US 10,148,693 B2Grant
Exploit detection system
Issue Date:2018-12-04
•28 Claims
•9 Drawing Sheets
Abstract
According to one embodiment, a virtualized malware detection system is integrated with a virtual machine host including a plurality of virtual machines and a security virtual machine. Logic within the virtual machines are configured to perform a dynamic analysis of an object and monitor for the occurrence of a triggering event. Upon detection of a triggering event within a virtual machine, the logic within the virtual machine provides the security virtual machine with information associated with the triggering event for further analysis. Based on the further analysis, the object may then be classified as “non-malicious,” or “malicious.”
Metadata
Assignee
- FireEye, Inc.
Inventors
- Japneet Singh
- Harinath Ramchetty
- Anil Gupta
Application Information
Application Number:US 14/739,921
Filing Date:2015-06-15
Priority Date:2015-03-25
Art Unit:2494
Classifications
IPC:
H04L29/06H04L29/08
Field of Search:
H04L 63/14H04L 63/1408H04L 63/1416H04L 63/1425H04L 63/1441H04L 63/145H04L 63/20H04L 63/10G06F 21/55G06F 21/56G06F 21/566G06F 21/564
Patent Drawings (9 sheets)
Description
FIELD
[0001] Embodiments of the disclosure relate to the field of cyber security. More specifically, embodiments of the disclosure relate to a system for detecting anomalous, or more specifically, malicious behavior through successive intercommunications between virtual machines.
GENERAL BACKGROUND
[0002] Over the last decade, malicious software has become a pervasive problem for Internet users as many networked resources include vulnerabilities that are subject to attack. For instance, over the past few years, more and more vulnerabilities are being discovered in software that is loaded onto endpoint devices present on the network. These vulnerabilities may be exploited by allowing a third-party, e.g., through computer software, to gain access to one or more areas within the network not typically accessible. For example, a third-party may exploit a vulnerability to gain unauthorized access to email accounts and/or data files.
[0003] While some vulnerabilities continue to be addressed through software patches, prior to the release of such software patches, network devices will continue to be targeted for attack by exploits, namely malicious computer code that attempts to acquire sensitive information, adversely influence, or attack normal operations of the network device or the entire enterprise network by taking advantage of a vulnerability in computer software.
[0004] Currently, a datacenter may employ a plurality of virtual machines to simulate one or more endpoint devices in order to detect attacks by exploits and/or malware. However, the performance of advanced security measures on each virtual machine within the datacenter may lead to duplication of exploit detection efforts. This duplication of exploit detection efforts results in increased overhead of the plurality of virtual machines.
[0005] Currently, a virtual machine may perform a dynamic analysis of an object, e.g., one or more files included within received network traffic and/or files stored in a local or external storage device. In addition, each of a plurality of virtual machines may be configured with different software images thereby simulating various network device deployments. In some instances, a virtual machine may include a software configuration to simulate a specific network device within a particular enterprise network, e.g., configured with one or more specific applications to perform execution of particular objects.
BRIEF DESCRIPTION OF THE DRAWINGS
[0006] Embodiments of the invention are illustrated by way of example and not by way of limitation in the figures of the accompanying drawings, in which like references indicate similar elements and in which:
[0007] FIG. 1 is a block diagram of an exemplary virtualized malware detection system.
[0008] FIG. 2 is a block diagram of an exemplary virtual machine host of a virtualized malware detection system communicatively coupled to a network security appliance, an endpoint security appliance and cloud services.
[0009] FIG. 3 is an in-depth block diagram of an exemplary virtual machine host of a virtualized malware detection system communicatively coupled to a network security appliance, an endpoint security appliance and cloud services.
[0010] FIG. 4A is a flowchart illustrating a first exemplary method of detecting malware and/or exploits using a virtualized malware detection system.
[0011] FIG. 4B is a flowchart illustrating a second exemplary method of detecting malware and/or exploits using a virtualized malware detection system.
[0012] FIGS. 5A and 5B are flowcharts illustrating an exemplary method for detecting malware and/or exploits associated with a uniform resource locator (URL) opened within a browser using a virtualized malware detection system.
[0013] FIG. 6 is an exemplary block diagram of logic associated with the detection system 1101 of FIG. 1 .
DETAILED DESCRIPTION
[0014] Various embodiments of the disclosure relate to a virtualized malware detection system that improves exploit detection and/or visual representation of the detection of the suspected exploit and/or malware. The virtualized malware detection system may include one or more virtual machine (VM) hosts, a controller, and optionally, a storage device. Each VM host may include one or more VMs, which perform dynamic analysis of an object, a “security” VM, which performs further analysis for each of the VMs within the VM host, and a hypervisor, which manages communications between the VMs and the security VM. It is contemplated that the security VM may be a secondary VM or another type of logic that runs in a virtual environment.
[0015] In one embodiment, the virtualized malware detection system may be deployed in a datacenter wherein the one or more VM hosts that include one or more VMs, a security VM and a hypervisor provide for savings on hardware costs. In one such embodiment, the VM hosts may be segmented (e.g., partitioned) according to enterprise and/or individual user (e.g., a solo entrepreneur) wherein each of the VMs and the security VM within a VM host are utilized by, for example, a single enterprise or solo entrepreneur. In a second embodiment, a datacenter deployment may include hardware comprising, at least, a first VM host including 500 VMs, a security VM and a hypervisor, and a second VM host including 1,000 VMs, a security VM and a hypervisor. In such an embodiment, a first enterprise may utilize the first VM including all 500 VMs and the security VM included therein, while a second enterprise may utilize the second VM including all 1,000 VMs and the security VM included therein.
[0016] In an alternative embodiment, the VMs within a VM host may be segmented according to enterprise and/or solo entrepreneur. For example, a datacenter deployment may include hardware comprising a VM host including 1,000 VMs, a security VM and a hypervisor. A first enterprise may utilize 900 VMs and a solo entrepreneur may utilize 100 VMs wherein all 1,000 VMs utilize the same security VM. The communication between the VMs and the security VM is coordinated by the hypervisor; therefore, data of the first enterprise and data of the entrepreneur will not be commingled.
[0017] In one embodiment of the disclosure, the virtualized malware detection system determines whether an object is associated with a malicious attack through a dynamic analysis of the object within a virtual run-time environment. The virtual run-time environment features one or more VMs, which may be provisioned with a guest image associated with a prescribed software profile. Each guest image may include a software application and/or an operating system (OS). The guest image may further include one or more monitors, namely software components that are configured to observe and capture run-time behavior of an object under analysis during processing within the virtual machine. In another embodiment, the virtualized malware detection system may perform pre-processing, which may include signature checks and/or comparisons of information associated with the object with content within the one or more entries of a blacklist and/or a whitelist. Herein, the term “signature” may designate an indicator of a set of characteristics and/or behaviors exhibited by one or more exploits that may not be unique to those exploit(s). Thus, a match of the signature may indicate to some level of probability that a portion of received data constitutes an exploit. Subsequently, depending on the results of the pre-processing, the virtualized malware detection system may conduct dynamic analysis of the object.
[0018] In one embodiment, each of the VMs within a VM host may be configured with a guest image to simulate a particular endpoint device which may be based on the specific needs of a corporation, for example. Specifically, each VM may be configured with different operating systems, different applications, different versions of a common operating system and/or different versions of a common application. In one embodiment, the virtualized malware detection system may receive an object via a network connection based on an action by a user. For example, a user may remotely control actions on a VM within the VM host such that the user may download an object from an Internet browsing application and launch the object. Upon the user launching the object remotely in the VM, the VM within the VM host performs an analysis to determine whether the object is associated with a malicious attack. Specifically, the VM may provide the security VM with information associated with the object in order to enable the security VM to perform pre-processing thereon. When the pre-processing does not result in a determination that the object is non-malicious (e.g., the object matches an entry on a whitelist), the VM continues a dynamic analysis of the object within the virtual run-time environment. Herein, the term “launch” (and other tenses) represents performance of one or more events that initiates activation of an object under analysis. When the VM detects the occurrence of a triggering event, the VM provides information associated with the triggering event to the security VM for further analysis. The triggering event may be an event that, through experiential knowledge and/or machine learning techniques, has been determined to have an association with a malicious attack but signifies further analysis should be performed.
[0019] In one embodiment, as the security VM is performing further analysis on the information associated with the triggering event, the VM continues the dynamic analysis. Furthermore, the VM may provide the security VM with post-processing information associated with the triggering event throughout the dynamic analysis. In a second embodiment, the VM may pause processing until the security VM requests additional information associated with processing of the object subsequent to the occurrence of the triggering event. Therefore, duplication of work performed on each of the VMs is avoided by off-loading the further analysis of information associated with the occurrence of a triggering event to a security VM.
[0020] Embodiments of the invention may be employed by or take the form of a server device or apparatus implementing a virtualized malware detection system, where the virtualized malware detection system includes a plurality of VM hosts, which each include a plurality of VMs and a security VM. According to one embodiment of the disclosure, an endpoint device, management system or cloud computing service transmits an object to the virtualized malware detection system for analysis, wherein a user remotely launches the object within a VM of the detection system 1101. Depending on the analysis by the virtualized malware detection system, the object may be labeled as either “non-malicious” or “malicious.” Throughout the specification, claims and figures, the term “network traffic” will be used in the discussion but any form of incoming data may be substituted.
I. Terminology
[0021] In the following description, certain terminology is used to describe features of the invention. For example, in certain situations, both terms “logic” and “engine” are representative of hardware, firmware and/or software that is configured to perform one or more functions. As hardware, logic (or engine) may include circuitry having data processing or storage functionality. Examples of such circuitry may include, but are not limited or restricted to a microprocessor, one or more processor cores, a programmable gate array, a microcontroller, a controller, an application specific integrated circuit, wireless receiver, transmitter and/or transceiver circuitry, semiconductor memory, or combinatorial logic.
[0022] Logic (or engine) may be software in the form of one or more software modules, such as executable code in the form of an executable application, an application programming interface (API), a subroutine, a function, a procedure, an applet, a servlet, a routine, source code, object code, a shared library/dynamic load library, or one or more instructions. These software modules may be stored in any type of a suitable non-transitory storage medium, or transitory storage medium (e.g., electrical, optical, acoustical or other form of propagated signals such as carrier waves, infrared signals, or digital signals). Examples of non-transitory storage medium may include, but are not limited or restricted to a programmable circuit; a semiconductor memory; non-persistent storage such as volatile memory (e.g., any type of random access memory “RAM”); persistent storage such as non-volatile memory (e.g., read-only memory “ROM”, power-backed RAM, flash memory, phase-change memory, etc.), a solid-state drive, hard disk drive, an optical disc drive, or a portable memory device. As firmware, the executable code is stored in persistent storage.
[0023] An “exploit” may be construed broadly as information (e.g., executable code, data, command(s), etc.) that attempts to take advantage of a vulnerability in software and/or an action by a person gaining unauthorized access to one or more areas of a network, a computer and/or an electronic device. For instance, a “vulnerability” is a coding error or artifact of software (e.g., computer program) that allows an attacker to alter legitimate control flow during processing of the software (computer program) by a network device, and thus, causes the network device to experience undesirable or anomalous behaviors. The undesired or anomalous behaviors may include a communication-based anomaly or an execution-based anomaly, which, for example, could (1) alter the functionality of an network device executing application software in an atypical manner (a file is opened by a first process where the file is configured to be opened by a second process and not the first process); (2) alter the functionality of the network device executing that application software without any malicious intent; and/or (3) provide unwanted functionality which may be generally acceptable in another context. As an illustrative example, a computer program may be considered as a state machine, where all valid states (and transitions between states) are managed and defined by the program, in which case an exploit may be viewed as seeking to alter one or more of the states (or transitions) from those defined by the program. The term “anomalous behavior” should be understood to include either (i) a first event that is an atypical occurrence or a malicious occurrence, or (ii) a relationship identifying that the first event is based on a second event, the relationship being an atypical relationship between the first and second event or a relationship between the first and second events that is malicious to the network, electronic device on which the relationship appears, or to one or more users of the electronic device or of the network.
[0024] According to one embodiment, the term “malware” may be construed broadly as computer code that executes an exploit to take advantage of a vulnerability, for example, to harm or co-opt operation of a network device or misappropriate, modify or delete data. Conventionally, malware is often said to be designed with malicious intent.
[0025] The term “transmission medium” is a physical or logical communication path between two or more network devices (e.g., any devices with data processing and network connectivity such as, for example, a security appliance, a server, a mainframe, a computer such as a desktop or laptop, netbook, tablet, firewall, smart phone, router, switch, bridge, etc.). For instance, the communication path may include wired and/or wireless segments. Examples of wired and/or wireless segments include electrical wiring, optical fiber, cable, bus trace, or a wireless channel using infrared, radio frequency (RF), or any other wired/wireless signaling mechanism.
[0026] The term “object” generally refers to a collection of data, whether in transit (e.g., over a network) or at rest (e.g., stored), often having a logical structure or organization that enables it to be classified for purposes of analysis. During analysis, for example, the object may exhibit a set of expected characteristics and, during processing, a set of expected behaviors. The object may also exhibit a set of unexpected characteristics and a set of unexpected behaviors that may evidence an exploit and potentially allow the object to be classified as an exploit.
[0027] Examples of objects may include one or more flows or a self-contained element within a flow itself. A “flow” generally refers to related packets that are received, transmitted, or exchanged within a communication session. For convenience, a packet is broadly referred to as a series of bits or bytes having a prescribed format, which may include packets, frames, or cells.
[0028] As an illustrative example, an “object” may include a set of flows such as a sequence of transmissions in accordance with a particular communication protocol (e.g., Transmission Control Protocol (TCP), Hypertext Transfer Protocol (HTTP), etc.), or inter-process communications (e.g., Remote Procedure Call “RPC” or analogous processes, etc.). Similar, as another illustrative example, the object may be a self-contained element, where different types of such objects may include an executable file, non-executable file (such as a document or a dynamically link library), a Portable Document Format (PDF) file, a JavaScript file, Zip file, a Flash file, a document (for example, a Microsoft Office® document), an electronic mail (email), downloaded web page, an instant messaging element in accordance with Session Initiation Protocol (SIP) or another messaging protocol, or the like.
