KR20220053549A - 인라인 멀웨어 검출 - Google Patents

인라인 멀웨어 검출 Download PDF

Info

Publication number
KR20220053549A
KR20220053549A KR1020227001606A KR20227001606A KR20220053549A KR 20220053549 A KR20220053549 A KR 20220053549A KR 1020227001606 A KR1020227001606 A KR 1020227001606A KR 20227001606 A KR20227001606 A KR 20227001606A KR 20220053549 A KR20220053549 A KR 20220053549A
Authority
KR
South Korea
Prior art keywords
file
gram
features
analysis
model
Prior art date
Application number
KR1020227001606A
Other languages
English (en)
Korean (ko)
Other versions
KR102676386B1 (ko
Inventor
윌리엄 레딩턴 휴렛
쑤이창 뎅
솅 양
호 유 람
Original Assignee
팔로 알토 네트웍스, 인크.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from US16/517,465 external-priority patent/US11636208B2/en
Priority claimed from US16/517,463 external-priority patent/US11374946B2/en
Application filed by 팔로 알토 네트웍스, 인크. filed Critical 팔로 알토 네트웍스, 인크.
Publication of KR20220053549A publication Critical patent/KR20220053549A/ko
Application granted granted Critical
Publication of KR102676386B1 publication Critical patent/KR102676386B1/ko

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/561—Virus type analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Artificial Intelligence (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Medical Informatics (AREA)
  • Mathematical Physics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)
KR1020227001606A 2019-07-19 2020-07-06 인라인 멀웨어 검출 KR102676386B1 (ko)

Applications Claiming Priority (5)

Application Number Priority Date Filing Date Title
US16/517,465 US11636208B2 (en) 2019-07-19 2019-07-19 Generating models for performing inline malware detection
US16/517,463 US11374946B2 (en) 2019-07-19 2019-07-19 Inline malware detection
US16/517,463 2019-07-19
US16/517,465 2019-07-19
PCT/US2020/040928 WO2021015941A1 (en) 2019-07-19 2020-07-06 Inline malware detection

Publications (2)

Publication Number Publication Date
KR20220053549A true KR20220053549A (ko) 2022-04-29
KR102676386B1 KR102676386B1 (ko) 2024-06-20

Family

ID=74193725

Family Applications (1)

Application Number Title Priority Date Filing Date
KR1020227001606A KR102676386B1 (ko) 2019-07-19 2020-07-06 인라인 멀웨어 검출

Country Status (5)

Country Link
EP (1) EP3999985A4 (zh)
JP (2) JP7411775B2 (zh)
KR (1) KR102676386B1 (zh)
CN (1) CN114072798A (zh)
WO (1) WO2021015941A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115378747B (zh) * 2022-10-27 2023-01-24 北京六方云信息技术有限公司 恶意数据检测方法、终端设备以及存储介质

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180013772A1 (en) * 2016-07-05 2018-01-11 Webroot Inc. Automatic Inline Detection based on Static Data
US20180300482A1 (en) * 2017-04-18 2018-10-18 Cylance Inc. Protecting devices from malicious files based on n-gram processing of sequential data

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8844033B2 (en) * 2008-05-27 2014-09-23 The Trustees Of Columbia University In The City Of New York Systems, methods, and media for detecting network anomalies using a trained probabilistic model
US9742796B1 (en) * 2015-09-18 2017-08-22 Palo Alto Networks, Inc. Automatic repair of corrupt files for a detonation engine
US10200391B2 (en) * 2015-09-23 2019-02-05 AVAST Software s.r.o. Detection of malware in derived pattern space
US10817608B2 (en) * 2017-04-07 2020-10-27 Zscaler, Inc. System and method for malware detection on a per packet basis
US10902124B2 (en) * 2017-09-15 2021-01-26 Webroot Inc. Real-time JavaScript classifier
US20190096214A1 (en) * 2017-09-27 2019-03-28 Johnson Controls Technology Company Building risk analysis system with geofencing for threats and assets

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180013772A1 (en) * 2016-07-05 2018-01-11 Webroot Inc. Automatic Inline Detection based on Static Data
US20180300482A1 (en) * 2017-04-18 2018-10-18 Cylance Inc. Protecting devices from malicious files based on n-gram processing of sequential data

Also Published As

Publication number Publication date
JP7411775B2 (ja) 2024-01-11
KR102676386B1 (ko) 2024-06-20
EP3999985A1 (en) 2022-05-25
JP2024023875A (ja) 2024-02-21
WO2021015941A1 (en) 2021-01-28
EP3999985A4 (en) 2023-12-13
CN114072798A (zh) 2022-02-18
JP2022541250A (ja) 2022-09-22

Similar Documents

Publication Publication Date Title
US11783035B2 (en) Multi-representational learning models for static analysis of source code
US12095728B2 (en) Identifying security risks and enforcing policies on encrypted/encoded network communications
US11816214B2 (en) Building multi-representational learning models for static analysis of source code
US11636208B2 (en) Generating models for performing inline malware detection
US11374946B2 (en) Inline malware detection
JP2024023875A (ja) インラインマルウェア検出
US12061696B2 (en) Sample traffic based self-learning malware detection
US20230344861A1 (en) Combination rule mining for malware signature generation
US20220245249A1 (en) Specific file detection baked into machine learning pipelines
KR20240124354A (ko) 악성 명령 및 제어 트래픽을 탐지하는 딥러닝 파이프라인
US20230344867A1 (en) Detecting phishing pdfs with an image-based deep learning approach
US20230069731A1 (en) Automatic network signature generation
US12069028B2 (en) Fast policy matching with runtime signature update
US12107831B2 (en) Automated fuzzy hash based signature collecting system for malware detection
US20240372832A1 (en) Fast policy matching with runtime signature update
US11770361B1 (en) Cobalt strike beacon HTTP C2 heuristic detection
US20240333759A1 (en) Inline ransomware detection via server message block (smb) traffic
US20240039951A1 (en) Probing for cobalt strike teamserver detection
US20240039952A1 (en) Cobalt strike beacon https c2 heuristic detection
US20240176869A1 (en) Dependency emulation for executable samples
US20230385412A1 (en) Automatically detecting unknown packers
WO2024025705A1 (en) Cobalt strike beacon http c2 heuristic detection
CN118901223A (zh) 用于检测恶意命令和控制流量的深度学习管道

Legal Events

Date Code Title Description
E902 Notification of reason for refusal
E701 Decision to grant or registration of patent right