecurity analysis can be performed. The regulator then communicates the message handling action to a network component supporting the session. The regulator maintains information and file chunks in a data store for active sessions and determines with the data store whether a condition for requesting cybersecurity analysis for a multipart file transmission is satisfied. Upon obtaining a cybersecurity analysis verdict, the regulator provides the verdict or a verdict based instruction to the network component that ensures the multipart file transmission is compliant with a cybersecurity policy(ies).

Inline inspection cybersecurity enforcement of multipart file transmissions

A set of repackaging fingerprints generated independently of a particular original application is received. The set of repackaging fingerprints comprises a plurality of predetermined indicators of build-related structure that is independent of the particular original application's code structure. A mobile application is received. The received mobile application is analyzed for one or more indicators that the received mobile application is a repackaged version of the particular original application, using at least one repackaging fingerprint. In response to a result of the analysis, the received mobile application is categorized as a repackaged application.

Detecting repackaged applications based on file format fingerprints

Automatic generation of a malware signature is disclosed. Code of a sample including packages and function names is parsed. Standard type packages and vendor type packages are filtered from the code of the sample to obtain main type packages. A signature using a fuzzy hash for the sample is generated based on the main type packages. A determination of whether the sample is malware is performed using the signature and a similarity score threshold.

Method and system for automatically generating malware signature

Inline package name based supply chain attack detection and prevention is disclosed. An indication that a client device has made a request to a remote server for a package is received. A data appliance then performs an action responsive to the received indication. In an example implementation, the data appliance makes a determination of whether the request for the package is associated with a nonexisting package.

Inline package name based supply chain attack detection and prevention

Domain Name System (DNS) security using process information is provided. An application accessing an internet service using a domain name is determined. Process information associated with the application along with an associated DNS query to identify an IP address associated with the domain name are identified. The process information and the associated DNS query to a DNS security service are sent. An action based on a response from the DNS security service is performed.

Method and system for providing DNS security using process information

A sample is received for analysis. A determination is made that the sample was compiled for a CPU architecture that is different from a host CPU architecture. The sample is executed in an emulated user space corresponding to the CPU architecture for which the sample was compiled. The emulated user space is provided by executing a user space emulation utility in a virtual machine that shares the host CPU architecture.

Analyzing multiple CPU architecture malware samples

Techniques for providing a large scale high-interaction honeypot farm are disclosed. In some embodiments, a system/method/computer program product for providing a large scale high-interaction honeypot farm includes sending traffic detected at a sensor to a smart proxy for a honeypot farm that is executed in a honeypot cloud, wherein the traffic is forwarded attack traffic that is sent using a tunneling protocol, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; selecting a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; forwarding the traffic to an instance of the matching type of vulnerable service; and executing a security agent associated with the instance of the matching type of vulnerable service to identify a threat by monitoring behaviors and detecting anomalies or post exploitation activities.

Large scale high-interactive honeypot farm

Techniques for providing a smart proxy for a large scale high-interaction honeypot farm are disclosed. In some embodiments, a system/method/computer program product for providing a smart proxy for a large scale high-interaction honeypot farm includes receiving tunneled traffic at a smart proxy from a sensor for a honeypot farm that is executed in a honeypot cloud, wherein the tunneled traffic is forwarded attack traffic, and wherein the honeypot farm includes a plurality of container images of distinct types of vulnerable services; selecting a matching type of vulnerable service from the plurality of container images of distinct types of vulnerable services based on a profile of the attack traffic; and forwarding the tunneled traffic to an instance of the matching type of vulnerable service.

Smart proxy for a large scale high-interaction honeypot farm

A sample is received for analysis by a virtualized environment. A determination is made that the sample was compiled for a CPU architecture that is different from a host CPU architecture. The sample is executed in an emulated user space corresponding to the CPU architecture for which the sample was compiled. The emulated user space is provided by executing a user space emulation utility in a virtual machine that shares the host CPU architecture.

A sample is received for analysis by a virtualized environment. A determination is made that the sample was compiled for a CPU architecture that is different from a host CPU architecture. The sample is executed in an emulated user space corresponding to the CPU architecture for which the sample was compiled.

A first mobile application is received. A reversing operation is performed on the first mobile application. A static analysis engine is used to determine a plurality of libraries included in the mobile application. Each library included in the plurality of libraries is categorized. A determination that the first mobile application is similar to a second mobile application based at least in part on a comparison of the respective categorizations of the respective libraries included in the respective first and second mobile applications. Commonality in the libraries of the two mobile applications can be used for a variety of purposes including detecting repackaging and also common authorship.

Growing community of inventors

Los Gatos, CA, United States of America

Zihang Xiao