[0029] The terms “potentially suspicious,” “suspicious” and “malicious” may each be represent a probability (or level of confidence) that the object is associated with a malicious attack. For instance, the probability may be based, at least in part, on (i) pattern matches; (ii) analyzed deviations in messaging practices set forth in applicable communication protocols e.g., HTTP, TCP, etc.); (iii) analyzed compliance with certain message formats established for the protocol (e.g., out-of-order commands); (iv) analyzed header or payload parameters to determine compliance, (v) attempts to communicate with external servers during dynamic processing, and/or (vi) attempts to access predetermined (e.g., secure) locations in memory during dynamic processing.
[0030] Lastly, the terms “or” and “and/or” as used herein are to be interpreted as inclusive or meaning any one or any combination. Therefore, “A, B or C” or “A, B and/or C” mean “any of the following: A; B; C; A and B; A and C; B and C; A, B and C.” An exception to this definition will occur only when a combination of elements, functions, steps or acts are in some way inherently mutually exclusive.
[0031] The invention may be utilized for displaying an interactive infection visualization detailing detection, verification and/or prioritization of malicious content. As this invention is susceptible to embodiments of many different forms, it is intended that the present disclosure is to be considered as an example of the principles of the invention and not intended to limit the invention to the specific embodiments shown and described.
II. Virtualized Malware Detection System
[0032] Referring to FIG. 1 , a block diagram of a malware and/or exploit detection system 100 deploying a plurality of exemplary virtualized malware detection systems (referred to hereinafter as “detection systems”) 1101-110D (D≥1, e.g., D=3) communicatively coupled to a management system 120 via a network 140 is shown. The malware and/or exploit detection system 100 may be deployed within an enterprise network, where the detection system 1101 is communicatively coupled for network connectivity, e.g., to communicate with one or more client devices 1901-190C.
[0033] Additionally, the detection system 1101 may be communicatively coupled to the management system 120 and one or more detection systems 1102-1103 via the network 140. In general, the management system 120 may be adapted to manage detection systems 1101-1103, in part, through propagation of updates of, for example, a whitelist, a blacklist, correlation rules, guest images for the VMs, and/or VM hosts. For example, updates may include, but are not limited or restricted to, modifying a current entry in the whitelist or the blacklist, modifying a current correlation rule, adding a new entry to the whitelist or the blacklist, adding a new correlation rule, removing a current entry in the whitelist or the blacklist, and/or removing a current correlation rule. Also, the detection system 1101 may be communicatively coupled to a network security appliance 150 and/or an endpoint security appliance 160. The coupling to the network security appliance 150 and/or the endpoint security appliance 160 may be through a wired connection or via a wireless network, such as the network 140. In addition, the detection system 1101 may be communicatively coupled, e.g., indirectly via the endpoint security appliance 160, to the cloud services 170. Finally, the detection system 1101 may be communicatively coupled to a storage device 130.
[0034] As further shown in FIG. 1 , the detection system 1101 may include one or more VM hosts 1111-111P (P≥1) and a controller 112. The VM host 1111 may include one or more VMs, a security VM, and a hypervisor. In a first embodiment, the VM host 1111 may be a hardware appliance hosting several VMs wherein the VM host 1111 may receive instructions, commands and/or updates via the controller 112. According to this embodiment, the VM hosts 1111-111P may reside in a single location on the same hardware (e.g., an enterprise server). In a second embodiment, the VM hosts 1111-111P may reside on separate hardware devices wherein each VM host 1111-111P is communicatively coupled to the controller 112. In the second embodiment, the separate hardware devices housing one or more VM hosts 1111-111P may be located at a central location (e.g., a datacenter) or located at various remote locations and communicatively coupled to the controller 112 and the storage 130 (e.g., via a network). The storage 130 may include storage space (e.g., a non-transitory storage medium) for each of the VMs included in the detection system 1101.
[0035] As will be discussed in detail below, each VMi (1≤i≤M, wherein M=3 for this example) deploying as part of the VM host 1111 may model a separate endpoint device (e.g., acting as a virtual representation of the endpoint device including running a specified operating system and one or more specified applications). Alternatively, one or more VMs (e.g., VM1-VMM) of the VM host 1111 may model a single endpoint device wherein various versions of operating systems and/or applications are run according to configurations of the endpoint device. For example, VM1 of the VM host 1111 may run the Microsoft® Windows® 8.1 operating system and Adobe® Acrobat® version 10.0 while VM2 of the VM host 1111 may run the Microsoft® Windows® 8.1 operating system and Adobe® Acrobat® version 11.0 in order to simulate the endpoint devices as needed by, for example, a corporation utilizing the detection system 1101. Additionally, the use of various configurations may also aid in determining the whether malware and/or exploits are triggered in a specified version of an application.
[0036] The security VM1 of the VM host 1111 serves as a VM dedicated to providing further analysis of an object identified in one or more of the VM1-VMM as being “potentially suspicious.” As will be discussed below, each of the VM1-VMM implemented within the VM host 1111 provides a virtualized run-time environment in which to execute an object. The detection system 1101 also enables a determination as to whether one or more triggering events (e.g., events that signify the object may be suspicious and/or malicious) are detected during the execution of the object. Once a triggering event is detected by at least one VM of VM1-VMM (for this example, VM1 will be used), the object is determined to be “potentially suspicious,” and information associated with the object and the detected event is transmitted to the security VM1 of the VM host 1111 wherein further analysis is done to determine whether the object is “suspicious.” If the security VM1 determines the object is suspicious, a request for further information associated with the detected event is transmitted to the VM1. Subsequently, the VM1 may provide the security VM1 with information associated with the event and information associated with the object, wherein the information provided is based on processing conducted subsequent to the detection of the event (e.g., information detailing one or more of changes to Registry files, the operating system and/or configuration files, attempts to access locations in memory, generated files, etc.). The security VM1 performs subsequent analysis based on one or more portions of information received from the VM1 and determines whether the object is malicious.
[0037] The hypervisor1 included in the VM host 1111 manages communications between VM1-VMM and the security VM1. In addition, the hypervisor1 may include logic to manage communications between the VM1-VMM and the security VM1 as well as data storage.
[0038] In a first embodiment, each of the VMs within the VM hosts 1111-111P correspond to endpoint devices within a separate enterprise network. For example, each of VM1-VMM deployed within the VM host 1111 may correspond to endpoint devices within an enterprise network of a first company and each of VM1-VMN deployed within the VM host 1112 may correspond to endpoint devices within an enterprise network of a second company. In a second embodiment, each VM1-VMQ of the VM host 111P may correspond to endpoint devices of a plurality of enterprise networks of a plurality of companies. For example, VM1 and VM2 of the VM host 111P may correspond to endpoint devices of an enterprise network of a first company and the VM3 and the VMQ of the VM host 111P may correspond to endpoint devices of an enterprise network of a second company.
[0039] A. Virtual Machine Host Component
[0040] Referring now to FIG. 2 , a block diagram of an exemplary the virtual machine (VM) host 1111 of the virtualized malware detection system 1101 that is communicatively coupled to a network security appliance 150, an endpoint security appliance 160 and cloud services 170 is shown. In particular, FIG. 2 provides a detailed illustration of the interactions within the VM host 1111. As shown, the each of VM1-VMM communicates with the security VM1 using the hypervisor1 included in the VM host 1111. In addition, FIG. 2 illustrates the hypervisor1 may include an exploit queue storage 210 and a VM routing logic 220.
[0041] The exploit queue storage 210 may store triggering events detected by one or more of VM1-VMM for example in a queue format, until the security VM1 is available for processing. In one embodiment, the security VM1 may be performing analysis on information received from the VM1 when the VM2 detects a triggering event during processing. In such a situation, the exploit queue storage 210 may store the information associated with the object being processed and the triggering event detected by the VM2 until the security VM1 is available (e.g., has finished processing the information provided by the VM1 and/or information in the queue ahead of the information provided by the VM2).
[0042] Included in the hypervisor1, the VM routing logic 220 may include logic to determine what information in the queue to provide to the security VM1 as well as control communications from the security VM1 to each of VM1-VMM. In addition, the VM routing logic 220 may maintain, e.g., via a table stored in the exploit queue storage 210, information such as (i) the VM from which information was provided and/or (ii) the process identification (ID) of the process in which the triggering event was detected.
[0043] Now referring to FIG. 3 , an in-depth block diagram of a portion of the VM host 1111 of the detection system 1101 communicatively coupled to a network security appliance 150, an endpoint security appliance 160 and cloud services 170 is shown. The portion of the VM host 1111 that is illustrated includes the VMM, the security VM1 and the hypervisor1. Of course, as illustrated previously, the VM host 1111 may include a plurality of VMs as seen in FIG. 1 .
[0044] As illustrated, the VMM includes an exploit event detection engine 301, a post-exploit event detection engine 302, a dynamic protection engine 303 and a forensics assistant 304. The exploit event detection engine 301 monitors the processing of the object within the VMM in order to detect an occurrence of a triggering event. Upon detecting the triggering event, the exploit event detection engine 301 collects information associated with the detected triggering event as well as information of the object. Examples of the collected information may include, but is not limited or restricted to, a type of triggering event, the application processing the object that caused the triggering event (e.g., application name and/or version number), input to an application that triggered the event (e.g., simulated user input and/or a document that was used as input), the operating system name and version, etc. The collected information is then provided to the security VM1 for further analysis. Following the detection of an occurrence of the triggering event, the post-exploit event detection engine 302 monitors the processing of the object with the VMM.
[0045] The collection of triggering events may be pre-defined and pre-stored, e.g., in the storage 130. Alternatively, although not illustrated, the triggering events may be pre-stored in a storage device located within the detection system 1101, in the VM host 1111, or in each of the VM1-VMM. The collection of triggering events may be updated via the management system 120 (e.g., due to one or more detections of an exploit and/or malware by detection systems 1102—detection systems 1103). Additionally, the collection of triggering events may be updated by the network security appliance 150, the endpoint security appliance 160 and/or the cloud services 170, wherein such an update may be facilitated by the security VMM.
[0046] Upon detection of a triggering event, the post-exploit event detection engine 302 monitors the processing of the object in the VMM. In contrast, the exploit detection engine 301 monitors the processing prior to detection of a triggering event. Specifically, the monitoring conducted by the post-exploit event detection engine 302 is to detect any changes made to the environment within the VMM (e.g., change in Registry files, attempted changes to the operating system, etc.) and/or actions performed as a result of the triggering event (e.g., a successful or unsuccessful attempt to delete a file/directory, create a file/directory, establish communication with an external server, password protect a file/directory, encrypt a file/directory, etc.). Upon request, the post-exploit event detection engine 302 provides the security VM1 with the collected information associated with the actions and changes subsequent to the detection of the occurrence of the triggering event.
[0047] The dynamic protection engine 303 determines identifying information of the object (e.g., URL, file name of the object, name of attachment in which the object was received email address of the sender of the object, etc.) and provides the initial identifying information to a pre-processing engine 312 implemented within the security VM1 as described below. Upon analysis by the pre-processing engine 312, to be discussed below, the dynamic protection engine 303 receives a notification from the pre-processing engine 312 based on the analysis. Based on the notification from the pre-processing engine 312, the dynamic protection engine 303 may allow the VMM to continue processing or stop processing of the object based on a determination as to whether the object is malicious or non-malicious. Additionally, the dynamic protection engine 303 may save the state information of the VMM when a triggering event is detected (hereinafter referred to as “taking a snapshot”). Subsequently, once processing of the object has been completed and/or the object has been identified as malicious or non-malicious, the dynamic protection engine 303 may revert the VMM back to the state captured in the snapshot.
[0048] The forensics assistant 304 collects state information of the VMM upon the detection of the occurrence of a triggering event. Examples of information collected by the forensics assistant 304 include, but are not limited or restricted to, registry key, registry values, metadata of specific storage locations (e.g., files and/or folders that may be interacted with during processing of an object), a disk image (e.g., a snapshot of a storage device), network activity occurring during processing of an object and/or requests of user interaction occurring during processing of an object.
[0049] The security VM1 includes an analysis engine 311, the pre-processing engine 312 and a forensics collection engine 313. The analysis engine 311 receives information associated with a triggering event and the object being processed from the VMM. Specifically, the analysis engine 311 receives information associated with the triggering event and information associated with the object being processed from the exploit event detection engine 301 as discussed above. The analysis engine 311 performs an analysis on the information received from the exploit event detection engine 301 to determine whether the object being processed in “suspicious.” The analysis performed by the analysis engine 311 is based on one or more correlation rules. The correlation rules provide a basis to determine whether the object is suspicious by assessing whether the information associated with the detected triggering event and the object being processed results in a rule violation.
[0050] For example, one correlation rule may state a prohibition of a particular application writing to a predetermined storage location without permission. A violation of the correlation rule would occur when the particular application attempts to write data to the predetermined storage without permission (whether the write attempt was successful or unsuccessful). Additional correlation rules may relate to occurrences of anomalous behaviors and may be defined for particular applications and/or may be defined for all applications. Additional examples of correlation rules may include, but are not limited or restricted to, a prohibition on copying data stored in a predetermined storage location, a prohibition on deleting data stored in a predetermined storage location, a prohibition on creating a file in a predetermined location in a file system, a prohibition on encrypting data in a predetermined storage location, or the like.
[0051] The analysis engine 311 may include a single set of correlation rules that are applied to all information associated with a detected triggering event. Alternatively, the analysis engine 311 may include multiple sets of correlation rules wherein intelligence (e.g., a filtering mechanism) may determine one or more sets of correlation rules to apply to the received information. For example, one or more sets of correlation rules may be applied based on, among other features, the detected triggering event, the operating system of the VMM and/or the application/process that triggered the occurrence of the triggering event.
