The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.
The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.
Patent No.:
Date of Patent:
Mar. 23, 2021
Filed:
Dec. 23, 2019
Applicant:
Palo Alto Networks, Inc., Santa Clara, CA (US);
Inventor:
Robert Jung, Albuquerque, NM (US);
Assignee:
Palo Alto Networks, Inc., Santa Clara, CA (US);
Attorney:
Primary Examiner:
Int. Cl.
CPC ...
G06F 11/30 (2006.01); G06F 21/56 (2013.01); G06F 3/06 (2006.01); H04L 29/06 (2006.01); G06F 12/0802 (2016.01);
U.S. Cl.
CPC ...
G06F 21/56 (2013.01); G06F 3/062 (2013.01); G06F 3/0641 (2013.01); G06F 3/0673 (2013.01); G06F 11/3034 (2013.01); G06F 12/0802 (2013.01); G06F 21/562 (2013.01); G06F 2212/1052 (2013.01);
Abstract
Techniques for efficient program deobfuscation through system application program interface (API) instrumentation are disclosed. In some embodiments, a system/process/computer program product for efficient program deobfuscation through system API instrumentation includes monitoring changes in memory after a system call event during execution of a malware sample in a computing environment; and generating a signature based on an analysis of the monitored changes in memory after the system call event during execution of the malware sample in the computing environment.