The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.
The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.
Patent No.:
Date of Patent:
May. 26, 2026
Filed:
Feb. 29, 2024
Palo Alto Networks, Inc., Santa Clara, CA (US);
Christian Elihu Navarrete Discua, San Jose, CA (US);
Yanhui Jia, San Jose, CA (US);
Taojie Wang, San Jose, CA (US);
Shengming Xu, San Jose, CA (US);
Palo Alto Networks, Inc., Santa Clara, CA (US);
Abstract
A service detects bot activity or malicious C2 activity based on data known to be associated with bot and C2 activity for supported web applications and that can be identified from network traffic corresponding to the web application for multiple communication protocols. Such data can include API endpoints known to be associated with C2 activity, malicious users/accounts associated with the web application, and malicious activity patterns. Whether the detection service can detect bot activity that may potentially correspond to C2 activity or malicious C2 activity itself is dependent on whether the obtained network traffic data are decrypted. When network traffic data are encrypted, detection service can detect bot activity by analyzing DNS and SSL/TLS traffic. When network traffic data are decrypted, the detection service can obtain the decrypted network traffic data comprising HTTP traffic and perform further analysis for detection of C2 activity reflected in HTTP traffic.