[0052] When the analysis based on the correlation rules results in a determination that the object is “suspicious,” the analysis engine 311 requests, from the post-exploit event detection engine 302 of the VMM, additional information pertaining to any changes to and/or actions taken within the environment of the VMM. Based upon the received additional information provided by the post-exploit event detection engine 302, the analysis engine 311 performs further analysis based on correlation rules (e.g., the same as above, a separate set of correlation rules, or a combination) to determine whether the suspicious object is malicious. In one embodiment, the correlation rules may be applied to both the initial information provided by the exploit event detection engine 301 as well as the additional information provided by the post-exploit event detection engine 302. As discussed above, a single set of correlation rules may be applied to the additional information (and optionally the initial information) or one or more sets of correlation rules may be applied based on intelligence in the analysis engine 311. Based on the analysis of at least the additional information provided by the post-exploit event detection engine 302, the analysis engine 311 may determine that the object is “malicious.”
[0053] Furthermore, the analysis of the additional information may occur repeatedly when an analysis of the additional information does not initially result in a determination that the object is malicious. When the analysis of the additional information does not result in a determination that the object is malicious and when the processing of the object in the VMM is not yet complete, the analysis engine 311 may requests more additional information (e.g., information pertaining to changes to and/or actions taken within the environment of the VMM since the first set of additional information was provided). The reoccurring process is illustrated in FIGS. 4A and 4B and will be discussed below.
[0054] The pre-processing engine 312 receives identifying information from the dynamic protection engine 303 and performs an analysis to determine whether the identifying information of the object matches an entry on either a whitelist or a blacklist. When the identifying information of the object matches an entry on the blacklist (e.g., signifying that the object has previously been determined to be malicious), the pre-processing engine 312 may (i) notify the dynamic protection engine 303 that processing of the object should cease as the object is malicious, or (ii) notify the dynamic protection engine 303 of the match between the identifying information of the object and an entry on the blacklist but that processing in the VMM should continue in order to determine and/or verify any malicious effects as a result of processing the object.
[0055] When the identifying information of the object matches an entry on the whitelist (e.g., signifying that the object has previously been determined to be non-malicious), the pre-processing engine 312 may (i) notify the dynamic protection engine 303 that processing of the object should cease as the object is non-malicious, or (ii) notify the dynamic protection engine 303 of the match between the identifying information of the object and an entry on the whitelist but that processing in the VMM should continue in order to verify the object is non-malicious based on updated correlation rules and/or other information collected/generated since the object was placed on the whitelist. When the object does not appear on either a whitelist or a blacklist, the dynamic protection engine 303 is notified to continue processing so that a determination of malicious/non-malicious can be made.
[0056] As is illustrated in FIG. 3 , the analysis engine 311 is communicatively coupled to the endpoint security appliance 160 and the cloud services 170. The result of the analysis performed by the analysis engine 311 may be supplied to the endpoint security appliance 160 for the purpose of alerting a user, network administrator and/or expert network analyst and/or enabling a user, network administrator and/or expert network analyst to view the results. Examples of information that may be displayed for viewing include, but are not limited or restricted to, one or more of (i) how the object entered the network, (ii) which application(s) triggered the occurrence of the triggering event and/or (iii) any malicious effects from the processing of the object. Additionally, the object may be processed by the endpoint security appliance 160 using a two-step analysis of a static analysis and a dynamic analysis. An illustrative example of the two-step analysis including a static analysis and a dynamic analysis may be found in a prior U.S. patent application entitled “Dynamically Remote Tuning of Malware Content Detection System,” U.S. patent application Ser. No. 14/231,216 filed Mar. 31, 2014, the contents of which are incorporated by reference. Furthermore, the results of the analysis engine 311 may be uploaded to the cloud services 170 for future reference by the detection systems 1101-3 and/or client devices.
[0057] As is further illustrated, the pre-processing engine 312 is communicatively coupled to the network security appliance 150. The result of the analysis performed by the pre-processing engine 312 may be supplied to the network security appliance 150 for the purpose of alerting a user, network administrator and/or expert network analyst and/or enabling a user, network administrator and/or expert network analyst to view the results. The viewing may include, among other things, the whitelist/blacklist on which the object appears as well as information associated with the object collected during analysis and/or processing. Additionally, the object may be processed by the network security appliance 170 using a two-step analysis of a static analysis and a dynamic analysis.
[0058] The forensics collection engine 313 collects and analyzes the information (e.g., forensics data) collected by the forensics assistants 304 of each VM1-VMM within the VM Host 1111. The forensics collection engine 313 may collect the information from the forensics assistants 304 at (i) scheduled intervals and/or (ii) upon detection of a triggering event. The forensics collection engine 313 may be configured to query the forensics assistants 304 of each VM1-VMM at scheduled intervals. Additionally, or in the alternative, forensics collection engine 313 may be configured to query the forensics assistants 304 of the VMM in which a triggering event was detected upon the detection.
[0059] Upon receiving a response to one or more queries, the forensics collection engine 313 correlates the collected information against a predetermined rule set (e.g., one or more rules that may recite expected behavior by an object and/or application, and/or one or more rules that may recite anomalous behavior by an object and/or application). The rule set may identify abnormalities of the processing environment of the VMM. For example, the correlation may identify deviations from expected behaviors of an object of a particular object-type or application as a result of processing an object. In one embodiment, one or more of the deviations identified by the rule set may not rise to a suspicious level of a triggering event; however, the forensics collection engine 313 may determine one or more rules of the rule set that were violated, and therefore an alert to, for example, the endpoint security appliance 160 for further processing may be provided by the security VM. Alternatively, one or more rules of the rule set may have different weightings that are used in determining whether an alert should be issued. Furthermore, the detection system 1101 may also provide alerts to the user remotely controlling the VMM from which the information violating the one or more rules of a rule set was collected, a network administration and/or an expert malware analyst. The correlation results and/or information collected by the forensics collection engine 313 may be stored in the storage 130, for example.
[0060] Similarly, the forensics collection engine of the security VM2 collects and analyzes the information collected by the forensics assistants of each VM1-VMN within the VM Host 1112 while the forensics collection engine of the security VM3 collects and analyzes the information collected by the forensics assistants of each VM1-VMQ within the VM Host 111P.
[0061] B. Exemplary Flow of a Virtualized Malware Detection System
[0062] Referring to FIGS. 4A and 4B , flowcharts illustrating an exemplary method for detecting malware and/or exploits using the detection system 1101 are shown. Referring to FIG. 4A , a flowchart illustrating a first exemplary method of detecting malware and/or exploits using detection system 1101 is shown. Each block illustrated in FIG. 4A represents an operation performed in the method 400A of detecting malware and/or exploits based on the use of detection system 1101 wherein the first VM (e.g., the VMM as described above) and the second VM (e.g., the security VM1 as described above) process the object concurrently (at least partially overlapping at the same time).
[0063] At block 401, an object is received within network traffic and at block 402, the object undergoes pre-processing to determine whether the object is malicious. In this embodiment, the pre-processing may include a comparison of information identifying the object with an entry on a whitelist and/or a blacklist. A match between the identifying information of the object and an entry on the blacklist may signify the object is malicious. When the object is determined to be malicious based on pre-processing (yes at block 402), actions are performed to handle the malicious object (block 403). Examples of actions performed to handle a malicious object include, but are not limited or restricted to, (i) generating an alert to notify a user, (ii) a network administrator and/or an expert network analyst, uploading information associated with the malicious object to the cloud services and/or (iii) preventing the object from being received and/or processed by a client device, if possible.
[0064] When pre-processing does not result in a determination that the object is malicious (no at block 402), the first VM launches the object and begins processing (block 405). At block 406, at least one of a set of triggering events is detected that identifies the object as being “potentially suspicious.” When an object is identified as being potentially suspicious, information associated with the object and information associated with the detected triggering event are provided to the second VM for analysis based on one or more correlation rules (block 407). Based on the analysis performed in block 407, a determination is based as to whether the object is suspicious (block 408). When the object is not determined to be suspicious (no at block 408), a determination is made as to whether the processing of the object is complete (e.g., the determination may be made by either the exploit event detection engine 301 or the post-exploit event detection engine 302) (block 409). When the processing of the object is not complete (no at block 409), the first VM continues processing the object while monitoring the processing for the occurrence of at least one or a predefined set of triggering event. When the processing of the object is complete (yes at block 409), the object is determined to be non-malicious (block 410), as no triggering event that led to a determination the object was suspicious was detected.
[0065] When the object is determined to be suspicious (yes at block 408), the second VM requests information associated with the post-event processing of the suspicious object from the first VM (block 412). In one embodiment, the first VM continues to process the object upon detection of the occurrence of the triggering event (e.g., the processing of the first VM and the analysis by the second VM occur concurrently). Therefore, when the second VM requests information associated with the post-event processing, the first VM supplies the information associated with the post-event processing without having to first continue processing of the object.
[0066] The second VM performs further analysis of the information associated with the post-event processing (and, optionally, the information pertaining to the triggering event) based on correlation rules (block 413). Following the further analysis by the second VM, a determination as to whether the object is malicious is made (block 414). When the object is determined to be malicious (yes at block 414), actions for handling the malicious object, as discussed above, are performed (block 415).
[0067] When the object is not determined to be malicious (no at block 414), a determination is made as to whether the processing of the object is complete (block 417). When the processing is complete (yes at block 417), the object is determined to be non-malicious (block 419). Additionally, as described above, the results of the analyses performed by the first VM and/or the second VM may be provided to a user, a network administrator and/or an export network analyst via one or more security appliances.
[0068] When the processing of the object is not complete (not at block 417), the first VM provides the second VM with additional information associated with the post-event processing (e.g., information associated with post-event processing since the second VM was previously provided with information associated with the post-event processing) (block 418) and the method 400A returns to block 413.
[0069] Referring to FIG. 4B , a flowchart illustrating a second exemplary method of detecting malware and/or exploits using the detection system 1101 is shown. Each block illustrated in FIG. 4B represents an operation performed in the method 400B of detecting malware and/or exploits based on the use of the detection system 1101 wherein the first VM and the second VM do not process the object concurrently.
[0070] At block 401, an object is received within network traffic and at block 402, the object undergoes pre-processing to determine whether the object is malicious. In this embodiment, the pre-processing may include a comparison of information identifying the object with an entry on a whitelist and/or a blacklist. A match between the identifying information of the object and an entry on the blacklist may signify the object is malicious. When the object is determined to be malicious based on pre-processing (yes at block 402), actions are performed to handle the malicious object (block 403). Examples of actions performed to handle a malicious object include, but are not limited or restricted to, (i) generating an alert to notify a user, (ii) a network administrator and/or an expert network analyst, uploading information associated with the malicious object to the cloud services and/or (iii) preventing the object from being received and/or processed by a client device, if possible.
[0071] When pre-processing does not result in a determination that the object is malicious (no at block 402), the first VM launches the object and begins processing the object (block 405). At block 406, at least one of a set of triggering events is detected that identifies the object as being “potentially suspicious.” In one embodiment, when an object is identified as being potentially suspicious, the first VM pauses processing and provides information associated with the object and the detected triggering event is provided to the second VM for analysis based on correlation rules (block 421). The second VM performs an analysis of the event information using correlation rules at block 407. Based on the analysis performed in block 407, a determination is based as to whether the object is suspicious (block 408). When the object is not determined to be suspicious at block 408, a determination is made as to whether the processing of the object is complete (e.g., the determination may be made by either the exploit event detection engine 301 or the post-exploit event detection engine 302) (block 409). When the processing of the object is not complete (no at block 409), the first VM continues processing the object, monitoring the processing for the occurrence of a triggering event. When the processing of the object is complete (yes at block 409), the object is determined to be non-malicious (block 410) as no triggering event that led to a determination the object was even suspicious was detected. Subsequently, the process may end at block 411.
[0072] When pre-processing does not result in a determination that the object is malicious (no at block 402), the first VM launches the object and begins processing (block 405). At block 406, at least one of a set of triggering events is detected that identifies the object as being “potentially suspicious.” When an object is identified as being potentially suspicious, the first VM pauses processing and provides information associated with the object and the detected triggering event is provided to the second VM for analysis based on correlation rules (block 421). The second VM performs an analysis of the event information using correlation rules at block 407. Based on the analysis performed in block 407, a determination is based as to whether the object is suspicious (block 408). When the object is not determined to be suspicious at block 408, a determination is made as to whether the processing of the object is complete (e.g., the determination may be made by either the exploit event detection engine 301 or the post-exploit event detection engine 302) (block 409). When the processing of the object is not complete (no at block 409), the first VM continues processing the object while monitoring the processing for the occurrence of at least one of a predefined set of triggering event. When the processing of the object is complete (yes at block 409), the object is determined to be non-malicious (block 410), as no triggering event that led to a determination the object was suspicious was detected.
[0073] When the object is determined to be suspicious (yes at block 408), the second VM notifies the first VM to (i) continue processing the object and (ii) provide information associated with the post-event processing of the suspicious object (block 422). In one embodiment, the first VM continues to process the object upon detection of the triggering event (e.g., the processing of the first VM and the analysis by the second VM occur concurrently). Therefore, when the second VM requests information associated with the post-event processing, the first VM supplies the information associated with the post-event processing without having to first continue processing of the object.
[0074] The first VM pauses processing and the second VM performs further analysis of the information associated with the post-event processing (and, optionally, the information pertaining to the triggering event) based on correlation rules (block 413). Following the further analysis by the second VM, a determination as to whether the object is malicious is made (block 414). When the object is determined to be malicious (yes at block 414), actions for handling the malicious object are performed, as discussed above (block 415).
[0075] When the object is not determined to be malicious (no at block 414), a determination is made as to whether the processing of the object is complete (block 417). When the processing is complete (yes at block 417), the object is determined to be non-malicious (block 419). Additionally, as described above, the results of the analyses performed by the first VM and/or the second VM may be provided to a user, a network administrator and/or an export network analyst via one or more security appliances.
[0076] When the processing of the object is not complete (not at block 417), the first VM continues processing and subsequently provides the second VM with additional information associated with the post-event processing (block 418) and the method 400B returns to block 413.
[0077] Referring to FIGS. 5A and 5B , flowcharts illustrating an exemplary method for detecting malware and/or exploits associated with a URL opened within a browser using the detection system 1101 are shown. Each block illustrated in FIGS. 5A and 5B represents an operation performed in the method 500 of detecting malware and/or exploits based on the use of the detection system 1101 wherein a URL is processed in a browser application. Referring to FIG. 5A , at block 501, a URL is opened in a browser application within a first VM. At block 502, information identifying the URL, in this example, the URL itself, is sent to the second VM for pre-processing to determine whether the URL matches an entry on a blacklist or a whitelist. When the URL is determined to be malicious, e.g., matches an entry on a blacklist (yes at block 503), actions to handle the malicious URL are performed at block 504. Examples of actions to handle the malicious URL include, but are not limited or restricted to, (i) generating an alert to notify a user, (ii) a network administrator and/or an expert network analyst uploading information associated with the malicious object to the cloud services and/or (iii) preventing the object from being received and/or processed by a client device, if possible. In one embodiment, an alert for user notification may be generated at block 505.
[0078] When the URL is not determined to be malicious (no at block 503), the first VM processes the URL in the browser application (block 507). At block 508, a determination is made as to whether a triggering event that identifies the URL as “potentially suspicious” has been detected prior to the completion of the processing of the URL. When a triggering event has not been detected (no at block 508), the URL is determined to be non-malicious at block 509. At optional block 510, the second VM may add information associated with the non-malicious URL to a whitelist for future reference and the process may subsequently end at block 511.
[0079] When a triggering event has been detected (yes at block 508), the URL is determined to be “potentially suspicious,” at block 512 and information associated with the detected triggering event and the information associated with the URL are provided to the second VM at block 513. At block 514, the second VM analyzes the information associated with the detected triggering event and the information associated with the URL using one or more correlation rules wherein a first score is assigned to the URL based on the analysis.
[0080] The method 500 continues in FIG. 5B at block 515 wherein a determination is made as to whether the first score is above a first threshold. When the first score is not above the first threshold (no at block 515), the first VM continues processing the URL in the browser application (block 516) and the method 500 returns to block 507.
[0081] When the first score is determined to be above the first threshold (yes at block 515), the URL is determined to be “suspicious” (block 517). At block 518, the first VM provides the second VM with information associated with the post-event processing associated with the URL (e.g., changes to or actions conducted within the virtual run-time environment of the first VM since the triggering event was detected). At block 519, the second VM performs further analysis on, at least, the information associated with the post-event processing (may optionally include the information associated with the triggering event and the information associated with the URL) based on one or more correlation rules, which may be the same as the correlation rules used above in association with block 514, may be separate correlation rules, or may be a combination thereof. At block 520, a second score is assigned to the URL based on the processing of, at least, the information associated with the post-event processing. A determination is made as to whether the second score exceeds a second threshold at block 521. When the second score is not above the second threshold (no at block 521), the first VM continues processing the URL in the browser application (block 522) and the method 500 returns to block 507.
[0082] When the second score is determined to be above the second threshold (yes at block 521), the URL is determined to be “malicious” (block 523). Actions may then be taken to handle the malicious URL. For example, (i) at optional block 524, the information associated with the URL (e.g., identifying information, metadata, information signifying how the URL was received by the detection system 1101, etc.) may be provided to the second VM for inclusion on a blacklist, (ii) at optional block 525, an alert may be generated for user notification (in one embodiment, using an endpoint security appliance 160 and/or a network security appliance 150), and/or (iii) at optional block 526, the information associated with the URL may be uploaded to cloud services 170 for reference by one or more other detection systems and/or by one or more client devices.
[0083] Referring now to FIG. 6 , an exemplary block diagram of logic associated with the detection system 1101 of FIG. 1 is shown. The detection system 1101 includes one or more processors 600 that are coupled to the communication interface logic 610 via a first transmission medium 620. Communication interface logic 610 enables communication with other detection systems 1102-1103 and management system 120 of FIG. 1 . According to one embodiment of the disclosure, the communication interface logic 610 may be implemented as a physical interface including one or more ports for wired connectors. Additionally, or in the alternative, communication interface logic 610 may be implemented with one or more radio units for supporting wireless communications with other network devices.
[0084] The one or more processors 600 are further coupled to the persistent storage 630 via the transmission medium 625. According to one embodiment of the disclosure, the persistent storage 630 may include (i) the VMM including the exploit event detection engine 301, the post exploit event detection engine 302, the dynamic protection engine 303 and the forensics assistant 304; and (ii) the security VM1 including the analysis engine 311, the pre-processing engine 312 and the forensics collection engine 313. Of course, when implemented as hardware (such as circuitry and/or programmable logic arrays), one or more of these logic units could be implemented separately from each other. In addition, one or more of these logic units may be implemented in hardware while one or more logic units may be implemented as software.
[0085] In the foregoing description, the invention is described with reference to specific exemplary embodiments thereof. It will, however, be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention as set forth in the appended claims.
Claims
What is claimed is:
1. A system comprising:
one or more hardware processors; and
a storage module communicatively coupled to the one or more hardware processors, the storage module comprising logic that, upon execution by the one or more hardware processors, performs operations comprising:
providing, by a first virtual machine, identifying information corresponding to an object to a security virtual machine for analysis of the object, the first virtual machine being one of a plurality of virtual machines and the first virtual machine being different than the security virtual machine;
performing, by the security virtual machine, a pre-processing based on the identifying information to determine whether the object is malicious;
responsive to the pre-processing resulting in a determination of suspicious, potentially suspicious or non-malicious, processing the object in the first virtual machine;
upon detection within the first virtual machine of a triggering event, providing, by the first virtual machine, information associated with the triggering event to the security virtual machine, wherein the detection occurs during the processing of the object in the first virtual machine; and
determining, within the security virtual machine, whether the object is malicious based upon an analysis of the information associated with the triggering event using one or more correlation rules, wherein a hypervisor coordinates communication between the security virtual machine and the plurality of virtual machines to prevent comingling of data between the plurality of virtual machines, and wherein the information associated with the triggering event is different than the identifying information.
2. The system of claim 1, wherein the pre-processing includes a signature check of the identifying information of the object.
3. The system of claim 1, wherein the information associated with the triggering event is an event that, through at least one of experiential knowledge or machine learning techniques, has been determined to have an association with a malicious attack.
4. The system of claim 1, wherein the triggering event is an attempt to perform one of: (i) deleting a first file or a first directory, (ii) creating a second file or second directory, (iii) establishing communication with an external server, (iv) protecting a file or directory with a password, or (v) encrypting a third file or a third directory.
5. The system of claim 1, wherein the first virtual machine simulates an endpoint device through configuration of the first virtual machine using a prescribed software profile.
6. The system of claim 1, wherein logic within the security virtual machine receives information associated with one or more triggering events from each of a plurality of first virtual machines included in the system.
7. The system of claim 1 further comprising:
upon determining that the object is malicious, generating an alert within the security virtual machine to notify one or more of a user of an endpoint device, a network administrator or an expert network analyst.
8. The system of claim 7, wherein the alert is provided to the one or more of a user of an endpoint device, a network administrator or an expert network analyst through a security appliance.
9. The system of claim 1 further comprising:
upon determining that the object is malicious, adding information associated with the object to a blacklist.
10. The system of claim 1 further comprising:
upon determining that the object is malicious, uploading information associated with the object to cloud services.
11. The system of claim 1 further comprising:
receiving, by logic of the security virtual machine, (a) one or more updates to one or more of (i) a blacklist, (ii) a whitelist, or (iii) a correlation rule of one or more correlation rules, or (b) a set of correlation rules including updates to the one or more correlation rules from a security appliance.
12. The system of claim 1, wherein the information associated with the triggering event is provided from the first virtual machine to the security virtual machine via the hypervisor communicatively coupled to the first virtual machine and the security virtual machine.
13. The system of claim 1, wherein a first set of the plurality of virtual machines is configured for utilization by a first entity and a second set of the plurality of virtual machines is configured for utilization by a second entity, and wherein the first entity and the second entity are each one of an enterprise or an entrepreneur.
14. The system of claim 1, wherein the plurality of virtual machines are contained within a virtual machine host.
15. A non-transitory computer readable medium having stored thereon logic that, upon execution by one or more processors, performs operations comprising:
providing, by a first virtual machine, identifying information corresponding to an object to a security virtual machine for analysis of the object, wherein the first virtual machine being one of a plurality of virtual machines and the first virtual machine being different than the security virtual machine;
performing, by the security virtual machine, a pre-processing based on the identifying information to determine whether the object is malicious;
responsive to the pre-processing resulting in a determination of suspicious, potentially suspicious or non-malicious, processing the object in the first virtual machine;
upon detection, by the first virtual machine, of a triggering event, providing, by logic of the first virtual machine, information associated with the triggering event to the security virtual machine, wherein the detection of the triggering event occurs during the processing of the object in the first virtual machine; and
determining, within the security virtual machine, that the object is malicious based upon an analysis of information associated with the triggering event and additional information associated with processing of the object after the detection of the triggering event using one or more correlation rules, wherein a hypervisor coordinates communication between the security virtual machine and the plurality of virtual machines to prevent comingling of data between the plurality of virtual machines, and wherein the information associated with the triggering event, the additional information, and the identifying information are different from each other.
16. The non-transitory computer readable medium of claim 15, wherein the logic that, upon execution by the one or more processors, performs operations further comprising:
determining, within the security virtual machine, that the object is suspicious based upon an analysis of the information associated with the triggering event using one or more correlation rules; and
upon determination the object is suspicious based on the information associated with the triggering event, requesting, by logic within the security virtual machine, the additional information associated with processing of the object after the detection of the triggering event.
17. The non-transitory computer readable medium of claim 15, wherein the pre-processing includes a signature check of the identifying information of the object.
18. The non-transitory computer readable medium of claim 15, wherein the information associated with the triggering event is an event that, through at least one of experiential knowledge or machine learning techniques, has been determined to have an association with a malicious attack.
19. The non-transitory computer readable medium of claim 15, wherein the triggering event is an attempt to perform one of: (i) deleting a first file or a first directory, (ii) creating a second file or second directory, (iii) establishing communication with an external server, (iv) protecting a file or directory with a password, or (v) encrypting a third file or a third directory.
20. The non-transitory computer readable medium of claim 15, wherein the information associated with the triggering event is provided from the first virtual machine to the security virtual machine via the hypervisor communicatively coupled to the first virtual machine and the security virtual machine.
21. The non-transitory computer readable medium of claim 15, wherein a first set of the plurality of virtual machines is configured for utilization by a first entity and a second set of the plurality of virtual machines is configured for utilization by a second entity, and wherein the first entity and the second entity are each one of an enterprise or an entrepreneur.
22. The non-transitory computer readable medium of claim 15, wherein the plurality of virtual machines are contained within a virtual machine host.
23. The non-transitory computer readable medium of claim 15, wherein the logic that, upon execution by the one or more processors, performs operations further comprising:
providing, by the logic of the first virtual machine, additional information associated with processing of the object after the detection of the triggering event, to the security virtual machine; and
determining, within the security virtual machine, that the object is malicious based upon an analysis of the additional information associated with processing of the object after the detection of the triggering event using one or more correlation rules, wherein a hypervisor coordinates communication between the security virtual machine and the plurality of virtual machines to prevent comingling of data between the plurality of virtual machines.
24. A computerized method comprising:
providing, by a first virtual machine, identifying information corresponding to an object to a security virtual machine for analysis of the object, wherein the first virtual machine being one of a plurality of virtual machines and the first virtual machine being different than the security virtual machine;
performing, by the security virtual machine, a pre-processing based on the identifying information to determine whether the object is malicious;
responsive to the pre-processing resulting in a determination of suspicious, potentially suspicious or non-malicious, processing the object in the first virtual machine;
upon detection, within the first virtual machine, of a triggering event, providing, by logic within the first virtual machine, information associated with the triggering event to the security virtual machine, wherein the detection occurs during the processing of the object in the first virtual machine; and
determining, within the security virtual machine, that the object is malicious based upon an analysis of the information associated with the triggering event using one or more correlation rules, and wherein a hypervisor coordinates communication between the security virtual machine and the plurality of virtual machines to prevent comingling of data between the plurality of virtual machines, wherein the information associated with the triggering event is different than the identifying information.
25. The computerized method of claim 24, wherein the triggering event is an attempt to perform one of: (i) deleting a first file or a first directory, (ii) creating a second file or second directory, (iii) establishing communication with an external server, (iv) protecting a file or directory with a password, or (v) encrypting a third file or a third directory.
26. The computerized method of claim 24, wherein the information associated with the triggering event is provided from the first virtual machine to the security virtual machine via the hypervisor communicatively coupled to the first virtual machine and the security virtual machine.
27. The computerized method of claim 24, wherein a first set of the plurality of virtual machines is configured for utilization by a first entity and a second set of the plurality of virtual machines is configured for utilization by a second entity, and wherein the first entity and the second entity are each one of an enterprise or an entrepreneur.
28. The computerized method of claim 24, wherein the plurality of virtual machines are contained within a virtual machine host.
Patent Citations (518)
| Patent | Date | Inventor | Cited By |
|---|---|---|---|
| US4292580(A) | 1981-09-01 | Ott et al. | Applicant |
| US5175732(A) | 1992-12-01 | Hendel et al. | Applicant |
| US5440723(A) | 1995-08-01 | Arnold et al. | Applicant |
| US5490249(A) | 1996-02-01 | Miller | Applicant |
| US5657473(A) | 1997-08-01 | Killean et al. | Applicant |
| US5842002(A) | 1998-11-01 | Schnurer et al. | Applicant |
| US5978917(A) | 1999-11-01 | Chi | Applicant |
| US6088803(A) | 2000-07-01 | Tso et al. | Applicant |
| US6094677(A) | 2000-07-01 | Capek et al. | Applicant |
| US6108799(A) | 2000-08-01 | Boulay et al. | Applicant |
| US6118382(A) | 2000-09-01 | Hibbs et al. | Applicant |
| US6269330(B1) | 2001-07-01 | Cidon et al. | Applicant |
| US6272641(B1) | 2001-08-01 | Ji | Applicant |
| US6279113(B1) | 2001-08-01 | Vaidya | Applicant |
| US6298445(B1) | 2001-10-01 | Shostack et al. | Applicant |
| US6357008(B1) | 2002-03-01 | Nachenberg | Applicant |
| US6417774(B1) | 2002-07-01 | Hibbs et al. | Applicant |
| US6424627(B1) | 2002-07-01 | Sørhaug et al. | Applicant |
| US6442696(B1) | 2002-08-01 | Wray et al. | Applicant |
| US6484315(B1) | 2002-11-01 | Ziese | Applicant |
| US6487666(B1) | 2002-11-01 | Shanklin et al. | Applicant |
| US6493756(B1) | 2002-12-01 | O'Brien et al. | Applicant |
| US6550012(B1) | 2003-04-01 | Villa et al. | Applicant |
| US6700497(B2) | 2004-03-01 | Hibbs et al. | Applicant |
| US6775657(B1) | 2004-08-01 | Baker | Applicant |
| US6831893(B1) | 2004-12-01 | Ben Nun et al. | Applicant |
| US6832367(B1) | 2004-12-01 | Choi et al. | Applicant |
| US6895550(B2) | 2005-05-01 | Kanchirayappa et al. | Applicant |
| US6898632(B2) | 2005-05-01 | Gordy et al. | Applicant |
| US6907396(B1) | 2005-06-01 | Muttik et al. | Applicant |
| US6941348(B2) | 2005-09-01 | Petry et al. | Applicant |
| US6971097(B1) | 2005-11-01 | Wallman | Applicant |
| US6981279(B1) | 2005-12-01 | Arnold et al. | Applicant |
| US6995665(B2) | 2006-02-01 | Appelt et al. | Applicant |
| US7007107(B1) | 2006-02-01 | Ivchenko et al. | Applicant |
| US7028179(B2) | 2006-04-01 | Anderson et al. | Applicant |
| US7043757(B2) | 2006-05-01 | Hoefelmeyer et al. | Applicant |
| US7069316(B1) | 2006-06-01 | Gryaznov | Applicant |
| US7080407(B1) | 2006-07-01 | Zhao et al. | Applicant |
| US7080408(B1) | 2006-07-01 | Pak et al. | Applicant |
| US7093002(B2) | 2006-08-01 | Wolff et al. | Applicant |
| US7093239(B1) | 2006-08-01 | van der Made | Applicant |
| US7096498(B2) | 2006-08-01 | Judge | Applicant |
| US7100201(B2) | 2006-08-01 | Izatt | Applicant |
| US7107617(B2) | 2006-09-01 | Hursey et al. | Applicant |
| US7159149(B2) | 2007-01-01 | Spiegel et al. | Applicant |
| US7213260(B2) | 2007-05-01 | Judge | Applicant |
| US7231667(B2) | 2007-06-01 | Jordan | Applicant |
| US7240364(B1) | 2007-07-01 | Branscomb et al. | Applicant |
| US7240368(B1) | 2007-07-01 | Roesch et al. | Applicant |
| US7243371(B1) | 2007-07-01 | Kasper et al. | Applicant |
| US7249175(B1) | 2007-07-01 | Donaldson | Applicant |
| US7287278(B2) | 2007-10-01 | Liang | Applicant |
| US7308716(B2) | 2007-12-01 | Danford et al. | Applicant |
| US7328453(B2) | 2008-02-01 | Merkle, Jr. et al. | Applicant |
| US7346486(B2) | 2008-03-01 | Ivancic et al. | Applicant |
| US7356736(B2) | 2008-04-01 | Natvig | Applicant |
| US7386888(B2) | 2008-06-01 | Liang et al. | Applicant |
| US7392542(B2) | 2008-06-01 | Bucher | Applicant |
| US7418729(B2) | 2008-08-01 | Szor | Applicant |
| US7428300(B1) | 2008-09-01 | Drew et al. | Applicant |
| US7441272(B2) | 2008-10-01 | Durham et al. | Applicant |
| US7448084(B1) | 2008-11-01 | Apap et al. | Applicant |
| US7458098(B2) | 2008-11-01 | Judge et al. | Applicant |
| US7464404(B2) | 2008-12-01 | Carpenter et al. | Applicant |
| US7464407(B2) | 2008-12-01 | Nakae et al. | Applicant |
| US7467408(B1) | 2008-12-01 | O'Toole, Jr. | Applicant |
| US7478428(B1) | 2009-01-01 | Thomlinson | Applicant |
| US7480773(B1) | 2009-01-01 | Reed | Applicant |
| US7487543(B2) | 2009-02-01 | Arnold et al. | Applicant |
| US7496960(B1) | 2009-02-01 | Chen et al. | Applicant |
| US7496961(B2) | 2009-02-01 | Zimmer et al. | Applicant |
| US7519990(B1) | 2009-04-01 | Xie | Applicant |
| US7523493(B2) | 2009-04-01 | Liang et al. | Applicant |
| US7530104(B1) | 2009-05-01 | Thrower et al. | Applicant |
| US7540025(B2) | 2009-05-01 | Tzadikario | Applicant |
| US7565550(B2) | 2009-07-01 | Liang et al. | Applicant |
| US7568233(B1) | 2009-07-01 | Szor et al. | Applicant |
| US7584455(B2) | 2009-09-01 | Ball | Applicant |
| US7603715(B2) | 2009-10-01 | Costa et al. | Applicant |
| US7607171(B1) | 2009-10-01 | Marsden et al. | Applicant |
| US7639714(B2) | 2009-12-01 | Stolfo et al. | Applicant |
| US7644441(B2) | 2010-01-01 | Schmid et al. | Applicant |
| US7657419(B2) | 2010-02-01 | van der Made | Applicant |
| US7676841(B2) | 2010-03-01 | Sobchuk et al. | Applicant |
| US7698548(B2) | 2010-04-01 | Shelest et al. | Applicant |
| US7707633(B2) | 2010-04-01 | Danford et al. | Applicant |
| US7712136(B2) | 2010-05-01 | Sprosts et al. | Applicant |
| US7730011(B1) | 2010-06-01 | Deninger et al. | Applicant |
| US7739740(B1) | 2010-06-01 | Nachenberg et al. | Applicant |
| US7779463(B2) | 2010-08-01 | Stolfo et al. | Applicant |
| US7784097(B1) | 2010-08-01 | Stolfo et al. | Applicant |
| US7832008(B1) | 2010-11-01 | Kraemer | Applicant |
| US7836502(B1) | 2010-11-01 | Zhao et al. | Applicant |
| US7849506(B1) | 2010-12-01 | Dansey et al. | Applicant |
| US7854007(B2) | 2010-12-01 | Sprosts et al. | Applicant |
| US7869073(B2) | 2011-01-01 | Oshima | Applicant |
| US7877803(B2) | 2011-01-01 | Enstone et al. | Applicant |
| US7904959(B2) | 2011-03-01 | Sidiroglou et al. | Applicant |
| US7908660(B2) | 2011-03-01 | Bahl | Applicant |
| US7930738(B1) | 2011-04-01 | Petersen | Applicant |
| US7937761(B1) | 2011-05-01 | Bennett | Applicant |
| US7949849(B2) | 2011-05-01 | Lowe et al. | Applicant |
| US7996556(B2) | 2011-08-01 | Raghavan et al. | Applicant |
| US7996836(B1) | 2011-08-01 | McCorkendale et al. | Applicant |
| US7996904(B1) | 2011-08-01 | Chiueh et al. | Applicant |
| US7996905(B2) | 2011-08-01 | Arnold et al. | Applicant |
| US8006305(B2) | 2011-08-01 | Aziz | Applicant |
| US8010667(B2) | 2011-08-01 | Zhang et al. | Applicant |
| US8020206(B2) | 2011-09-01 | Hubbard et al. | Applicant |
| US8028338(B1) | 2011-09-01 | Schneider et al. | Applicant |
| US8042184(B1) | 2011-10-01 | Batenin | Applicant |
| US8045094(B2) | 2011-10-01 | Teragawa | Applicant |
| US8045458(B2) | 2011-10-01 | Alperovitch et al. | Applicant |
| US8069484(B2) | 2011-11-01 | McMillan et al. | Applicant |
| US8087086(B1) | 2011-12-01 | Lai et al. | Applicant |
| US8171553(B2) | 2012-05-01 | Aziz et al. | Applicant |
| US8176049(B2) | 2012-05-01 | Deninger et al. | Applicant |
| US8176480(B1) | 2012-05-01 | Spertus | Applicant |
| US8201246(B1) | 2012-06-01 | Wu et al. | Applicant |
| US8204984(B1) | 2012-06-01 | Aziz et al. | Applicant |
| US8214905(B1) | 2012-07-01 | Doukhvalov et al. | Applicant |
| US8220055(B1) | 2012-07-01 | Kennedy | Applicant |
| US8225288(B2) | 2012-07-01 | Miller et al. | Applicant |
| US8225373(B2) | 2012-07-01 | Kraemer | Applicant |
| US8233882(B2) | 2012-07-01 | Rogel | Applicant |
| US8234640(B1) | 2012-07-01 | Fitzgerald et al. | Applicant |
| US8234709(B2) | 2012-07-01 | Viljoen et al. | Applicant |
| US8239944(B1) | 2012-08-01 | Nachenberg et al. | Applicant |
| US8260914(B1) | 2012-09-01 | Ranjan | Applicant |
| US8266091(B1) | 2012-09-01 | Gubin et al. | Applicant |
| US8286251(B2) | 2012-10-01 | Eker et al. | Applicant |
| US8291499(B2) | 2012-10-01 | Aziz et al. | Applicant |
| US8307435(B1) | 2012-11-01 | Mann et al. | Applicant |
| US8307443(B2) | 2012-11-01 | Wang et al. | Applicant |
| US8312545(B2) | 2012-11-01 | Tuvell et al. | Applicant |
| US8321936(B1) | 2012-11-01 | Green et al. | Applicant |
| US8321941(B2) | 2012-11-01 | Tuvell et al. | Applicant |
| US8332571(B1) | 2012-12-01 | Edwards, Sr. | Applicant |
| US8365286(B2) | 2013-01-01 | Poston | Applicant |
| US8365297(B1) | 2013-01-01 | Parshin et al. | Applicant |
| US8370938(B1) | 2013-02-01 | Daswani et al. | Applicant |
| US8370939(B2) | 2013-02-01 | Zaitsev et al. | Applicant |
| US8375444(B2) | 2013-02-01 | Aziz et al. | Applicant |
| US8381299(B2) | 2013-02-01 | Stolfo et al. | Applicant |
| US8402529(B1) | 2013-03-01 | Green et al. | Applicant |
| US8464340(B2) | 2013-06-01 | Ahn et al. | Applicant |
| US8479174(B2) | 2013-07-01 | Chiriac | Applicant |
| US8479276(B1) | 2013-07-01 | Vaystikh et al. | Applicant |
| US8479291(B1) | 2013-07-01 | Bodke | Applicant |
| US8510827(B1) | 2013-08-01 | Leake et al. | Applicant |
| US8510828(B1) | 2013-08-01 | Guo et al. | Applicant |
| US8510842(B2) | 2013-08-01 | Amit et al. | Applicant |
| US8516478(B1) | 2013-08-01 | Edwards et al. | Applicant |
| US8516590(B1) | 2013-08-01 | Ranadive | Examiner |
| US8516593(B2) | 2013-08-01 | Aziz | Applicant |
| US8522348(B2) | 2013-08-01 | Chen et al. | Applicant |
| US8528086(B1) | 2013-09-01 | Aziz | Applicant |
| US8533824(B2) | 2013-09-01 | Hutton et al. | Applicant |
| US8539582(B1) | 2013-09-01 | Aziz et al. | Applicant |
| US8549638(B2) | 2013-10-01 | Aziz | Applicant |
| US8555391(B1) | 2013-10-01 | Demir et al. | Applicant |
| US8561177(B1) | 2013-10-01 | Aziz et al. | Applicant |
| US8566946(B1) | 2013-10-01 | Aziz et al. | Applicant |
| US8584094(B2) | 2013-11-01 | Dadhia et al. | Applicant |
| US8584234(B1) | 2013-11-01 | Sobel et al. | Applicant |
| US8584239(B2) | 2013-11-01 | Aziz et al. | Applicant |
| US8595834(B2) | 2013-11-01 | Xie et al. | Applicant |
| US8627476(B1) | 2014-01-01 | Satish et al. | Applicant |
| US8635696(B1) | 2014-01-01 | Aziz | Applicant |
| US8682054(B2) | 2014-03-01 | Xue et al. | Applicant |
| US8682812(B1) | 2014-03-01 | Ranjan | Applicant |
| US8689333(B2) | 2014-04-01 | Aziz | Applicant |
| US8695096(B1) | 2014-04-01 | Zhang | Applicant |
| US8713631(B1) | 2014-04-01 | Pavlyushchik | Applicant |
| US8713681(B2) | 2014-04-01 | Silberman et al. | Applicant |
| US8726392(B1) | 2014-05-01 | McCorkendale et al. | Applicant |
| US8739280(B2) | 2014-05-01 | Chess et al. | Applicant |
| US8776229(B1) | 2014-07-01 | Aziz | Applicant |
| US8782792(B1) | 2014-07-01 | Bodke | Applicant |
| US8789172(B2) | 2014-07-01 | Stolfo et al. | Applicant |
| US8789178(B2) | 2014-07-01 | Kejriwal et al. | Applicant |
| US8793787(B2) | 2014-07-01 | Ismael et al. | Applicant |
| US8805947(B1) | 2014-08-01 | Kuzkin et al. | Applicant |
| US8806647(B1) | 2014-08-01 | Daswani et al. | Applicant |
| US8832829(B2) | 2014-09-01 | Manni et al. | Applicant |
| US8850570(B1) | 2014-09-01 | Ramzan | Applicant |
| US8850571(B2) | 2014-09-01 | Staniford et al. | Applicant |
| US8881234(B2) | 2014-11-01 | Narasimhan et al. | Applicant |
| US8881282(B1) | 2014-11-01 | Aziz et al. | Applicant |
| US8898788(B1) | 2014-11-01 | Aziz et al. | Applicant |
| US8935779(B2) | 2015-01-01 | Manni et al. | Applicant |
| US8984638(B1) | 2015-03-01 | Aziz et al. | Applicant |
| US8990939(B2) | 2015-03-01 | Staniford et al. | Applicant |
| US8990944(B1) | 2015-03-01 | Singh et al. | Applicant |
| US8997219(B2) | 2015-03-01 | Staniford et al. | Applicant |
| US9009822(B1) | 2015-04-01 | Ismael et al. | Applicant |
| US9009823(B1) | 2015-04-01 | Ismael et al. | Applicant |
| US9027135(B1) | 2015-05-01 | Aziz | Applicant |
| US9071638(B1) | 2015-06-01 | Aziz et al. | Applicant |
| US9104867(B1) | 2015-08-01 | Thioux et al. | Applicant |
| US9106694(B2) | 2015-08-01 | Aziz et al. | Applicant |
| US9118715(B2) | 2015-08-01 | Staniford et al. | Applicant |
| US2001/0005889(A1) | 2001-06-01 | Albrecht | Applicant |
| US2001/0047326(A1) | 2001-11-01 | Broadbent et al. | Applicant |
| US2002/0018903(A1) | 2002-02-01 | Kokubo et al. | Applicant |
| US2002/0038430(A1) | 2002-03-01 | Edwards et al. | Applicant |
| US2002/0091819(A1) | 2002-07-01 | Melchione et al. | Applicant |
| US2002/0095607(A1) | 2002-07-01 | Lin-Hendel | Applicant |
| US2002/0116627(A1) | 2002-08-01 | Tarbotton et al. | Applicant |
| US2002/0144156(A1) | 2002-10-01 | Copeland | Applicant |
| US2002/0162015(A1) | 2002-10-01 | Tang | Applicant |
| US2002/0166063(A1) | 2002-11-01 | Lachman et al. | Applicant |
| US2002/0169952(A1) | 2002-11-01 | DiSanto et al. | Applicant |
| US2002/0184528(A1) | 2002-12-01 | Shevenell et al. | Applicant |
| US2002/0188887(A1) | 2002-12-01 | Largman et al. | Applicant |
| US2002/0194490(A1) | 2002-12-01 | Halperin et al. | Applicant |
| US2003/0074578(A1) | 2003-04-01 | Ford et al. | Applicant |
| US2003/0084318(A1) | 2003-05-01 | Schertz | Applicant |
| US2003/0101381(A1) | 2003-05-01 | Mateev et al. | Applicant |
| US2003/0115483(A1) | 2003-06-01 | Liang | Applicant |
| US2003/0188190(A1) | 2003-10-01 | Aaron et al. | Applicant |
| US2003/0191957(A1) | 2003-10-01 | Hypponen et al. | Applicant |
| US2003/0200460(A1) | 2003-10-01 | Morota et al. | Applicant |
| US2003/0212902(A1) | 2003-11-01 | van der Made | Applicant |
| US2003/0229801(A1) | 2003-12-01 | Kouznetsov et al. | Applicant |
| US2003/0237000(A1) | 2003-12-01 | Denton et al. | Applicant |
| US2004/0003323(A1) | 2004-01-01 | Bennett et al. | Applicant |
| US2004/0015712(A1) | 2004-01-01 | Szor | Applicant |
| US2004/0019832(A1) | 2004-01-01 | Arnold et al. | Applicant |
| US2004/0047356(A1) | 2004-03-01 | Bauer | Applicant |
| US2004/0083408(A1) | 2004-04-01 | Spiegel et al. | Applicant |
| US2004/0088581(A1) | 2004-05-01 | Brawn et al. | Applicant |
| US2004/0093513(A1) | 2004-05-01 | Cantrell et al. | Applicant |
| US2004/0111531(A1) | 2004-06-01 | Staniford et al. | Applicant |
| US2004/0117478(A1) | 2004-06-01 | Triulzi et al. | Applicant |
| US2004/0117624(A1) | 2004-06-01 | Brandt et al. | Applicant |
| US2004/0128355(A1) | 2004-07-01 | Chao et al. | Applicant |
| US2004/0165588(A1) | 2004-08-01 | Pandya | Applicant |
| US2004/0236963(A1) | 2004-11-01 | Danford et al. | Applicant |
| US2004/0243349(A1) | 2004-12-01 | Greifeneder et al. | Applicant |
| US2004/0249911(A1) | 2004-12-01 | Alkhatib et al. | Applicant |
| US2004/0255161(A1) | 2004-12-01 | Cavanaugh | Applicant |
| US2004/0268147(A1) | 2004-12-01 | Wiederin et al. | Applicant |
| US2005/0005159(A1) | 2005-01-01 | Oliphant | Applicant |
| US2005/0021740(A1) | 2005-01-01 | Bar et al. | Applicant |
| US2005/0033960(A1) | 2005-02-01 | Vialen et al. | Applicant |
| US2005/0033989(A1) | 2005-02-01 | Poletto et al. | Applicant |
| US2005/0050148(A1) | 2005-03-01 | Mohammadioun et al. | Applicant |
| US2005/0086523(A1) | 2005-04-01 | Zimmer et al. | Applicant |
| US2005/0091513(A1) | 2005-04-01 | Mitomo et al. | Applicant |
| US2005/0091533(A1) | 2005-04-01 | Omote et al. | Applicant |
| US2005/0091652(A1) | 2005-04-01 | Ross et al. | Applicant |
| US2005/0108562(A1) | 2005-05-01 | Khazan et al. | Applicant |
| US2005/0114663(A1) | 2005-05-01 | Cornell et al. | Applicant |
| US2005/0125195(A1) | 2005-06-01 | Brendel | Applicant |
| US2005/0149726(A1) | 2005-07-01 | Joshi et al. | Applicant |
| US2005/0157662(A1) | 2005-07-01 | Bingham et al. | Applicant |
| US2005/0183143(A1) | 2005-08-01 | Anderholm et al. | Applicant |
| US2005/0201297(A1) | 2005-09-01 | Peikari | Applicant |
| US2005/0210533(A1) | 2005-09-01 | Copeland et al. | Applicant |
| US2005/0238005(A1) | 2005-10-01 | Chen et al. | Applicant |
| US2005/0240781(A1) | 2005-10-01 | Gassoway | Applicant |
| US2005/0262562(A1) | 2005-11-01 | Gassoway | Applicant |
| US2005/0265331(A1) | 2005-12-01 | Stolfo | Applicant |
| US2005/0283839(A1) | 2005-12-01 | Cowburn | Applicant |
| US2006/0010495(A1) | 2006-01-01 | Cohen et al. | Applicant |
| US2006/0015416(A1) | 2006-01-01 | Hoffman et al. | Applicant |
| US2006/0015715(A1) | 2006-01-01 | Anderson | Applicant |
| US2006/0015747(A1) | 2006-01-01 | Van De Ven | Applicant |
| US2006/0021029(A1) | 2006-01-01 | Brickell et al. | Applicant |
| US2006/0021054(A1) | 2006-01-01 | Costa et al. | Applicant |
| US2006/0031476(A1) | 2006-02-01 | Mathes et al. | Applicant |
| US2006/0047665(A1) | 2006-03-01 | Neil | Applicant |
| US2006/0070130(A1) | 2006-03-01 | Costea et al. | Applicant |
| US2006/0075496(A1) | 2006-04-01 | Carpenter et al. | Applicant |
| US2006/0095968(A1) | 2006-05-01 | Portolani et al. | Applicant |
| US2006/0101516(A1) | 2006-05-01 | Sudaharan et al. | Applicant |
| US2006/0101517(A1) | 2006-05-01 | Banzhof et al. | Applicant |
| US2006/0117385(A1) | 2006-06-01 | Mester et al. | Applicant |
| US2006/0123477(A1) | 2006-06-01 | Raghavan et al. | Applicant |
| US2006/0143709(A1) | 2006-06-01 | Brooks et al. | Applicant |
| US2006/0150249(A1) | 2006-07-01 | Gassen et al. | Applicant |
| US2006/0161983(A1) | 2006-07-01 | Cothrell et al. | Applicant |
| US2006/0161987(A1) | 2006-07-01 | Levy-Yurista | Applicant |
| US2006/0161989(A1) | 2006-07-01 | Reshef et al. | Applicant |
| US2006/0164199(A1) | 2006-07-01 | Gilde et al. | Applicant |
| US2006/0173992(A1) | 2006-08-01 | Weber et al. | Applicant |
| US2006/0179147(A1) | 2006-08-01 | Tran et al. | Applicant |
| US2006/0184632(A1) | 2006-08-01 | Marino et al. | Applicant |
| US2006/0191010(A1) | 2006-08-01 | Benjamin | Applicant |
| US2006/0221956(A1) | 2006-10-01 | Narayan et al. | Applicant |
| US2006/0236393(A1) | 2006-10-01 | Kramer et al. | Applicant |
| US2006/0242709(A1) | 2006-10-01 | Seinfeld et al. | Applicant |
| US2006/0248519(A1) | 2006-11-01 | Jaeger et al. | Applicant |
| US2006/0248582(A1) | 2006-11-01 | Panjwani et al. | Applicant |
| US2006/0251104(A1) | 2006-11-01 | Koga | Applicant |
| US2006/0288417(A1) | 2006-12-01 | Bookbinder et al. | Applicant |
| US2007/0006288(A1) | 2007-01-01 | Mayfield et al. | Applicant |
| US2007/0006313(A1) | 2007-01-01 | Porras et al. | Applicant |
| US2007/0011174(A1) | 2007-01-01 | Takaragi et al. | Applicant |
| US2007/0016951(A1) | 2007-01-01 | Piccard et al. | Applicant |
| US2007/0033645(A1) | 2007-02-01 | Jones | Applicant |
| US2007/0038943(A1) | 2007-02-01 | FitzGerald et al. | Applicant |
| US2007/0064689(A1) | 2007-03-01 | Shin et al. | Applicant |
| US2007/0074169(A1) | 2007-03-01 | Chess et al. | Applicant |
| US2007/0094730(A1) | 2007-04-01 | Bhikkaji et al. | Applicant |
| US2007/0101435(A1) | 2007-05-01 | Konanka et al. | Applicant |
| US2007/0128855(A1) | 2007-06-01 | Cho et al. | Applicant |
| US2007/0142030(A1) | 2007-06-01 | Sinha et al. | Applicant |
| US2007/0143827(A1) | 2007-06-01 | Nicodemus et al. | Applicant |
| US2007/0156895(A1) | 2007-07-01 | Vuong | Applicant |
| US2007/0157180(A1) | 2007-07-01 | Tillmann et al. | Applicant |
| US2007/0157306(A1) | 2007-07-01 | Elrod et al. | Applicant |
| US2007/0168988(A1) | 2007-07-01 | Eisner et al. | Applicant |
| US2007/0171824(A1) | 2007-07-01 | Ruello et al. | Applicant |
| US2007/0174915(A1) | 2007-07-01 | Gribble et al. | Applicant |
| US2007/0192500(A1) | 2007-08-01 | Lum | Applicant |
| US2007/0192858(A1) | 2007-08-01 | Lum | Applicant |
| US2007/0198275(A1) | 2007-08-01 | Malden et al. | Applicant |
| US2007/0208822(A1) | 2007-09-01 | Wang et al. | Applicant |
| US2007/0220607(A1) | 2007-09-01 | Sprosts et al. | Applicant |
| US2007/0240218(A1) | 2007-10-01 | Tuvell et al. | Applicant |
| US2007/0240219(A1) | 2007-10-01 | Tuvell et al. | Applicant |
| US2007/0240220(A1) | 2007-10-01 | Tuvell et al. | Applicant |
| US2007/0240222(A1) | 2007-10-01 | Tuvell et al. | Applicant |
| US2007/0250930(A1) | 2007-10-01 | Aziz et al. | Applicant |
| US2007/0256132(A2) | 2007-11-01 | Oliphant | Applicant |
| US2007/0271446(A1) | 2007-11-01 | Nakamura | Applicant |
| US2008/0005782(A1) | 2008-01-01 | Aziz | Applicant |
| US2008/0028463(A1) | 2008-01-01 | Dagon et al. | Applicant |
| US2008/0032556(A1) | 2008-02-01 | Schreier | Applicant |
| US2008/0040710(A1) | 2008-02-01 | Chiriac | Applicant |
| US2008/0046781(A1) | 2008-02-01 | Childs et al. | Applicant |
| US2008/0066179(A1) | 2008-03-01 | Liu | Applicant |
| US2008/0072326(A1) | 2008-03-01 | Danford et al. | Applicant |
| US2008/0077793(A1) | 2008-03-01 | Tan et al. | Applicant |
| US2008/0080518(A1) | 2008-04-01 | Hoeflin et al. | Applicant |
| US2008/0086720(A1) | 2008-04-01 | Lekel | Applicant |
| US2008/0098476(A1) | 2008-04-01 | Syversen | Applicant |
| US2008/0120722(A1) | 2008-05-01 | Sima et al. | Applicant |
| US2008/0134178(A1) | 2008-06-01 | Fitzgerald et al. | Applicant |
| US2008/0134334(A1) | 2008-06-01 | Kim et al. | Applicant |
| US2008/0141376(A1) | 2008-06-01 | Clausen et al. | Applicant |
| US2008/0184373(A1) | 2008-07-01 | Traut et al. | Applicant |
| US2008/0189787(A1) | 2008-08-01 | Arnold et al. | Applicant |
| US2008/0201778(A1) | 2008-08-01 | Guo et al. | Applicant |
| US2008/0209557(A1) | 2008-08-01 | Herley et al. | Applicant |
| US2008/0215742(A1) | 2008-09-01 | Goldszmidt et al. | Applicant |
| US2008/0222729(A1) | 2008-09-01 | Chen et al. | Applicant |
| US2008/0263665(A1) | 2008-10-01 | Ma et al. | Applicant |
| US2008/0295172(A1) | 2008-11-01 | Bohacek | Applicant |
| US2008/0301810(A1) | 2008-12-01 | Lehane et al. | Applicant |
| US2008/0307524(A1) | 2008-12-01 | Singh et al. | Applicant |
| US2008/0313738(A1) | 2008-12-01 | Enderby | Applicant |
| US2008/0320594(A1) | 2008-12-01 | Jiang | Applicant |
| US2009/0003317(A1) | 2009-01-01 | Kasralikar et al. | Applicant |
| US2009/0007100(A1) | 2009-01-01 | Field et al. | Applicant |
| US2009/0013408(A1) | 2009-01-01 | Schipka | Applicant |
| US2009/0031423(A1) | 2009-01-01 | Liu et al. | Applicant |
| US2009/0036111(A1) | 2009-02-01 | Danford et al. | Applicant |
| US2009/0037835(A1) | 2009-02-01 | Goldman | Applicant |
| US2009/0044024(A1) | 2009-02-01 | Oberheide et al. | Applicant |
| US2009/0044274(A1) | 2009-02-01 | Budko et al. | Applicant |
| US2009/0064332(A1) | 2009-03-01 | Porras et al. | Applicant |
| US2009/0077666(A1) | 2009-03-01 | Chen et al. | Applicant |
| US2009/0083369(A1) | 2009-03-01 | Marmor | Applicant |
| US2009/0083855(A1) | 2009-03-01 | Apap et al. | Applicant |
| US2009/0089879(A1) | 2009-04-01 | Wang et al. | Applicant |
| US2009/0094697(A1) | 2009-04-01 | Provos et al. | Applicant |
| US2009/0113425(A1) | 2009-04-01 | Ports et al. | Applicant |
| US2009/0125976(A1) | 2009-05-01 | Wassermann et al. | Applicant |
| US2009/0126015(A1) | 2009-05-01 | Monastyrsky et al. | Applicant |
| US2009/0126016(A1) | 2009-05-01 | Sobko et al. | Applicant |
| US2009/0133125(A1) | 2009-05-01 | Choi et al. | Applicant |
| US2009/0144823(A1) | 2009-06-01 | Lamastra et al. | Applicant |
| US2009/0158430(A1) | 2009-06-01 | Borders | Applicant |
| US2009/0172815(A1) | 2009-07-01 | Gu et al. | Applicant |
| US2009/0187992(A1) | 2009-07-01 | Poston | Applicant |
| US2009/0193293(A1) | 2009-07-01 | Stolfo et al. | Applicant |
| US2009/0199296(A1) | 2009-08-01 | Xie et al. | Applicant |
| US2009/0228233(A1) | 2009-09-01 | Anderson et al. | Applicant |
| US2009/0241187(A1) | 2009-09-01 | Troyansky | Applicant |
| US2009/0241190(A1) | 2009-09-01 | Todd et al. | Applicant |
| US2009/0265692(A1) | 2009-10-01 | Godefroid et al. | Applicant |
| US2009/0271867(A1) | 2009-10-01 | Zhang | Applicant |
| US2009/0300415(A1) | 2009-12-01 | Zhang et al. | Applicant |
| US2009/0300761(A1) | 2009-12-01 | Park et al. | Applicant |
| US2009/0328185(A1) | 2009-12-01 | Berg et al. | Applicant |
| US2009/0328221(A1) | 2009-12-01 | Blumfield et al. | Applicant |
| US2010/0005146(A1) | 2010-01-01 | Drako et al. | Applicant |
| US2010/0011205(A1) | 2010-01-01 | McKenna | Applicant |
| US2010/0017546(A1) | 2010-01-01 | Poo et al. | Applicant |
| US2010/0031353(A1) | 2010-02-01 | Thomas et al. | Applicant |
| US2010/0037314(A1) | 2010-02-01 | Perdisci et al. | Applicant |
| US2010/0043073(A1) | 2010-02-01 | Kuwamura | Applicant |
| US2010/0054278(A1) | 2010-03-01 | Stolfo et al. | Applicant |
| US2010/0058474(A1) | 2010-03-01 | Hicks | Applicant |
| US2010/0064044(A1) | 2010-03-01 | Nonoyama | Applicant |
| US2010/0077481(A1) | 2010-03-01 | Polyakov et al. | Applicant |
| US2010/0083376(A1) | 2010-04-01 | Pereira et al. | Applicant |
| US2010/0115621(A1) | 2010-05-01 | Staniford et al. | Applicant |
| US2010/0132038(A1) | 2010-05-01 | Zaitsev | Applicant |
| US2010/0154056(A1) | 2010-06-01 | Smith et al. | Applicant |
| US2010/0180344(A1) | 2010-07-01 | Malyshev et al. | Applicant |
| US2010/0192223(A1) | 2010-07-01 | Ismael et al. | Applicant |
| US2010/0220863(A1) | 2010-09-01 | Dupaquis et al. | Applicant |
| US2010/0235831(A1) | 2010-09-01 | Dittmer | Applicant |
| US2010/0251104(A1) | 2010-09-01 | Massand | Applicant |
| US2010/0281102(A1) | 2010-11-01 | Chinta et al. | Applicant |
| US2010/0281541(A1) | 2010-11-01 | Stolfo et al. | Applicant |
| US2010/0281542(A1) | 2010-11-01 | Stolfo et al. | Applicant |
| US2010/0287260(A1) | 2010-11-01 | Peterson et al. | Applicant |
| US2010/0299754(A1) | 2010-11-01 | Amit et al. | Applicant |
| US2010/0306173(A1) | 2010-12-01 | Frank | Applicant |
| US2011/0004737(A1) | 2011-01-01 | Greenebaum | Applicant |
| US2011/0025504(A1) | 2011-02-01 | Lyon et al. | Applicant |
| US2011/0041179(A1) | 2011-02-01 | St Hlberg | Applicant |
| US2011/0047594(A1) | 2011-02-01 | Mahaffey et al. | Applicant |
| US2011/0047620(A1) | 2011-02-01 | Mahaffey et al. | Applicant |
| US2011/0055907(A1) | 2011-03-01 | Narasimhan et al. | Applicant |
| US2011/0078794(A1) | 2011-03-01 | Manni et al. | Applicant |
| US2011/0093951(A1) | 2011-04-01 | Aziz | Applicant |
| US2011/0099620(A1) | 2011-04-01 | Stavrou et al. | Applicant |
| US2011/0099633(A1) | 2011-04-01 | Aziz | Applicant |
| US2011/0113231(A1) | 2011-05-01 | Kaminsky | Applicant |
| US2011/0145918(A1) | 2011-06-01 | Jung et al. | Applicant |
| US2011/0145920(A1) | 2011-06-01 | Mahaffey et al. | Applicant |
| US2011/0145934(A1) | 2011-06-01 | Abramovici et al. | Applicant |
| US2011/0167493(A1) | 2011-07-01 | Song et al. | Applicant |
| US2011/0167494(A1) | 2011-07-01 | Bowen et al. | Applicant |
| US2011/0173460(A1) | 2011-07-01 | Ito et al. | Applicant |
| US2011/0219449(A1) | 2011-09-01 | St Neitzel et al. | Applicant |
| US2011/0219450(A1) | 2011-09-01 | McDougal et al. | Applicant |
| US2011/0225624(A1) | 2011-09-01 | Sawhney et al. | Applicant |
| US2011/0225655(A1) | 2011-09-01 | Niemela et al. | Applicant |
| US2011/0247072(A1) | 2011-10-01 | Staniford et al. | Applicant |
| US2011/0265182(A1) | 2011-10-01 | Peinado et al. | Applicant |
| US2011/0289582(A1) | 2011-11-01 | Kejriwal et al. | Applicant |
| US2011/0302587(A1) | 2011-12-01 | Nishikawa et al. | Applicant |
| US2011/0307954(A1) | 2011-12-01 | Melnik et al. | Applicant |
| US2011/0307955(A1) | 2011-12-01 | Kaplan et al. | Applicant |
| US2011/0307956(A1) | 2011-12-01 | Yermakov et al. | Applicant |
| US2011/0314546(A1) | 2011-12-01 | Aziz et al. | Applicant |
| US2012/0023593(A1) | 2012-01-01 | Puder et al. | Applicant |
| US2012/0054869(A1) | 2012-03-01 | Yen et al. | Applicant |
| US2012/0066698(A1) | 2012-03-01 | Yanoo | Applicant |
| US2012/0079596(A1) | 2012-03-01 | Thomas et al. | Applicant |
| US2012/0084859(A1) | 2012-04-01 | Radinsky et al. | Applicant |
| US2012/0110667(A1) | 2012-05-01 | Zubrilin et al. | Applicant |
| US2012/0117652(A1) | 2012-05-01 | Manni et al. | Applicant |
| US2012/0121154(A1) | 2012-05-01 | Xue et al. | Applicant |
| US2012/0124426(A1) | 2012-05-01 | Maybee et al. | Applicant |
| US2012/0174186(A1) | 2012-07-01 | Aziz et al. | Applicant |
| US2012/0174196(A1) | 2012-07-01 | Bhogavilli et al. | Applicant |
| US2012/0174218(A1) | 2012-07-01 | McCoy et al. | Applicant |
| US2012/0198279(A1) | 2012-08-01 | Schroeder | Applicant |
| US2012/0210423(A1) | 2012-08-01 | Friedrichs et al. | Applicant |
| US2012/0222121(A1) | 2012-08-01 | Staniford et al. | Applicant |
| US2012/0255015(A1) | 2012-10-01 | Sahita et al. | Applicant |
| US2012/0255017(A1) | 2012-10-01 | Sallam | Applicant |
| US2012/0260342(A1) | 2012-10-01 | Dube et al. | Applicant |
| US2012/0266244(A1) | 2012-10-01 | Green et al. | Applicant |
| US2012/0278886(A1) | 2012-11-01 | Luna | Applicant |
| US2012/0297489(A1) | 2012-11-01 | Dequevy | Applicant |
| US2012/0330801(A1) | 2012-12-01 | McDougal et al. | Applicant |
| US2013/0014259(A1) | 2013-01-01 | Gribble et al. | Applicant |
| US2013/0036472(A1) | 2013-02-01 | Aziz | Applicant |
| US2013/0047257(A1) | 2013-02-01 | Aziz | Applicant |
| US2013/0074185(A1) | 2013-03-01 | McDougal et al. | Applicant |
| US2013/0086684(A1) | 2013-04-01 | Mohler | Applicant |
| US2013/0097699(A1) | 2013-04-01 | Balupari et al. | Applicant |
| US2013/0097706(A1) | 2013-04-01 | Titonis et al. | Applicant |
| US2013/0111587(A1) | 2013-05-01 | Goel et al. | Applicant |
| US2013/0117852(A1) | 2013-05-01 | Stute | Applicant |
| US2013/0117855(A1) | 2013-05-01 | Kim et al. | Applicant |
| US2013/0139264(A1) | 2013-05-01 | Brinkley et al. | Applicant |
| US2013/0160125(A1) | 2013-06-01 | Likhachev et al. | Applicant |
| US2013/0160127(A1) | 2013-06-01 | Jeong et al. | Applicant |
| US2013/0160130(A1) | 2013-06-01 | Mendelev et al. | Applicant |
| US2013/0160131(A1) | 2013-06-01 | Madou et al. | Applicant |
| US2013/0167236(A1) | 2013-06-01 | Sick | Applicant |
| US2013/0174214(A1) | 2013-07-01 | Duncan | Applicant |
| US2013/0185789(A1) | 2013-07-01 | Hagiwara et al. | Applicant |
| US2013/0185795(A1) | 2013-07-01 | Winn et al. | Applicant |
| US2013/0185798(A1) | 2013-07-01 | Saunders et al. | Applicant |
| US2013/0191915(A1) | 2013-07-01 | Antonakakis et al. | Applicant |
| US2013/0196649(A1) | 2013-08-01 | Paddon et al. | Applicant |
| US2013/0227691(A1) | 2013-08-01 | Aziz et al. | Applicant |
| US2013/0246370(A1) | 2013-09-01 | Bartram et al. | Applicant |
| US2013/0263260(A1) | 2013-10-01 | Mahaffey et al. | Applicant |
| US2013/0291109(A1) | 2013-10-01 | Staniford et al. | Applicant |
| US2013/0298243(A1) | 2013-11-01 | Kumar et al. | Applicant |
| US2014/0019963(A1) | 2014-01-01 | Deng | Examiner |
| US2014/0053260(A1) | 2014-02-01 | Gupta et al. | Applicant |
| US2014/0053261(A1) | 2014-02-01 | Gupta et al. | Applicant |
| US2014/0130158(A1) | 2014-05-01 | Wang et al. | Applicant |
| US2014/0137180(A1) | 2014-05-01 | Lukacs et al. | Applicant |
| US2014/0169762(A1) | 2014-06-01 | Ryu | Applicant |
| US2014/0179360(A1) | 2014-06-01 | Jackson et al. | Applicant |
| US2014/0328204(A1) | 2014-11-01 | Klotsche et al. | Applicant |
| US2014/0337836(A1) | 2014-11-01 | Ismael | Applicant |
| US2014/0351935(A1) | 2014-11-01 | Shao et al. | Applicant |
| US2015/0007312(A1) | 2015-01-01 | Pidathala | Examiner |
| US2015/0096025(A1) | 2015-04-01 | Ismael | Applicant |
| US2015/0242627(A1) | 2015-08-01 | Lee | Examiner |
| US2017/0295089(A1) | 2017-10-01 | Saltsidis | Examiner |
| GB2439806(A) | 2008-01-01 | Applicant | |
| GB2490431(A) | 2012-10-01 | Applicant | |
| WO223805(A2) | 2002-03-01 | Applicant | |
| WO206928 | 2003-11-01 | Applicant | |
| WO2007117636(A2) | 2007-10-01 | Applicant | |
| WO2008041950(A2) | 2008-04-01 | Applicant | |
| WO2011084431(A2) | 2011-07-01 | Applicant | |
| WO2011/112348(A1) | 2011-09-01 | Applicant | |
| WO2012/075336(A1) | 2012-06-01 | Applicant | |
| WO2012145066(A1) | 2012-10-01 | Applicant | |
| WO2013/067505(A1) | 2013-05-01 | Applicant |
Non-Patent Literature (81)
- Marchette, David J., Computer Intrusion Detection and Network Monitoring: A Statistical (“Marchette”), (2001).Applicant
- Margolis, P.E., “Random House Webster's 'Computer & Internet Dictionary 3rd Edition”, ISBN 0375703519, (Dec. 1998).Applicant
- Moore, D., et al., “Internet Quarantine: Requirements for Containing Self-Propagating Code”, Infocom, vol. 3, (Mar. 30-Apr. 3, 2003), pp. 1901-1910.Applicant
- Morales, Jose A., et al., ““Analyzing and exploiting network behaviors of nnalware.””, Security and Privacy in Communication Networks. Springer Berlin Heidelberg, 2010. 20-34.Applicant
- Mori, Detecting Unknown Computer Viruses, 2004, Springer-Verlag Berlin Heidelberg.Applicant
- Natvig, Kurt, “SandboxII: Internet”, Virus Bulletin Conference, (“Natvig”), (Sep. 2002).Applicant
- NetBIOS Working Group. Protocol Standard for a NetBIOS Service on a TCP/UDP transport: Concepts and Methods. STD 19, RFC 1001, Mar. 1987.Applicant
- Newsome, J., et al., “Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software”, In Proceedings of the 12th Annual Network and Distributed System Security, Symposium (NDSS '05), (Feb. 2005).Applicant
- Newsome, J., et al., “Polygraph: Automatically Generating Signatures for Polymorphic Worms”, In Proceedings of the IEEE Symposium on Security and Privacy, (May 2005).Applicant
- Nojiri, D. , et al., “Cooperation Response Strategies for Large Scale Attack Mitigation”, DARPA Information Survivability Conference and Exposition, vol. 1, (Apr. 22-24, 2003), pp. 293-302.Applicant
- Oberheide et al., CloudAV.sub.--N-Version Antivirus in the Network Cloud, 17th USENIX Security Symposium USENIX Security '08 Jul. 28-Aug. 1, 2008 San Jose, CA.Applicant
- Peter M. Chen, and Brian D. Noble, “When Virtual Is Better Than Real, Department of Electrical Engineering and Computer Science”, University of Michigan (“Chen”).Applicant
- Reiner Sailer, Enriquillo Valdez, Trent Jaeger, Roonald Perez, Leendert van Doom, John Linwood Griffin, Stefan Berger., sHype: Secure Hypervisor Approach to Trusted Virtualized Systems (Feb. 2, 2005) (“Sailer”).Applicant
- Silicon Defense, “Worm Containment in the Internal Network”, (Mar. 2003), pp. 1-25.Applicant
- Singh, S., et al., “Automated Worm Fingerprinting”, Proceedings of the ACM/USENIX Symposium on Operating System Design and Implementation, San Francisco, California, (Dec. 2004).Applicant
- Spitzner, Lance, “Honeypots: Tracking Hackers”, (“Spizner”), (Sep. 17, 2002).Applicant
- The Sniffers's Guide to Raw Traffic available at: yuba.stanford.edu/˜casado/pcap/sectionl.html, (Jan. 6, 2014).Applicant
- Thomas H. Ptacek, and Timothy N. Newsham , “Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection”, Secure Networks, (“Ptacek”), (Jan. 1998).Applicant
- U.S. Appl. No. 11/717,475, filed Mar. 12, 2007 Final Office Action dated Feb. 27, 2013.Applicant
- U.S. Appl. No. 11/717,475, filed Mar. 12, 2007 Final Office Action dated Nov. 22, 2010.Applicant
- U.S. Appl. No. 11/717,475, filed Mar. 12, 2007 Non-Final Office Action dated Aug. 28, 2012.Applicant
- U.S. Appl. No. 11/717,475, filed Mar. 12, 2007 Non-Final Office Action dated May 6, 2010.Applicant
- U.S. Appl. No. 14/059,381, filed Oct. 21, 2013 Non-Final Office Action dated Oct. 29, 2014.Applicant
- U.S. Pat. No. 8,171,553 filed Apr. 20, 2006, Inter Parties Review Decision dated Jul. 10, 2015.Applicant
- U.S. Pat. No. 8,291,499 filed Mar. 16, 2012, Inter Parties Review Decision dated Jul. 10, 2015.Applicant
- Venezia, Paul, “NetDetector Captures Intrusions”, InfoWorld Issue 27, (“Venezia”), (Jul. 14, 2003).Applicant
- Wahid et al., Characterising the Evolution in Scanning Activity of Suspicious Hosts, Oct. 2009, Third International Conference on Network and System Security, pp. 344-350.Applicant
- Whyte, et al., “DNS-Based Detection of Scanning Works in an Enterprise Network”, Proceedings of the 12th Annual Network and Distributed System Security Symposium, (Feb. 2005), 15 pages.Applicant
- Williamson, Mathew M., “Throttling Virses: Restricting Propagation to Defeat Malicious Mobile Code”, ACSAC Conference, Las Vegas, NV, USA, (Dec. 2002), pp. 1-9.Applicant
- Yuhei Kawakoya et al: “Memory behavior-based automatic malware unpacking in stealth debugging environment”, Malicious and Unwanted Software (Malware), 2010 5th International Conference on, IEEE, Piscataway, NJ, USA, Oct. 19, 2010, pp. 39-46, XP031833827, ISBN:978-1-4244-8-9353-1.Applicant
- Zhang et al., The Effects of Threading, Infection Time, and Multiple-Attacker Collaboration on Malware Propagation, Sep. 2009, IEEE 28th International Symposium on Reliable Distributed Systems, pp. 73-82.Applicant
- “Network Security: NetDetector—Network Intrusion Forensic System (NIFS) Whitepaper”, (“NetDetector Whitepaper”), (2003).Applicant
- “Packet”, Microsoft Computer Dictionary Microsoft Press, (Mar. 2002), 1 page.Applicant
- “When Virtual is Better Than Real”, IEEEXplore Digital Library, available at, http://ieeexplore.ieee.org/xpl/articleDetails.jso?reload=true&arnumber=990073, (Dec.7, 2013).Applicant
- Abdullah, et al., Visualizing Network Data for Intrusion Detection, 2005 IEEE Workshop on Information Assurance and Security, pp. 100-108.Applicant
- Adetoye, Adedayo, et al., “Network Intrusion Detection & Response System”, (“Adetoye”) (Sep. 2003).Applicant
- Adobe Systems Incorporated, “PDF 32000-1:2008, Document management—Portable document format—Part1:PDF 1.7”, First Edition, Jul. 1, 2008, 756 pages.Applicant
- AltaVista Advanced Search Results. “attack vector identifier” Http://www.altavista.com/web/results?ltag=ody&pg=aq&aqmode=aqa=Event+Orchestrator . . . , (Accessed on Sep. 15, 2009).Applicant
- AltaVista Advanced Search Results. “Event Orchestrator”. Http://www.altavista.com/web/results?ltag=ody&pg=aq&aqmode=aqa=Event+Orchesrator . . . , (Accessed on Sep. 3, 2009).Applicant
- Apostolopoulos, George; hassapis, Constantinos; “V-eM: A cluster of Virtual Machines for Robust, Detailed, and High-Performance Network Emulation”, 14th IEEE International Symposium on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, Sep. 11-14, 2006, pp. 117-126.Applicant
- Aura, Tuomas, “Scanning electronic documents for personally identifiable information”, Proceedings of the 5th ACM workshop on Privacy in electronic society. ACM, 2006.Applicant
- Aziz, Ashar, System and Method for Malware Containment, U.S. Appl. No. 14/620,060, filed Feb. 11, 2015, non-Final Office Action dated Apr. 3, 2015.Applicant
- Baecher, “The Nepenthes Platform: An Efficient Approach to collect Malware”, Springer-verlaq Berlin Heidelberg, (2006), pp. 165-184.Applicant
- Baldi, Mario; Risso, Fulvio; “A Framework for Rapid Development and Portable Execution of Packet-Handling Applications”, 5th IEEE International Symposium Processing and Information Technology, Dec. 21, 2005, pp. 233-238.Applicant
- Bayer, et al., “Dynamic Analysis of Malicious Code”, J Comput Virol, Springer-Verlag, France., (2006), pp. 67-77.Applicant
- Boubalos, Chris , “extracting syslog data out of raw pcap dumps, seclists.org, Honeypots mailing list archives”, available at http://seclists,org/honeypots/2003/q2/319 (“Boubalos”), (Jun. 5, 2003).Applicant
- Chaudet, C., et al., “Optimal Positioning of Active and Passive Monitoring Devices”, International Conference on Emerging Networking Experiments and Technologies, Proceedings of the 2005 ACM Conference on Emerging Network Experiment and Technology, CoNEXT '05, Toulousse, France, (Oct. 2005), pp. 71-82.Applicant
- Cisco “Intrusion Prevention for the Cisco ASA 5500-x Series” Data Sheet (2012).Applicant
- Cisco, Configuring the Catalyst Switched Port Analyzer (SPAN) (“Cisco”), (1992-2003).Applicant
- Clark, John, Sylvian Leblanc,and Scott Knight. “Risks associated with usb hardware trojan devices used by insiders.” Systems Conference (SysCon), 2011 IEEE International. IEEE, 2011.Applicant
- Cohen, M.I., “PyFlag—An advanced network forensic framework”, Digital investigation 5, Elsevier, (2008), pp. S112-S120.Applicant
- Costa, M., et al., “Vigilante: End-to-End Containment of Internet Worms”, SOSP '05 Association for Computing Machinery, Inc., Brighton U.K., (Oct. 23-26, 2005).Applicant
- Crandall, J.R., et al., “Minos:Control Data Attack Prevention Orthogonal to Memory Model”, 37th International Symposium on Microarchitecture, Portland, Oregon, (Dec. 2004).Applicant
- Deutsch, P., “”Zlib compressed data format specification version 3.3“ RFC 1950, (1996)”.Applicant
- Distler, “Malware Analysis: An Introduction”, SANS Institute InfoSec Reading Room, SANS Institute, (2007).Applicant
- Dunlap, George W. , et al., “ReVirt: Enabling Intrusion Analysis through Virtual-Machine Logging and Replay”, Proceeding of the 5th Symposium on Operating Systems Design and Implementation, USENIX Association, (“Dunlap”), (Dec. 9, 2002).Applicant
- Excerpt regarding First Printing Date for Merike Kaeo, Designing Network Security (“Kaeo”), (2005).Applicant
- Filiol, Eric , et al., “Combinatorial Optimisation of Worm Propagation on an Unknown Network”, International Journal of Computer Science 2.2 (2007).Applicant
- FireEye Malware Analysis & Exchange Network, Malware Protection System, FireEye Inc., 2010.Applicant
- FireEye Malware Analysis, Modern Malware Forensics, FireEye Inc., 2010.Applicant
- FireEye v.6.0 Security Target, pp. 1-35, Version 1.1, FireEye Inc., May 2011.Applicant
- Gibler, Clint, et al. AndroidLeaks: automatically detecting potential privacy leaks in android applications on a large scale. Springer Berlin Heidelberg, 2012.Applicant
- Goel, et al., Reconstructing System State for Intrusion Analysis, Apr. 2008 SIGOPS Operating Systems Review vol. 42 Issue 3, pp. 21-28.Applicant
- Gregg Keizer: “Microsoft's HoneyMonkeys Show Patching Windows Works”, Aug. 8, 2005, XP055143386, Retrieved from the Internet: URL:https://web.archive.org/web/20121022220617/http://www.informationweek- .com/microsofts-honeymonkeys-show-patching-wi/167600716 [retrieved on Sep. 29, 2014].Applicant
- Heng Yin et al, Panorama: Capturing System-Wide Information Flow for Malware Detection and Analysis, Research Showcase © CMU, Carnegie Mellon University, 2007.Applicant
- Hjelmvik, Erik, “Passive Network Security Analysis with NetworkMiner”, (IN)Secure, Issue 18, (Oct. 2008), pp. 1-100.Applicant
- Idika et al., A-Survey-of-Malware-Detection-Techniques, Feb. 2, 2007, Department of Computer Science, Purdue University.Applicant
- IEEE Xplore Digital Library Sear Results for “detection of unknown computer worms”. Http//ieeexplore.ieee.org/searchresult.jsp?SortField=Score&SortOrder=desc&ResultC . . . (Accessed on Aug. 28, 2009).Applicant
- Isohara, Takamasa, Keisuke Takemori, and Ayumu Kubota. “Kernel-based behavior analysis for android malware detection.” Computational intelligence and Security (CIS), 2011 Seventh International Conference on. IEEE, 2011.Applicant
- Kaeo, Merike, “Designing Network Security”, (“Kaeo”), (Nov. 2003).Applicant
- Kevin A Roundy et al: “Hybrid Analysis and Control of Malware”, Sep. 15, 2010, Recent Advances in Intrusion Detection, Springer Berlin Heidelberg, Berlin, Heidelberg, pp. 317-338, XP019150454 ISBN:978-3-642-15511-6.Applicant
- Kim, H., et al., “Autograph: Toward Automated, Distributed Worm Signature Detection”, Proceedings of the 13th Usenix Security Symposium (Security 2004), San Diego, (Aug. 2004), pp. 271-286.Applicant
- King, Samuel T., et al., “Operating System Support for Virtual Machines”, (“King”).Applicant
- Krasnyansky, Max, et al., Universal TUN/TAP driver, available at https://www.kernel.org/doc/Documentation/networking/tuntap.txt (2002) (“Krasnyansky”).Applicant
- Kreibich, C., et al., “Honeycomb-Creating Intrusion Detection Signatures Using Honeypots”, 2nd Workshop on Hot Topics in Networks (HotNets-11), Boston, USA, (2003).Applicant
- Kristoff, J., “Botnets, Detection and Mitigation: DNS-Based Techniques”, NU Security Day, (2005), 23 pages.Applicant
- Leading Colleges Select FireEye to Stop Malware-Related Data Breaches, FireEye Inc., 2009.Applicant
- Li et al., A VMM-Based System Call Interposition Framework for Program Monitoring, Dec. 2010, IEEE 16th International Conference on Parallel and Distributed Systems, pp. 706-711.Applicant
- Liljenstam, Michael, et al., “Simulating Realistic Network Traffic for Worm Warning System Design and Testing”, Institute for Security Technology studies, Dartmouth College, (“Liljenstam”), (Oct. 27, 2003).Applicant
- Lindorter, Martina, Clemens Kolbitsch, and Paolo Milani Comparetti. “Detecting environment-sensitive malware.” Recent Advances in Intrusion Detection. Springer Berlin Heidelberg, 2011.Applicant
- Lok Kwong et al: “DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis”, Aug. 10, 2012, XP055158513, Retrieved from the Internet: URL:https://www.usenix.org/system/files/conference/usenixsecurity12/sec12- -final107.pdf [retrieved on Dec. 15, 2014].Applicant